Analysis
- user interaction
yes - max time kernel
78s - max time network
66s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 19:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Retrac_3.0.13_x64_en-US.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
Retrac_3.0.13_x64_en-US.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target Retrac_3.0.13_x64_en-US.msi
- Size 14.4MB
- Sample260930-x6lphsscjf
- SHA256 eeac210d8ec932ed9321d14894cc258b9ff1326269cf5b5f2a32f546b5bacb5d
- MD5 c5dcedf519425df5b725eb904500c0c4
- SHA1 e8077f60735e924620bc3a276e26d1bc6ac80723
- SHA512 290c0438a6c9f8b7ddecbb4b357625c9a86d61b7c734286bc9416314eb2a9cf283a956c74b1a9b6464f9c4e6189b429f07a8b8d7ed64ac6f6cb77e87dce786c8
- SSDEEP 393216:6iT0PlLJ0/XBZtZW9a81kNBMUD19EFKEprsFDx+iTSH:PT0tG/Xbr6gE8ENeAiO
- TLSH T11BE63353BE45AB24C62D1FBE6472CB4C10363E146B95AC579294BE38ECFB2C04CB59D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3424 retrac.exe - Loads dropped DLL 1 IoCs
pid Process 2868 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 3 236 msiexec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA retrac.exe - Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Retrac\retrac.exe msiexec.exe File created C:\Program Files\Retrac\Uninstall Retrac.lnk msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5a58ef.msi msiexec.exe File created C:\Windows\SystemTemp\~DF2F9F18E8E78EB838.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI5EFA.tmp msiexec.exe File created C:\Windows\Installer\{8638F244-7326-4667-8400-E035604C8B3E}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\{8638F244-7326-4667-8400-E035604C8B3E}\ProductIcon msiexec.exe File created C:\Windows\Installer\e5a58f1.msi msiexec.exe File created C:\Windows\SystemTemp\~DF7821BD03BF064967.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF350B504E20A9A1FF.TMP msiexec.exe File created C:\Windows\Installer\e5a58ef.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF080D4CBE3612FEE2.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{8638F244-7326-4667-8400-E035604C8B3E} msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 236 msiexec.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 retrac.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 retrac.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname retrac.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain retrac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\retrac\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\442F83686237766448000E5306C4B8E3 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\Version = "50331661" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF\442F83686237766448000E5306C4B8E3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\shell\open\command\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\442F83686237766448000E5306C4B8E3\External msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\SourceList\PackageName = "Retrac_3.0.13_x64_en-US.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\DefaultIcon\ = "\"C:\\PROGRA~1\\Retrac\\retrac.exe\",0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\SourceList msiexec.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\retrac\DefaultIcon retrac.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\retrac\shell retrac.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\ProductIcon = "C:\\Windows\\Installer\\{8638F244-7326-4667-8400-E035604C8B3E}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\retrac\DefaultIcon\ = "C:\\Program Files\\Retrac\\retrac.exe,0" retrac.exe Key created \REGISTRY\MACHINE\Software\Classes\retrac\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\retrac msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\442F83686237766448000E5306C4B8E3\Environment = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\AuthorizedLUAApp = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\retrac retrac.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\retrac\ = "URL:launcher.retrac.site protocol" retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\retrac\ = "URL: protocol" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\retrac\URL Protocol retrac.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\retrac\shell\open\command retrac.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\retrac\shell\open retrac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\442F83686237766448000E5306C4B8E3\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\PackageCode = "5FA7135E960702F4B97304A91B0AD521" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D39F67BF21D37C75581F63A03A3CC6BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\442F83686237766448000E5306C4B8E3\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\ProductName = "Retrac" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\442F83686237766448000E5306C4B8E3\SourceList\Media msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\retrac\shell\open\command\ = "\"C:\\Program Files\\Retrac\\retrac.exe\" \"%1\"" retrac.exe - Modifies system certificate store 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 retrac.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3328 msiexec.exe 3328 msiexec.exe 3424 retrac.exe 3424 retrac.exe 3424 retrac.exe 3424 retrac.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 5920 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 236 msiexec.exe Token: SeIncreaseQuotaPrivilege 236 msiexec.exe Token: SeSecurityPrivilege 3328 msiexec.exe Token: SeCreateTokenPrivilege 236 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 236 msiexec.exe Token: SeLockMemoryPrivilege 236 msiexec.exe Token: SeIncreaseQuotaPrivilege 236 msiexec.exe Token: SeMachineAccountPrivilege 236 msiexec.exe Token: SeTcbPrivilege 236 msiexec.exe Token: SeSecurityPrivilege 236 msiexec.exe Token: SeTakeOwnershipPrivilege 236 msiexec.exe Token: SeLoadDriverPrivilege 236 msiexec.exe Token: SeSystemProfilePrivilege 236 msiexec.exe Token: SeSystemtimePrivilege 236 msiexec.exe Token: SeProfSingleProcessPrivilege 236 msiexec.exe Token: SeIncBasePriorityPrivilege 236 msiexec.exe Token: SeCreatePagefilePrivilege 236 msiexec.exe Token: SeCreatePermanentPrivilege 236 msiexec.exe Token: SeBackupPrivilege 236 msiexec.exe Token: SeRestorePrivilege 236 msiexec.exe Token: SeShutdownPrivilege 236 msiexec.exe Token: SeDebugPrivilege 236 msiexec.exe Token: SeAuditPrivilege 236 msiexec.exe Token: SeSystemEnvironmentPrivilege 236 msiexec.exe Token: SeChangeNotifyPrivilege 236 msiexec.exe Token: SeRemoteShutdownPrivilege 236 msiexec.exe Token: SeUndockPrivilege 236 msiexec.exe Token: SeSyncAgentPrivilege 236 msiexec.exe Token: SeEnableDelegationPrivilege 236 msiexec.exe Token: SeManageVolumePrivilege 236 msiexec.exe Token: SeImpersonatePrivilege 236 msiexec.exe Token: SeCreateGlobalPrivilege 236 msiexec.exe Token: SeCreateTokenPrivilege 236 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 236 msiexec.exe Token: SeLockMemoryPrivilege 236 msiexec.exe Token: SeIncreaseQuotaPrivilege 236 msiexec.exe Token: SeMachineAccountPrivilege 236 msiexec.exe Token: SeTcbPrivilege 236 msiexec.exe Token: SeSecurityPrivilege 236 msiexec.exe Token: SeTakeOwnershipPrivilege 236 msiexec.exe Token: SeLoadDriverPrivilege 236 msiexec.exe Token: SeSystemProfilePrivilege 236 msiexec.exe Token: SeSystemtimePrivilege 236 msiexec.exe Token: SeProfSingleProcessPrivilege 236 msiexec.exe Token: SeIncBasePriorityPrivilege 236 msiexec.exe Token: SeCreatePagefilePrivilege 236 msiexec.exe Token: SeCreatePermanentPrivilege 236 msiexec.exe Token: SeBackupPrivilege 236 msiexec.exe Token: SeRestorePrivilege 236 msiexec.exe Token: SeShutdownPrivilege 236 msiexec.exe Token: SeDebugPrivilege 236 msiexec.exe Token: SeAuditPrivilege 236 msiexec.exe Token: SeSystemEnvironmentPrivilege 236 msiexec.exe Token: SeChangeNotifyPrivilege 236 msiexec.exe Token: SeRemoteShutdownPrivilege 236 msiexec.exe Token: SeUndockPrivilege 236 msiexec.exe Token: SeSyncAgentPrivilege 236 msiexec.exe Token: SeEnableDelegationPrivilege 236 msiexec.exe Token: SeManageVolumePrivilege 236 msiexec.exe Token: SeImpersonatePrivilege 236 msiexec.exe Token: SeCreateGlobalPrivilege 236 msiexec.exe Token: SeCreateTokenPrivilege 236 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 236 msiexec.exe Token: SeLockMemoryPrivilege 236 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 236 msiexec.exe 236 msiexec.exe 3424 retrac.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 236 msiexec.exe 3328 msiexec.exe 2868 MsiExec.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3328 wrote to memory of 2868 3328 msiexec.exe 89 PID 3328 wrote to memory of 2852 3328 msiexec.exe 94 PID 236 wrote to memory of 3424 236 msiexec.exe 98 PID 3424 wrote to memory of 5920 3424 retrac.exe 99 PID 5920 wrote to memory of 1604 5920 msedgewebview2.exe 100 PID 5920 wrote to memory of 5192 5920 msedgewebview2.exe 101 PID 5920 wrote to memory of 5192 5920 msedgewebview2.exe 101 PID 5920 wrote to memory of 5192 5920 msedgewebview2.exe 101 PID 5920 wrote to memory of 5192 5920 msedgewebview2.exe 101 PID 5920 wrote to memory of 6048 5920 msedgewebview2.exe 102 PID 5920 wrote to memory of 2588 5920 msedgewebview2.exe 103 PID 5920 wrote to memory of 2588 5920 msedgewebview2.exe 103 PID 5920 wrote to memory of 2588 5920 msedgewebview2.exe 103 PID 5920 wrote to memory of 2720 5920 msedgewebview2.exe 104 PID 5920 wrote to memory of 2720 5920 msedgewebview2.exe 104 PID 5920 wrote to memory of 2720 5920 msedgewebview2.exe 104 PID 5920 wrote to memory of 2720 5920 msedgewebview2.exe 104 PID 5920 wrote to memory of 2720 5920 msedgewebview2.exe 104 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Retrac_3.0.13_x64_en-US.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Program Files\Retrac\retrac.exe"C:\Program Files\Retrac\retrac.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3424.2532.8961924781132301714 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView /prefetch:4 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x168,0x194,0x7ffdcc695fd8,0x7ffdcc695fe4,0x7ffdcc695ff04⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1712 --field-trial-handle=1564,i,10320521532470149503,12165741800084251481,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:5192
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1880 --field-trial-handle=1564,i,10320521532470149503,12165741800084251481,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:6048
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1564,i,10320521532470149503,12165741800084251481,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca4⤵PID:2588
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView" --webview-exe-name=retrac.exe --webview-exe-version=3.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3268 --field-trial-handle=1564,i,10320521532470149503,12165741800084251481,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fd0de7e5cefc9f8a2e2a61a11d5c8b08aabc87ca /prefetch:14⤵PID:2720
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 799BDA4B3254963D82CCF516DE0C3F10 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2868
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2852
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4804
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a58f0.rbs
- Size 10KB
- SHA256 c9327d17f01a376d2570a3377bfd100081639babecc662fdff6c939b42af03df
- MD5 6ccf32802a4869504818a5595be13358
- SHA1 0cbdf1adb9c29c796c0cb4211247273d6ac38d16
- SHA512 1577ece3ff41a8b0382da611129213f7e73ea419c1e59f1d89a5add543173d1a2b1c24b62fd5d54e1729c8551ec6bf6c205df82eb080f30fd50b5127745e96d0
- SSDEEP 192:yrEv2lD6BvCGJ/8Gr/8u6xc3PWiiNPpBK:yra2lD6Bp/D/FQdK
- TLSH T15F222101B205C3D3E9536734CB0327243766F7E69B19234B07DE9568AE877C86F9628E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Retrac\retrac.exe
- Size 26.1MB
- SHA256 31f5fac8644a5803759edbd3e53e42bbcf4f8b2ba17b4dd8033582516c3a17f9
- MD5 ddbff854e0044929e354a21327e4f720
- SHA1 bd97e07b8b59b8f9bdaea7047f2623b2c5f09aa6
- SHA512 ce4536e547820efe2021c4051220083a858390e7352690c1c80ca92ef52f9ad1ea686fff847e8bdfdc4cc3a6093971f9acc7da45d65d50c347864b2f3bb5bcb5
- SSDEEP 393216:Ckmizc1w/McqO0BAsPAtdEYOK1Jmii8l+MMuM8MY+M/6sdkhjrB:Ckmi68cPlYx1JNl+MMuM8MY+M/4rB
- TLSH T1C05749217B5AA96DD19AC474834B4A725A7130DB0B35BAFF44C492383F6DBF42F38258
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk
- Size 1KB
- SHA256 8402445705cc2ffdc5361691fd8a8517e78bdc14a2a53466081ef1fa12a82400
- MD5 bf31fa325931a539f3f9cc55f5b1030b
- SHA1 5989f56244174976f18510942169f86b002a8cea
- SHA512 2baac2592dd707301a4169f4d35ae53a4d12dc9f26e3937d53f15d21dd63b103ffa0f422cc4df77af8da372b1df7a5cb393b64244f1dfb27a38f1adf52c34bd9
- TLSH T1C5418E1167E1072AF27356396CF94A219E32BC06E5148F2F4399018B0ABA8019DACF67
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac\Retrac.lnk~RFe5a633f.TMP
- Size 1KB
- SHA256 7628a194865eaa4e050368703ba1c24fb09f6f9e3906a13223c3555a564618ec
- MD5 f05b195909b4f0f1c4f21e6d8a7fd594
- SHA1 c01d665f0c557f30de18720fb63093d0e671dd35
- SHA512 ff50f5e9d1ec36c8b5be016dc599b9a8cab8dcb7d2af3c8f5437ba6e3a67ab5a5517e69a10d9d9a95d3f98e8f09eb3b7102d59a729af8477e43e87d965e48a42
- TLSH T130419D1067F1072AF37357396CE94A219E32BC05E6148F2F4399018B0ABA8119DACF67
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI1435.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 47360adfaed7fbd67ae0a53865f4efb51489caae9230d43d7a31aa7d735bf249
- MD5 888f1397d23ae01f10676ce8a8696e09
- SHA1 02a5c9d4b2c072e378c095b61baa94037ddaef91
- SHA512 80a48f72b199009d42fe53a0ebf15dd4df3bc30594fab8a37200ca9140d38352fc9a867e353561892d45646a12b6ac57fc4d5eeefce524c5ddeca5382e9096f0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 e3829b891eda70420dc623df580ce4842e0a0a39a2011fa920a4b04202a01877
- MD5 f59c610ac1b37d45465068ff9959c7e3
- SHA1 6d20deefc078455dcff4525603c7c0e4a444d4f2
- SHA512 629e6ee896e909a1619d66c8714b42ff3a79d2444d55f91af707a128889b2aa47a4d0c7e981df691784cbc87511d12a986cf166cdb0d3d946a3ee41b69ceea20
- TLSH T13BD0121232014134C024643304177F0A0584C50B420740449439C95E5B141500D12841
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 fcc546259ea81a07bb54ea674fcb1b2874faf04045a699ec33a5cd3c73007999
- MD5 46602c4a80703bfb9021337faad7bae9
- SHA1 c4f692b34bb81eaebecb96a45eb17b146684eea1
- SHA512 30a88735db8373f432f2cb6e7a5c04b852ed42418151ca4240b5989a6150406b718957f667e97b67e61fe728c9f0c31e1fbb70fd4e67243b98d88f971e39cd88
- TLSH T104A002911671D505C1404AF160C3064832A08D72664A9E1244B007ACFD66381621A019
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a98d6.TMP
- Size 48B
- SHA256 18955a7408e9aeb6a12c02c133140ca4e0896dbc520d66f8853a8e8f6629b7d2
- MD5 cf441ddc08fd3521386811c926d2498c
- SHA1 a19c0216b04b67d417066918bc5b56e569eba7ac
- SHA512 8df1786ab2a8ea3243aa4fef5c29b856d1e310543046829ce1b1c37cfb9a1ed23094ac08313d0c7f80e7950cf73162f1a29c2355fe01fadd2f350fdbfe203ff8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 15KB
- SHA256 43373bb41ea2242d2204175c9d9adcf2f5ecd217c077f7bbe2faeb7005b9b501
- MD5 137e0db6fc2e3382dad5699c055725d7
- SHA1 83760b4b5fccb9c78e677fe2db04b4c54d17edd0
- SHA512 e03cc5c6aebe00144fe786154a4fde345a630c160b95e9823b71b618701b3bfe01492ec64c26fc9c33185ce94d6197d4f9540311d3333c1384efd48f375173eb
- SSDEEP 384:V+aQikB+z/xvxjg/qhE83NBS473vdsrwVp9zj:g/UxvxjgC+8bdMwVpFj
- TLSH T18E729E3759B43D3795F3E504BA5D178BCBF99472A0C26AB84ABD4F0D06C729D0382D52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 2KB
- SHA256 dcc0bf1f7b1c9ea23b8b051019fc00d1ed611b889c5321f3b17456a214e193df
- MD5 efa2b742c6b42a44f1b753f73138ffb0
- SHA1 e3793de0c0061ac71963617f6a54b74b435ea5ea
- SHA512 f200d2d483b1f9cf6945aaa885731ade304ead736566ad4aa4990d6ed146aab41b6cbbcad38fcc37631b19a580c3e90883b7be26ca6009cba6f45e9e18729230
- TLSH T1B851A4336860AB7B99E2C614794F3A239B755062EAA22F14A7ED4B0C02DB11C1382C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State
- Size 3KB
- SHA256 ebce9f539084d431193e7c2440e3447a966e6048d9bc52f10df6d8189bb50c76
- MD5 72d4cc58997c321f0d059621d4a38593
- SHA1 9265e65ed719df94dfa3b7270f15423fb8e31eb9
- SHA512 ad86fccdddc8f772bbe81fd8fa2a36ac6f424c59cf0a1bfb6884834068b4bd15f423ed924554c29989b33b7a1b77619768cc6b621344dfafd1459a8c472a64a4
- TLSH T13C61A53769B0AA7B4DE2D614B88A3B16A7A54023E5D13F98D6EC0F0C01D729C1382C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\launcher.retrac.site\EBWebView\Local State~RFe5a855e.TMP
- Size 1KB
- SHA256 ede8866d833f358b8f304e8e9c65681d6155afdb575d0434e9705861f5ce72c8
- MD5 11665855d02a11bc77004eeb3599acea
- SHA1 238828a139e27fb715d724ea04d3b8f31a3e6235
- SHA512 31f9c0e331a98cd142a90fefa01d7c3b03fd5ab944ae4937a0c2ed40212ece8998ac6a7e9e22fe8f5d79fe665e7ec42fce09a8a9bdfdb56d34614420f98513a1
- TLSH T1C82187B2E4F0AB766C91E155320B7A5B6F701053E2618E0472EECF1C13EB10C96A6C33
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5a58ef.msi
- Size 14.4MB
- SHA256 eeac210d8ec932ed9321d14894cc258b9ff1326269cf5b5f2a32f546b5bacb5d
- MD5 c5dcedf519425df5b725eb904500c0c4
- SHA1 e8077f60735e924620bc3a276e26d1bc6ac80723
- SHA512 290c0438a6c9f8b7ddecbb4b357625c9a86d61b7c734286bc9416314eb2a9cf283a956c74b1a9b6464f9c4e6189b429f07a8b8d7ed64ac6f6cb77e87dce786c8
- SSDEEP 393216:6iT0PlLJ0/XBZtZW9a81kNBMUD19EFKEprsFDx+iTSH:PT0tG/Xbr6gE8ENeAiO
- TLSH T11BE63353BE45AB24C62D1FBE6472CB4C10363E146B95AC579294BE38ECFB2C04CB59D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 f13673415b1b25f1109cb630678e8e0d3f227d4771fa5e3559f57765b708d73f
- MD5 f318431d8b97b4f26fc0e1884a0f00c9
- SHA1 32adeeff01c223680a789bb26fb9bad6dada72c0
- SHA512 a34bb8ed0897dad928ce9014ee0d8a1ef6440b1d0ca85b781b1ab422e835cd53f2fc40cbd4081d51d582ced37efb36410bedef2e676341f9419e25ce4a7cb419
- SSDEEP 24576:EFo3DMPIdoO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+3:9HE
- TLSH T12757B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{de82f390-9ec9-4f97-bd90-ea6101f488a6}_OnDiskSnapshotProp
- Size 6KB
- SHA256 d0a9a07bd3c4673d8c8a14d785c9ca5bfacdccf6c2b68e1b69413fd6134372fd
- MD5 7eda4788c4d5238a9ce38c6a930a7ef4
- SHA1 42d58877a09edbeeac9d1840d364f7cc32c8c3f4
- SHA512 d1a13ed292741c0062339a22518069e943b9f453b1e313a7bd570452b276c44c58ce21de5eed3d13f79a82393c25cda2edfd83c82a81dfb1a834c43c7b580d09
- SSDEEP 96:F7P+Zrvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:xPIb++uVm
- TLSH T183D198085AF54711E2B3AB3128F54557A877B911EF33CB8E0198238F6670A10F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH