Identifier / Programs / Windows

tttracer.exe

Time Travel Debugging Tracer Tool file version info (xCyclopedia)

LOLBAS Execute, Dump 2 ATT&CK techniques 2 documented commands 10 known copies with hashes

How tttracer.exe is abused

documented by LOLBAS

Execute T1127 Trusted Developer Utilities Proxy Execution

Dump T1003 OS Credential Dumping

-dumpfull

-attach

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for tttracer.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1127 Trusted Developer Utilities Proxy Execution Administrator privileges

Execute specified executable from tttracer.exe. Requires administrator privileges.

tttracer.exe {PATH_ABSOLUTE:.exe}

Identify

Dump T1003 OS Credential Dumping Administrator privileges

Dumps process using tttracer.exe. Requires administrator privileges

TTTracer.exe -dumpFull -attach {PID}

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for tttracer.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for tttracer.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

T1003OS Credential Dumping

T1127Trusted Developer Utilities Proxy Execution

Is it the real tttracer.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionTime Travel Debugging Tracer Tool

10 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tttracer.exe · signed by Microsoft Windows

369e7975815009216b360da3d4fe674ad629ef3062253028202b9986e2bce8c7

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\tttracer.exe · signed by Microsoft Windows

41ab646231a3e8606cc11ce9ea8a285a0d1d0697421037bc3ae3e992c48b8945

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\tttracer.exe · signed by Microsoft Windows

62054b4aebc9da850fe32c6a056ceaa2039c5bd3f51e3f1471116792e8778ed9

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tttracer.exe · signed by Microsoft Windows

a766076806b2610cbec325a886eda7352da83703f6f4c623c2f58e0706c499a9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tttracer.exe · signed by Microsoft Windows

73fd8aa2603f3df92dc6c912cc823099ef611340e6864a237d45c124afc6efb5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\tttracer.exe · signed by Microsoft Windows

b2a6e526499f552c2c9ae920dd7b6722b0d49b862950b5740033a8764f66e9d2

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tttracer.exe · signed by Microsoft Windows

9b3f44c3aa76aea793ef3cf23401bf1c1e5dbe23932dc36f26c4ba2bb0187426

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\tttracer.exe · signed by Microsoft Windows

cbab0edef72829dd9897c33cd83b51846691db4ae6617deb48391f6baa83d909

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\tttracer.exe · signed by Microsoft Windows

4d94208e7d497b5bedd481263fea903c9cd66962a5dba9f5353cca15faf0d9fd

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tttracer.exe · signed by Microsoft Windows

f501b18d8270ce7802e724c84d1eba5c5d77adb9113739605fb45e302edf9c4c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.