File name:

Retrac.Launcher_1.0.20_x64_en-US.msi

Full analysis: https://app.any.run/tasks/ba09a2d5-5be4-4f1c-aad6-a315cd9c7d71
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 01, 2025, 16:18:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
generated-doc
loader
github
discord
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Retrac Launcher, Author: retrac, Keywords: Installer, Comments: This installer database contains the logic and data required to install Retrac Launcher., Template: x64;0, Revision Number: {9C0108FB-123F-402E-BE6E-952F9675CB5C}, Create Time/Date: Sat Jan 25 15:54:14 2025, Last Saved Time/Date: Sat Jan 25 15:54:14 2025, Number of Pages: 450, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
MD5:

950D02BAC3C4B74DB88DC490DD532232

SHA1:

3ABCF285A025772FC8E61F7C0CB04CC4B4A44E0E

SHA256:

2D757F0266C30D807C65301A3D8CF036DB3E7B450A40A1E85AA79894FE138DE3

SSDEEP:

98304:4z7WBKlkY5FEmybILtDfChesgllZReUPFGZEitv6WLXF/y6p1IGORqLKumDJ8jIa:mLdiNXks

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6184)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 2996)

    • The DLL Hijacking

      • msedgewebview2.exe (PID: 1796)

    • Scans artifacts that could help determine the target

      • msedgewebview2.exe (PID: 7000)

  • SUSPICIOUS

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 6184)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6184)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 6908)

    • Starts process via Powershell

      • powershell.exe (PID: 6184)

    • Manipulates environment variables

      • powershell.exe (PID: 6184)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 6908)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6320)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6908)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 6184)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)
      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 4308)
      • setup.exe (PID: 6092)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 6184)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)
      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 4308)
      • setup.exe (PID: 6092)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)
      • MicrosoftEdgeUpdate.exe (PID: 2996)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 3732)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6352)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 440)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2324)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • msiexec.exe (PID: 6292)
      • msedgewebview2.exe (PID: 7000)
      • Retrac Launcher.exe (PID: 6624)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 2996)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 4628)

    • Searches for installed software

      • setup.exe (PID: 6092)

    • Creates a software uninstall entry

      • setup.exe (PID: 6092)

    • Application launched itself

      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • setup.exe (PID: 6092)
      • msedgewebview2.exe (PID: 7000)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 6908)
      • msiexec.exe (PID: 6292)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)
      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • MicrosoftEdgeUpdate.exe (PID: 3732)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6352)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 440)
      • MicrosoftEdgeUpdate.exe (PID: 536)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2324)
      • MicrosoftEdgeUpdate.exe (PID: 848)
      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 4308)
      • MicrosoftEdgeUpdate.exe (PID: 1328)
      • setup.exe (PID: 6092)
      • setup.exe (PID: 6352)
      • Retrac Launcher.exe (PID: 6624)
      • msedgewebview2.exe (PID: 7000)
      • msedgewebview2.exe (PID: 2088)
      • msedgewebview2.exe (PID: 4544)
      • msedgewebview2.exe (PID: 1796)
      • identity_helper.exe (PID: 7360)
      • msedgewebview2.exe (PID: 4804)
      • msedgewebview2.exe (PID: 6460)

    • Reads the computer name

      • msiexec.exe (PID: 6292)
      • msiexec.exe (PID: 6908)
      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • MicrosoftEdgeUpdate.exe (PID: 3732)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 2324)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6352)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 440)
      • MicrosoftEdgeUpdate.exe (PID: 536)
      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 4308)
      • MicrosoftEdgeUpdate.exe (PID: 848)
      • MicrosoftEdgeUpdate.exe (PID: 1328)
      • setup.exe (PID: 6092)
      • msedgewebview2.exe (PID: 7000)
      • Retrac Launcher.exe (PID: 6624)
      • msedgewebview2.exe (PID: 1796)
      • msedgewebview2.exe (PID: 2088)
      • identity_helper.exe (PID: 7360)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6808)
      • msiexec.exe (PID: 6908)

    • An automatically generated document

      • msiexec.exe (PID: 6808)

    • Disables trace logs

      • powershell.exe (PID: 6184)

    • Manages system restore points

      • SrTasks.exe (PID: 4640)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6908)

    • Checks proxy server information

      • powershell.exe (PID: 6184)
      • MicrosoftEdgeUpdate.exe (PID: 536)
      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • MicrosoftEdgeUpdate.exe (PID: 1328)
      • msedgewebview2.exe (PID: 7000)

    • The sample compiled with english language support

      • powershell.exe (PID: 6184)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)
      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 4308)
      • setup.exe (PID: 6092)

    • The executable file from the user directory is run by the Powershell process

      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 5652)
      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • msedgewebview2.exe (PID: 7000)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • MicrosoftEdge_X64_132.0.2957.140.exe (PID: 4308)
      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • setup.exe (PID: 6092)
      • setup.exe (PID: 6352)
      • msedgewebview2.exe (PID: 7000)
      • msedgewebview2.exe (PID: 4544)
      • msedgewebview2.exe (PID: 2088)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 2996)
      • setup.exe (PID: 6092)
      • msiexec.exe (PID: 6292)
      • msedgewebview2.exe (PID: 7000)
      • msedgewebview2.exe (PID: 6460)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 536)
      • MicrosoftEdgeUpdate.exe (PID: 1328)
      • msedgewebview2.exe (PID: 7000)
      • identity_helper.exe (PID: 7360)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 536)
      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • MicrosoftEdgeUpdate.exe (PID: 1328)

    • Reads the machine GUID from the registry

      • MicrosoftEdgeUpdate.exe (PID: 4628)
      • msedgewebview2.exe (PID: 7000)

    • Application launched itself

      • msedge.exe (PID: 7552)
      • msedge.exe (PID: 2736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: Retrac Launcher
Author: retrac
Keywords: Installer
Comments: This installer database contains the logic and data required to install Retrac Launcher.
Template: x64;0
RevisionNumber: {9C0108FB-123F-402E-BE6E-952F9675CB5C}
CreateDate: 2025:01:25 15:54:14
ModifyDate: 2025:01:25 15:54:14
Pages: 450
Words: 2
Software: Windows Installer XML Toolset (3.11.2.4516)
Security: Read-only recommended
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
199
Monitored processes
64
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedge_x64_132.0.2957.140.exe setup.exe setup.exe no specs microsoftedgeupdate.exe retrac launcher.exe msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
440"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.195.43\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
536"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7MEQyNzk5N0ItRjUxMy00RTE4LTk5RDYtRTRGODM5NTI1MEM1fSIgdXNlcmlkPSJ7RjZDRDkwMTAtNzFFMC00RDlFLTg1OEMtRjk1QjcwMjQ0QUM2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDOUU4MDQwNi0wRDJCLTQyNzEtODQ5OS1GMjYwNkQ3MUIyMUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjQwNDYiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE5NS40MyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMwNjIxNzkyNTQiIGluc3RhbGxfdGltZV9tcz0iNTYyIi8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
848"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=false" /installsource otherinstallcmd /sessionid "{0D27997B-F513-4E18-99D6-E4F8395250C5}" /silentC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1200"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3568 --field-trial-handle=2420,i,16478664053949365391,9469135455950372574,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1224"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3516 --field-trial-handle=2420,i,16478664053949365391,9469135455950372574,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1328"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7MEQyNzk5N0ItRjUxMy00RTE4LTk5RDYtRTRGODM5NTI1MEM1fSIgdXNlcmlkPSJ7RjZDRDkwMTAtNzFFMC00RDlFLTg1OEMtRjk1QjcwMjQ0QUM2fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBRDVCMEM3My0xMDk2LTQ5MTktOTQ1Ny1ENUY5NDFEMDQyRDh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ1LjQwNDYiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMzIuMC4yOTU3LjE0MCIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzA3NDI0ODU2NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzMDc0MjQ4NTY1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM0NzcwNjg2NDQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5MDMxNTMzJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWlmT1ZTb092VXlBemtBcHgyMUZEQXRKQ2ZSJTJmTldnQ2w0RHBZMGpZcjh1MW1DZmFqM1NFME1kS2JaZHlSMEE0NDZjbnJTcFJ4eGZsblFyU1VzQzlOVUElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIGRvd25sb2FkX3RpbWVfbXM9IjM2MzU3Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM0NzcyMjE4ODEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzQ5NjU5ODYxMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM4Njk2OTMyODUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI1NjUiIGRvd25sb2FkX3RpbWVfbXM9IjQwMjgyIiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM3Mjk0Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1400"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5328 --field-trial-handle=2420,i,16478664053949365391,9469135455950372574,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1796"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1844,i,7942843946748792039,16334747974892594821,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:2C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Exit code:
0
Version:
132.0.2957.140
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2072"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2416 --field-trial-handle=2420,i,16478664053949365391,9469135455950372574,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2088"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\site.retrac\EBWebView" --webview-exe-name="Retrac Launcher.exe" --webview-exe-version=1.0.20 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2096,i,7942843946748792039,16334747974892594821,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:3C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Exit code:
0
Version:
132.0.2957.140
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\132.0.2957.140\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
25 900
Read events
23 158
Write events
2 657
Delete events
85

Modification events

(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000087E92E9C474DB01FC1A000074120000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000087E92E9C474DB01FC1A000074120000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000074678AEAC474DB01FC1A000074120000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000074678AEAC474DB01FC1A000074120000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000008FF593EAC474DB01FC1A000074120000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000892D8FEAC474DB01FC1A000074120000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
480000000000000041BEF5EAC474DB01FC1A0000F8170000E80300000100000000000000000000009F98AA3BB5CCEF4E974783FAD29A149100000000000000000000000000000000
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6908) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000F05AF3EAC474DB01FC1A000074120000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6320) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000001939FFEAC474DB01B018000084060000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
226
Suspicious files
328
Text files
82
Unknown types
1

Dropped files

PID
Process
Filename
Type
6908msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6908msiexec.exeC:\Windows\Installer\13c0b3.msi —
MD5:—
SHA256:—
6908msiexec.exeC:\Windows\Installer\13c0b5.msi —
MD5:—
SHA256:—
6808msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI6E6D.tmpexecutable
MD5:4FDD16752561CF585FED1506914D73E0
SHA256:AECD2D2FE766F6D439ACC2BBF1346930ECC535012CF5AD7B3273D2875237B7E7
6908msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:FF1D1B40241A2563C5AF48A0CA9FD239
SHA256:ADFCF61C57FE604C83A3EFB7B529FAEDFAC80CB369927900F048EBE47F883292
6908msiexec.exeC:\Windows\Temp\~DF72A334DA574E8A9F.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
6908msiexec.exeC:\Program Files\Retrac Launcher\Uninstall Retrac Launcher.lnkbinary
MD5:CCDA4C5C49BD608A62100DA14EE52C9B
SHA256:B85209FC4DB5CFD8975B1738DCC6B26CE78B5C2FCF4DCF91FB410768132FA88D
6908msiexec.exeC:\Windows\Temp\~DFA854CF6B317757B5.TMPbinary
MD5:162FEDD546BF339F71757653AAA7FEB5
SHA256:6D1093B59A64BB62337B10DD982EB923298D5A95E4565614217AB3C44ECDE43C
6908msiexec.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retrac Launcher\Retrac Launcher.lnkbinary
MD5:83B9CA3013C532BFB87709ACB16CADE7
SHA256:68E5359B7E4BF2EE64B43737BCE32DDDD05F6E0E8DB1B1E4D3C24BD014ADCB87
6908msiexec.exeC:\Program Files\Retrac Launcher\Retrac Launcher.exeexecutable
MD5:5FB6C0788B7D173A412CCDAD986D4A6E
SHA256:1C849DCE609B4EF151A3CB352D4003F73A8A65C7F40D41CCB96AF2B60C9814B9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
74
DNS requests
69
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1752
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
DE
binary
312 b
whitelisted
6540
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
DE
binary
471 b
whitelisted
5096
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
NL
binary
419 b
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
5096
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
NL
binary
408 b
whitelisted
2512
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739031533&P2=404&P3=2&P4=ifOVSoOvUyAzkApx21FDAtJCfR%2fNWgCl4DpY0jYr8u1mCfaj3SE0MdKbZdyR0A446cnrSpRxxflnQrSUsC9NUA%3d%3d
US
—
—
whitelisted
2512
svchost.exe
GET
200
199.232.210.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739031533&P2=404&P3=2&P4=ifOVSoOvUyAzkApx21FDAtJCfR%2fNWgCl4DpY0jYr8u1mCfaj3SE0MdKbZdyR0A446cnrSpRxxflnQrSUsC9NUA%3d%3d
US
executable
168 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1752
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
92.123.104.65:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
google.com
  • 142.250.74.206
whitelisted
www.bing.com
  • 92.123.104.65
  • 92.123.104.7
  • 92.123.104.58
  • 92.123.104.64
  • 92.123.104.54
  • 92.123.104.59
  • 92.123.104.6
  • 92.123.104.53
  • 92.123.104.47
  • 92.123.104.36
  • 92.123.104.37
  • 92.123.104.46
  • 92.123.104.38
  • 92.123.104.41
  • 92.123.104.63
  • 92.123.104.62
  • 92.123.104.35
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.130
  • 40.126.32.136
  • 40.126.32.138
  • 20.190.160.22
  • 20.190.160.5
  • 20.190.160.66
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 23.35.238.131
  • 184.28.89.167
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
arc.msn.com
  • 20.223.36.55
  • 20.31.169.57
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2512
svchost.exe
Misc activity
ET INFO Packed Executable Download
2088
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2088
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2088
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
2088
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
2088
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2088
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2088
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2088
msedgewebview2.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
6636
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
Process
Message
msedgewebview2.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\site.retrac directory exists )
Retrac Launcher.exe
Warning: AddWebResourceRequestedFilter without SourceKind parameter is deprecated! It does not behave as expected for iframes.Please use AddWebResourceRequestedFilterWithRequestSourceKinds instead. For more information, please see https://go.microsoft.com/fwlink/?linkid=2286319
Retrac Launcher.exe
Warning: AddWebResourceRequestedFilter without SourceKind parameter is deprecated! It does not behave as expected for iframes.Please use AddWebResourceRequestedFilterWithRequestSourceKinds instead. For more information, please see https://go.microsoft.com/fwlink/?linkid=2286319
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Retrac.Launcher_1.0.20_x64_en-US.msi