File name:

Retrac.Launcher_1.0.20_x64_en-US.msi

Full analysis: https://app.any.run/tasks/ba09a2d5-5be4-4f1c-aad6-a315cd9c7d71
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 01, 2025, 16:18:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
loader
github
discord
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Retrac Launcher, Author: retrac, Keywords: Installer, Comments: This installer database contains the logic and data required to install Retrac Launcher., Template: x64;0, Revision Number: {9C0108FB-123F-402E-BE6E-952F9675CB5C}, Create Time/Date: Sat Jan 25 15:54:14 2025, Last Saved Time/Date: Sat Jan 25 15:54:14 2025, Number of Pages: 450, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5:

950D02BAC3C4B74DB88DC490DD532232

SHA1:

3ABCF285A025772FC8E61F7C0CB04CC4B4A44E0E

SHA256:

2D757F0266C30D807C65301A3D8CF036DB3E7B450A40A1E85AA79894FE138DE3

SSDEEP:

98304:4z7WBKlkY5FEmybILtDfChesgllZReUPFGZEitv6WLXF/y6p1IGORqLKumDJ8jIa:mLdiNXks

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6184)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 2996)

    • Scans artifacts that could help determine the target

      • msedgewebview2.exe (PID: 7000)

    • The DLL Hijacking

      • msedgewebview2.exe (PID: 1796)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 6320)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6908)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 6908)

    • Manipulates environment variables

      • powershell.exe (PID: 6184)

    • Starts process via Powershell

      • powershell.exe (PID: 6184)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 6184)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 6908)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6184)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 6184)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)
      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 4308)
      • setup.exe (PID: 6092)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)
      • MicrosoftEdgeUpdate.exe (PID: 2996)

    • Executable content was dropped or overwritten

      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • powershell.exe (PID: 6184)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 4308)
      • setup.exe (PID: 6092)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6352)
      • MicrosoftEdgeUpdate.exe (PID: 3732)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2324)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 440)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 2996)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 4628)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • msiexec.exe (PID: 6292)
      • msedgewebview2.exe (PID: 7000)
      • Retrac Launcher.exe (PID: 6624)

    • Application launched itself

      • setup.exe (PID: 6092)
      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • msedgewebview2.exe (PID: 7000)

    • Creates a software uninstall entry

      • setup.exe (PID: 6092)

    • Searches for installed software

      • setup.exe (PID: 6092)

  • INFO

    • An automatically generated document

      • msiexec.exe (PID: 6808)

    • Checks supported languages

      • msiexec.exe (PID: 6908)
      • msiexec.exe (PID: 6292)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)
      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 440)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2324)
      • MicrosoftEdgeUpdate.exe (PID: 536)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6352)
      • MicrosoftEdgeUpdate.exe (PID: 3732)
      • MicrosoftEdgeUpdate.exe (PID: 848)
      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 4308)
      • MicrosoftEdgeUpdate.exe (PID: 1328)
      • setup.exe (PID: 6092)
      • setup.exe (PID: 6352)
      • Retrac Launcher.exe (PID: 6624)
      • msedgewebview2.exe (PID: 7000)
      • msedgewebview2.exe (PID: 2088)
      • msedgewebview2.exe (PID: 4804)
      • msedgewebview2.exe (PID: 1796)
      • msedgewebview2.exe (PID: 4544)
      • msedgewebview2.exe (PID: 6460)
      • identity_helper.exe (PID: 7360)

    • Reads the computer name

      • msiexec.exe (PID: 6908)
      • msiexec.exe (PID: 6292)
      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • MicrosoftEdgeUpdate.exe (PID: 3732)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6352)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2324)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 440)
      • MicrosoftEdgeUpdate.exe (PID: 536)
      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • MicrosoftEdgeUpdate.exe (PID: 848)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 4308)
      • setup.exe (PID: 6092)
      • MicrosoftEdgeUpdate.exe (PID: 1328)
      • Retrac Launcher.exe (PID: 6624)
      • msedgewebview2.exe (PID: 7000)
      • msedgewebview2.exe (PID: 1796)
      • msedgewebview2.exe (PID: 2088)
      • identity_helper.exe (PID: 7360)

    • Manages system restore points

      • SrTasks.exe (PID: 4640)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6808)
      • msiexec.exe (PID: 6908)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6908)

    • Disables trace logs

      • powershell.exe (PID: 6184)

    • Checks proxy server information

      • powershell.exe (PID: 6184)
      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • MicrosoftEdgeUpdate.exe (PID: 536)
      • MicrosoftEdgeUpdate.exe (PID: 1328)
      • msedgewebview2.exe (PID: 7000)

    • The executable file from the user directory is run by the Powershell process

      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)
      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • msedgewebview2.exe (PID: 7000)

    • The sample compiled with english language support

      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)
      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • powershell.exe (PID: 6184)
      • setup.exe (PID: 6092)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 4308)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 4308)
      • setup.exe (PID: 6092)
      • setup.exe (PID: 6352)
      • msedgewebview2.exe (PID: 7000)
      • msedgewebview2.exe (PID: 2088)
      • msedgewebview2.exe (PID: 4544)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 536)
      • MicrosoftEdgeUpdate.exe (PID: 1328)
      • msedgewebview2.exe (PID: 7000)
      • identity_helper.exe (PID: 7360)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • setup.exe (PID: 6092)
      • msiexec.exe (PID: 6292)
      • msedgewebview2.exe (PID: 6460)
      • msedgewebview2.exe (PID: 7000)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • MicrosoftEdgeUpdate.exe (PID: 536)
      • MicrosoftEdgeUpdate.exe (PID: 1328)

    • Reads the machine GUID from the registry

      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • msedgewebview2.exe (PID: 7000)

    • Application launched itself

      • msedge.exe (PID: 2736)
      • msedge.exe (PID: 7552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Retrac Launcher
Author: retrac
Keywords: Installer
Comments: This installer database contains the logic and data required to install Retrac Launcher.
Template: x64;0
RevisionNumber: {9C0108FB-123F-402E-BE6E-952F9675CB5C}
CreateDate: 2025:01:25 15:54:14
ModifyDate: 2025:01:25 15:54:14
Pages: 450
Words: 2
Software: Windows Installer XML Toolset (3.11.2.4516)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
199
Monitored processes
64
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
440"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.43\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
536"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7MEQyNzk5N0ItRjUxMy00RTE4LTk5RDYtRTRGODM5NTI1MEM1fSIgdXNlcmlkPSJ7RjZDRDkwMTAtNzFFMC00RDlFLTg1OEMtRjk1QjcwMjQ0QUM2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDOUU4MDQwNi0wRDJCLTQyNzEtODQ5OS1GMjYwNkQ3MUIyMUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjQwNDYiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE5NS40MyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMwNjIxNzkyNTQiIGluc3RhbGxfdGltZV9tcz0iNTYyIi8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
848"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=false" /installsource otherinstallcmd /sessionid "{0D27997B-F513-4E18-99D6-E4F8395250C5}" /silentC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1200"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3568 --field-trial-handle=2420,i,16478664053949365391,9469135455950372574,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1224"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3516 --field-trial-handle=2420,i,16478664053949365391,9469135455950372574,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1328"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7MEQyNzk5N0ItRjUxMy00RTE4LTk5RDYtRTRGODM5NTI1MEM1fSIgdXNlcmlkPSJ7RjZDRDkwMTAtNzFFMC00RDlFLTg1OEMtRjk1QjcwMjQ0QUM2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBRDVCMEM3My0xMDk2LTQ5MTktOTQ1Ny1ENUY5NDFEMDQyRDh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjQwNDYiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMzIuMC4yOTU3LjE0MCIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzA3NDI0ODU2NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzMDc0MjQ4NTY1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM0NzcwNjg2NDQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5MDMxNTMzJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWlmT1ZTb092VXlBemtBcHgyMUZEQXRKQ2ZSJTJmTldnQ2w0RHBZMGpZcjh1MW1DZmFqM1NFME1kS2JaZHlSMEE0NDZjbnJTcFJ4eGZsblFyU1VzQzlOVUElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIGRvd25sb2FkX3RpbWVfbXM9IjM2MzU3Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM0NzcyMjE4ODEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzQ5NjU5ODYxMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM4Njk2OTMyODUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI1NjUiIGRvd25sb2FkX3RpbWVfbXM9IjQwMjgyIiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM3Mjk0Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1400"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5328 --field-trial-handle=2420,i,16478664053949365391,9469135455950372574,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1796"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1844,i,7942843946748792039,16334747974892594821,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:2C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Exit code:
0
Version:
132.0.2957.140
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2072"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2416 --field-trial-handle=2420,i,16478664053949365391,9469135455950372574,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2088"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2096,i,7942843946748792039,16334747974892594821,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:3C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Exit code:
0
Version:
132.0.2957.140
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
25 900
Read events
23 158
Write events
2 657
Delete events
85

Modification events

(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000087E92E9C474DB01FC1A000074120000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000087E92E9C474DB01FC1A000074120000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000074678AEAC474DB01FC1A000074120000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000074678AEAC474DB01FC1A000074120000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000008FF593EAC474DB01FC1A000074120000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000892D8FEAC474DB01FC1A000074120000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000041BEF5EAC474DB01FC1A0000F8170000E80300000100000000000000000000009F98AA3BB5CCEF4E974783FAD29A149100000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000F05AF3EAC474DB01FC1A000074120000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6320) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000001939FFEAC474DB01B018000084060000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
226
Suspicious files
328
Text files
82
Unknown types
1

Dropped files

PID
Process
Filename
Type
6908msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6908msiexec.exeC:\Windows\Installer\13c0b3.msi —
MD5:—
SHA256:—
6908msiexec.exeC:\Windows\Installer\13c0b5.msi —
MD5:—
SHA256:—
6908msiexec.exeC:\Users\Public\Desktop\Retrac Launcher.lnkbinary
MD5:B0F721B34EA5DBAFE90D7F86BF3117BA
SHA256:08C558B4E550F850F7F2884ECAE0A478F8CB7853CAAFB6FF5BA07EBA4FC1788E
6908msiexec.exeC:\Windows\Installer\MSIC612.tmpbinary
MD5:CE2117C97902FA43C76B1BE3E7DB8CB6
SHA256:11BF6578382A42A75091008ED1957D95B894231AA15C61C712696C620CAFB363
6908msiexec.exeC:\Windows\Temp\~DFA854CF6B317757B5.TMPbinary
MD5:162FEDD546BF339F71757653AAA7FEB5
SHA256:6D1093B59A64BB62337B10DD982EB923298D5A95E4565614217AB3C44ECDE43C
6908msiexec.exeC:\Windows\Temp\~DF72A334DA574E8A9F.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
6908msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:162FEDD546BF339F71757653AAA7FEB5
SHA256:6D1093B59A64BB62337B10DD982EB923298D5A95E4565614217AB3C44ECDE43C
6908msiexec.exeC:\Program Files\Retrac Launcher\Retrac Launcher.exeexecutable
MD5:5FB6C0788B7D173A412CCDAD986D4A6E
SHA256:1C849DCE609B4EF151A3CB352D4003F73A8A65C7F40D41CCB96AF2B60C9814B9
6908msiexec.exeC:\Windows\Installer\{DB60CD67-E332-4FE5-BC15-AC908E8FDF97}\ProductIconimage
MD5:B57F2765879042B033B21C525C289D80
SHA256:B9F884956C9D614CCE40B8E362F814C279AC9C93BBFBA75601587BCD6B7CD117
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
74
DNS requests
69
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
DE
binary
312 b
whitelisted
6540
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
DE
binary
471 b
whitelisted
5096
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
NL
binary
419 b
whitelisted
5096
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
NL
binary
408 b
whitelisted
2512
svchost.exe
GET
200
199.232.210.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739031533&P2=404&P3=2&P4=ifOVSoOvUyAzkApx21FDAtJCfR%2fNWgCl4DpY0jYr8u1mCfaj3SE0MdKbZdyR0A446cnrSpRxxflnQrSUsC9NUA%3d%3d
US
executable
168 Mb
whitelisted
1752
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
2512
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739031533&P2=404&P3=2&P4=ifOVSoOvUyAzkApx21FDAtJCfR%2fNWgCl4DpY0jYr8u1mCfaj3SE0MdKbZdyR0A446cnrSpRxxflnQrSUsC9NUA%3d%3d
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1752
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
92.123.104.65:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
google.com
  • 142.250.74.206
whitelisted
www.bing.com
  • 92.123.104.65
  • 92.123.104.7
  • 92.123.104.58
  • 92.123.104.64
  • 92.123.104.54
  • 92.123.104.59
  • 92.123.104.6
  • 92.123.104.53
  • 92.123.104.47
  • 92.123.104.36
  • 92.123.104.37
  • 92.123.104.46
  • 92.123.104.38
  • 92.123.104.41
  • 92.123.104.63
  • 92.123.104.62
  • 92.123.104.35
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.130
  • 40.126.32.136
  • 40.126.32.138
  • 20.190.160.22
  • 20.190.160.5
  • 20.190.160.66
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 23.35.238.131
  • 184.28.89.167
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
arc.msn.com
  • 20.223.36.55
  • 20.31.169.57
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2512
svchost.exe
Misc activity
ET INFO Packed Executable Download
2088
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2088
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2088
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
2088
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
2088
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2088
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2088
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2088
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6636
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
Process
Message
msedgewebview2.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\site.retrac directory exists )
Retrac Launcher.exe
Warning: AddWebResourceRequestedFilter without SourceKind parameter is deprecated! It does not behave as expected for iframes.Please use AddWebResourceRequestedFilterWithRequestSourceKinds instead. For more information, please see https://go.microsoft.com/fwlink/?linkid=2286319
Retrac Launcher.exe
Warning: AddWebResourceRequestedFilter without SourceKind parameter is deprecated! It does not behave as expected for iframes.Please use AddWebResourceRequestedFilterWithRequestSourceKinds instead. For more information, please see https://go.microsoft.com/fwlink/?linkid=2286319
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Retrac.Launcher_1.0.20_x64_en-US.msi