redline | 403d0422e6db9adbfc47a7056e3946737b7e76fe097c4c43d4906fe167a5e75a

Analysis

max time kernel
299s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20241007-de
resource tags

arch:x64arch:x86image:win10v2004-20241007-delocale:de-deos:windows10-2004-x64systemwindows
submitted
23-11-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GitHub.Installer.zip
Size

20.0MB
MD5

14871c98f75a900ac3b41c9091b0484d
SHA1

5849d6ab6cc59560a5857267953e98071bd3ae55
SHA256

403d0422e6db9adbfc47a7056e3946737b7e76fe097c4c43d4906fe167a5e75a
SHA512

7c3b8d3fac4357e03d68147dde1aebc0cd3253b31a592a5bb1fd94dd60b192d89961f9d4573e144e82d023b5945aafcee61955cea657d8aba959465610ade40e
SSDEEP

393216:dXz7pLcn49wQSjauUux6BjNNXfGNHaBso4ZiYj6ZvfQ89HbZ+:dXY4GQSjaPLjNNXO621TUf79HbZ+

Score

10^/10

redline @sentak88 discovery execution infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

@Sentak88

45.15.156.167:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 14 IoCs

resource	yara_rule
behavioral1/memory/2304-14-0x0000000000AF0000-0x0000000000B42000-memory.dmp	family_redline
behavioral1/memory/3832-22-0x0000000000E00000-0x0000000000E52000-memory.dmp	family_redline
behavioral1/memory/1404-29-0x0000000000B20000-0x0000000000B72000-memory.dmp	family_redline
behavioral1/memory/4108-495-0x0000000000850000-0x00000000008A2000-memory.dmp	family_redline
behavioral1/memory/692-502-0x0000000000350000-0x00000000003A2000-memory.dmp	family_redline
behavioral1/memory/4496-534-0x00000000012F0000-0x0000000001342000-memory.dmp	family_redline
behavioral1/memory/2268-555-0x0000000001150000-0x00000000011A2000-memory.dmp	family_redline
behavioral1/memory/768-562-0x00000000009D0000-0x0000000000A22000-memory.dmp	family_redline
behavioral1/memory/2848-568-0x00000000010C0000-0x0000000001112000-memory.dmp	family_redline
behavioral1/memory/4264-572-0x00000000011E0000-0x0000000001232000-memory.dmp	family_redline
behavioral1/memory/3868-578-0x0000000000A20000-0x0000000000A72000-memory.dmp	family_redline
behavioral1/memory/2188-584-0x0000000000DA0000-0x0000000000DF2000-memory.dmp	family_redline
behavioral1/memory/4352-656-0x0000000000360000-0x00000000003B2000-memory.dmp	family_redline
behavioral1/memory/5068-682-0x0000000000940000-0x0000000000992000-memory.dmp	family_redline

Redline family
redline
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	VC_redist.x86.exe

Executes dropped EXE 23 IoCs

pid	Process
2304	Launcher.exe
3832	Launcher.exe
1404	Launcher.exe
3672	VC_redist.x86.exe
4864	VC_redist.x86.exe
3972	VC_redist.x86.exe
4108	Launcher.exe
692	Launcher.exe
4496	Launcher.exe
2268	Launcher.exe
768	Launcher.exe
2848	Launcher.exe
4264	Launcher.exe
3868	Launcher.exe
2188	Launcher.exe
4864	Launcher.exe
1116	Launcher.exe
2728	Launcher.exe
2960	Launcher.exe
3780	Launcher.exe
2436	Launcher.exe
4352	Launcher.exe
5068	Launcher.exe

Loads dropped DLL 2 IoCs

pid	Process
4864	VC_redist.x86.exe
2248	VC_redist.x86.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{e7802eac-3305-4da0-9378-e55d1ed05518} = "\"C:\\ProgramData\\Package Cache\\{e7802eac-3305-4da0-9378-e55d1ed05518}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2410.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b1f5e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b1f4c.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21FC.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C2BB95AA-90F3-4891-81C1-A7E565BB836C}	msiexec.exe
File created	C:\Windows\Installer\e5b1f4c.msi	msiexec.exe
File created	C:\Windows\Installer\e5b1f5d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI29CE.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{84E3E712-6343-484B-8B6C-9F145F019A70}	msiexec.exe
File created	C:\Windows\Installer\e5b1f5e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D1A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b1f73.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 17 IoCs

pid	pid_target	Process	procid_target
2244	2304	WerFault.exe	95
2880	3832	WerFault.exe	102
2216	1404	WerFault.exe	107
3320	4108	WerFault.exe	145
1088	4496	WerFault.exe	151
3220	2268	WerFault.exe	156
4508	768	WerFault.exe	160
1080	2848	WerFault.exe	164
2572	4264	WerFault.exe	168
4284	3868	WerFault.exe	171
4404	2188	WerFault.exe	176
4840	4864	WerFault.exe	180
740	1116	WerFault.exe	185
4264	2728	WerFault.exe	190
2640	2960	WerFault.exe	194
4692	3780	WerFault.exe	198
5032	2436	WerFault.exe	202

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001397c7f967de25740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001397c7f90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001397c7f9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1397c7f9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001397c7f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133768667580308243"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.42,bundle\Dependents	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C2BB95AA-90F3-4891-81C1-A7E565BB836C}v14.42.34433\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.42,bundle\Version = "14.42.34433.0"	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.42,bundle\Dependents\{e7802eac-3305-4da0-9378-e55d1ed05518}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.42.34433"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AA59BB2C3F091984181C7A5E56BB38C6\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\ProductName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.42.34433"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.42,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.42.34433"	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AA59BB2C3F091984181C7A5E56BB38C6\VC_Runtime_Minimum	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\Version = "237667969"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{e7802eac-3305-4da0-9378-e55d1ed05518}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\679E80FBE29B63345BF612177149674C	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Version = "14.42.34433"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AA59BB2C3F091984181C7A5E56BB38C6	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AA59BB2C3F091984181C7A5E56BB38C6\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\ProductName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.42.34433"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\PackageCode = "1D9C529D8C7ACCB44AEB146B378F1D12"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{84E3E712-6343-484B-8B6C-9F145F019A70}v14.42.34433\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.42,bundle\ = "{e7802eac-3305-4da0-9378-e55d1ed05518}"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\ = "{84E3E712-6343-484B-8B6C-9F145F019A70}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\217E3E483436B484B8C6F941F510A907\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{C2BB95AA-90F3-4891-81C1-A7E565BB836C}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\PackageCode = "2A6913A281E36934992C8D584A14C6CB"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\Version = "237667969"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\217E3E483436B484B8C6F941F510A907\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{84E3E712-6343-484B-8B6C-9F145F019A70}v14.42.34433\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{e7802eac-3305-4da0-9378-e55d1ed05518}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.42,bundle	VC_redist.x86.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	Launcher.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4092	NOTEPAD.EXE
4080	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4540	chrome.exe
4540	chrome.exe
4832	msiexec.exe
4832	msiexec.exe
4832	msiexec.exe
4832	msiexec.exe
4832	msiexec.exe
4832	msiexec.exe
4832	msiexec.exe
4832	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4416	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4416	7zFM.exe
Token: 35	4416	7zFM.exe
Token: SeSecurityPrivilege	4416	7zFM.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe
Token: SeCreatePagefilePrivilege	4540	chrome.exe
Token: SeShutdownPrivilege	4540	chrome.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4416	7zFM.exe
4416	7zFM.exe
4092	NOTEPAD.EXE
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4864	VC_redist.x86.exe
4864	VC_redist.x86.exe
692	Launcher.exe
5068	Launcher.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe
4540	chrome.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
5068	OpenWith.exe
5068	OpenWith.exe
5068	OpenWith.exe
5068	OpenWith.exe
5068	OpenWith.exe
5068	OpenWith.exe
5068	OpenWith.exe
5068	OpenWith.exe
5068	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4292	4540	chrome.exe	112
PID 4540 wrote to memory of 4292	4540	chrome.exe	112
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 1152	4540	chrome.exe	113
PID 4540 wrote to memory of 3676	4540	chrome.exe	114
PID 4540 wrote to memory of 3676	4540	chrome.exe	114
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115
PID 4540 wrote to memory of 636	4540	chrome.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\GitHub.Installer.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:684

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 884
  2⤵
  - Program crash
  PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2304 -ip 2304
1⤵
PID:2752

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\GitHub.Installer\Instruction.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:4092

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 864
  2⤵
  - Program crash
  PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3832 -ip 3832
1⤵
PID:2484

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\GitHub.Installer\Engine.js"
1⤵
PID:5012

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 880
  2⤵
  - Program crash
  PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1404 -ip 1404
1⤵
PID:1428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffac447cc40,0x7ffac447cc4c,0x7ffac447cc58
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1976,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2200,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2300,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3352,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4552,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4848,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4912,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4072,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4396,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4756,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5256,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5348,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5340,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3556,i,7295940247920419803,10128868832872394280,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:2868

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3332

C:\Users\Admin\Downloads\VC_redist.x86.exe
"C:\Users\Admin\Downloads\VC_redist.x86.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3672
- C:\Windows\Temp\{32140EFA-7E64-4BC7-930F-8C59934DB604}\.cr\VC_redist.x86.exe
  "C:\Windows\Temp\{32140EFA-7E64-4BC7-930F-8C59934DB604}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x86.exe" -burn.filehandle.attached=716 -burn.filehandle.self=720
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:4864
- - C:\Windows\Temp\{DD7D8969-CC62-472B-B764-BE9688E8BBAE}\.be\VC_redist.x86.exe
    "C:\Windows\Temp\{DD7D8969-CC62-472B-B764-BE9688E8BBAE}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{89E1196E-1570-4850-AE57-2868E980D236} {287B24BC-3595-4ECC-BB4F-5EA35F3861A3} 4864
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3972
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=1216 -burn.embedded BurnPipe.{CFB8C2DB-4103-42D6-BB41-C23660722139} {D687EE56-3C53-4A6F-B92D-D4A797A8CCD7} 3972
      4⤵
      System Location Discovery: System Language Discovery
      PID:1088
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=1216 -burn.embedded BurnPipe.{CFB8C2DB-4103-42D6-BB41-C23660722139} {D687EE56-3C53-4A6F-B92D-D4A797A8CCD7} 3972
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2248
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{9831F514-2C14-4BCD-A213-F4966118A5A8} {902885B0-00D3-42E5-9FD6-817266064963} 2248
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5024

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:948

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2848

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4832

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 864
  2⤵
  - Program crash
  PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4108 -ip 4108
1⤵
PID:3800

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:692

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 880
  2⤵
  - Program crash
  PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4496 -ip 4496
1⤵
PID:1804

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 864
  2⤵
  - Program crash
  PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2268 -ip 2268
1⤵
PID:64

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 864
  2⤵
  - Program crash
  PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 768 -ip 768
1⤵
PID:848

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 864
  2⤵
  - Program crash
  PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2848 -ip 2848
1⤵
PID:4356

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 864
  2⤵
  - Program crash
  PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4264 -ip 4264
1⤵
PID:3460

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 864
  2⤵
  - Program crash
  PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3868 -ip 3868
1⤵
PID:4844

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 864
  2⤵
  - Program crash
  PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2188 -ip 2188
1⤵
PID:852

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 864
  2⤵
  - Program crash
  PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4864 -ip 4864
1⤵
PID:1704

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5068

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 864
  2⤵
  - Program crash
  PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1116 -ip 1116
1⤵
PID:2764

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\GitHub.Installer\Config\_conf.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4080

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 880
  2⤵
  - Program crash
  PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2728 -ip 2728
1⤵
PID:2660

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 864
  2⤵
  - Program crash
  PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2960 -ip 2960
1⤵
PID:2404

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 864
  2⤵
  - Program crash
  PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3780 -ip 3780
1⤵
PID:4168

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 868
  2⤵
  - Program crash
  PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2436 -ip 2436
1⤵
PID:1140

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4352

C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe
"C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5b1f51.rbs

Filesize
16KB

MD5
62f9e6cc9787aab22112c28d7abe210e

SHA1
7359f68006a6ea41ac12d41e69e3e7eb225314d3

SHA256
b6dee70874847e22a5ceb5e68dfc916ae6dd4d6ff8735e1f50d3980e775d995b

SHA512
dbe83d6bee4d076b66dbeb8616d6fb01f8da4e8fc0432078dca3611d0604a7b28887bd0848d68f994ac9dedd21eb6b9a1cddafab81fa590c96f23b54b87ead50

Download Submit
C:\Config.Msi\e5b1f56.rbs

Filesize
18KB

MD5
06730e1ae3d5321bb9dc1b91a5a8da74

SHA1
a2a403be1eaf1f001489257c698557f2c2e4529c

SHA256
49b41c10585337705a812d125a18c7d25edbab2286dca7045d82abce57b56976

SHA512
b4fae653dd9f0b15ad10de7192b3a8759542714a383148ffa901e46c6568f042b15229f96be11a5bfbde79a837267931cec58ae8eb93087272c5076b19f289cf

Download Submit
C:\Config.Msi\e5b1f63.rbs

Filesize
20KB

MD5
0ecc2208bc5eed45dcb887baac7c2f65

SHA1
65c99710caa96bbaae30b844c90e245289fd5b04

SHA256
d53266e66c141ace6f7bfad0ba2d1fa69da8c2f291ac9f51f475ca7baed51e49

SHA512
194c9c030fcabe463c5e7446ed41986233a009de1dfc8e5939689806cb6958ee600a5826a7c824555cc428017f19c0a0e678c4e23cc56faa5460a4497344bd19

Download Submit
C:\Config.Msi\e5b1f72.rbs

Filesize
19KB

MD5
a200687ec6bfc323423c7cbf872f4e47

SHA1
44f8f085e88421a4c9b7b774a43209b9413a3913

SHA256
e7e0c62886f3c4d613df56697c8b3129424afe59f0726f7121d51bdc13f5c898

SHA512
7b263685a2cc1d68b370589e7942e8855abf20fe30be24853d51695ee13b48ae7accde900a96580698f9fd03d495cc6babe87c9cb6b1152d6b918b35eaaaed6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
3295758722894f255bdc4f8c0c41829c

SHA1
32c4aaf87874ef51eaee6e1e6743b5c8f94ae0f2

SHA256
c2b602eaea4810ca93fb6b512939004033aba1f7f0f99465c008965f005edd24

SHA512
9806a97e756e9ef98d646bad4df3e4547ae62019bde861099a88763527454ecaa574164f0071b2a13ac7beef5235dc772dbc31be1565dedf43a4218e168420ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
fc4faaee4c3ca73f028178551a0d5be7

SHA1
fa3ac1d8ed5ef310bfa0fa1c96ada130d7cc8177

SHA256
d0b82b5cadf453171c0532cbb69d49cea7020262575258403e2024727aca7ef3

SHA512
a17ee4dbddf0973d671f5de0afb8feb36fb75c5301162600b506d8150cf34c725dfddb69f0ba6d4b275ec798e0159a1d84cec9a1034d608977105c32eee77ba1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
f20a20bf8f569898ee2401d413e11d5c

SHA1
d42c9971c6ff6515f70cdf85bc1686239a91fde0

SHA256
da42861a62035dd0d9b27060b4d49b64660cdea0bb803571254244e1e960512b

SHA512
4f1c9600fa52f97ff8028a2233709170be16007a9271e774c3984db5af8585357a6b6ae5b1ec0b5a04ef0ec3c617d20e802e9a2f4952417113055a4780f64e23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
109cba301118fa94ea4c74791af0850f

SHA1
0e55a870f9b9a419335c13988f6e786b1b4c6d21

SHA256
b15bb7a693f08b53f3f5f265805249f581181db9de002054c1aa50d500d5205e

SHA512
74f9852ad7be4ef9e0ede8a6fcf2428c73ded9826c6e178b0fbc2f2130c93d4c3c1811b4580e1fdf64995026a20623a23296572d93f9c8312734229d05bb04ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
bd6645a06004528eb85b8df2fe99d26a

SHA1
86bd86003aff897fa1030fb160f890cd12cdbf9f

SHA256
cc0af77db50e032c57b9503cf63e9d4b88972bd69537d2881bdaca34c798f175

SHA512
cecab43afe595ef48a76a1db3a55bc27d42ccbfc1e2629215db9fca65c7795755326dc57f6cd45ac1b7d4a2f2d5af7f2d0ac72b87d8fa2b773b7fabe9f55f965

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
5d4c34e8ca0afb1aab4d96c1a4d82ba1

SHA1
0bb3a34be7d56b7adaae5e5c1a028bda1a42a425

SHA256
398d63556d38d766cbffe15bcb47a1a9f4f0339e52e0e46d11580a10fd9828d5

SHA512
12144807de4e422d7ead214ff22ce76ed2f3449f0da4a07e2ef0ea086f6ab1f7e0e3c1aed5babd9b1334e3589a6259a68096522d22ecfe53fd5f0531d3eaddce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
db29fecba0b0faf051f2aaedce717256

SHA1
efc733803cc59d231048fbcee3ddc3fadc0d5d13

SHA256
eb1072e1dbd0ae5435a41e88b810a6bd40fbf141e9b6ee52d183e128a917b5b4

SHA512
daf2d1069d817ab6019fb2baf0e5dd5ec5ee7909c57230aa471e06c2ea07101e7852a43fa56ec50fe3e52a275cd7a0d1a1e82a88159db969f48ce98b9d193caa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9fb35f2071fefab023f659b1147d4d10

SHA1
fb0954ae97f54a00780a27f3e33569ccb811240b

SHA256
295ff9d63d2bfadb68adbd99075463fc14304298e2f5a076c59450d3cbf76ce2

SHA512
395dd8a0cb86829da33c39484babbd49d7948cf90811774a8b107368f2e78d801a60ed8655f472233215929b45344f19a28f53ddb66df881c545e79e907f2d78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7025930febec15a41746040d0e431672

SHA1
1a13187aa1664c796dcd409ab5bba3c795c4a5b7

SHA256
9d658b5cdf1624b10a3923a0b54fae5fc420f723548e3c18f20470809f9d7364

SHA512
a19cd8732c4465332d0146ae57f4262428ab0024778112d72bd79c1187f1e91f6beaeb0d49c792160d6eae692057c43f967c5b431c503f47c8654dedd5d0ac54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5bd05d73d91823437d4c29bb1e189cf5

SHA1
8a7659cf622d4080ca2da3d0fccd9c7b1daddf33

SHA256
d369fcf6f51b052de55a363cc4c1a41e12150d8fc88e0d1c97a156a2931a89b3

SHA512
0edb89d4637718769a6d2e65203009cd42a3fc649290e81371d93afcc63c0c174ca685f9f8286df3a39de3fadba7f6422cee0b3e6cb5a6f4b9f574131fbb92dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c3f1c34170526db163a2e12e530e764d

SHA1
d89f57e13b823a358a74ad227eac8136a51c286c

SHA256
24d29d7ba658047925c61af0901a69ab590fae4f754acda7beb0ff592c4e3070

SHA512
51817bd43bfb149d70b6ddc323312eb0cc63c995d2cef65ad5167b73ae04c2f6b26c080503ecf5cb1aa99f09c995a2c8e636436a634ad12bf67f78f60137556d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f3645a07fc5ff296c6cbe8d689711d1f

SHA1
9235ab7f1bc911bb7b30659a9ff578db7bfa4680

SHA256
cfce90a93adf429577c4c8c30623664ed668f931ddb850aeb0b0a3b999f35094

SHA512
7cb814485035c0f08737d5c3dc430d5cabd288a89db69e75e289e31a4ace4586556c1b0ba81d66bbf838e387c5290fc17fdc2b1967b8d13f12853b0791f580c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
948b1b9ebd6b2e1b8f5e9dd297403f07

SHA1
24b845190e493107c63801492996678f2cb51cc8

SHA256
2af2a8a176781d6a494f7adc5308832281f9d7b11419556060c838ca8e546a67

SHA512
0aa826ec176990f4c4f02e3930efb755fecb447486f9ac37a373a3002be0cb3dd0443e4f08b4cc4e2490f2db48a4faede120b2da6dd1d780b6c397cb79331431

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2658c6c6f9f56fb093ec03d879598a0f

SHA1
c093e1e43e7e171cf0f39467654c945da6d3906f

SHA256
08a4e219768c090268f1301626aac99a710c63ba44c8630fed7ac000466e38cb

SHA512
dda896d04e036deea77f043aa12f4608df562b6b3f7ed22e0a583ee33790c3f04d6b0002ce5ef9f569ecfee92c0f4f8929ddf6ecb9ae2ed1ac79dac35bf5dc5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
61f4359451049393bb82ce6d1fc10612

SHA1
2b9a06a7bb08953d4e02835d06c83145280f4c21

SHA256
e6086849809a6efce96995cc786a848b97b7617199ac20e50a634ac012bc1358

SHA512
f311a7e157bd2fdd8048df7e72aea3f51217d16b7a298645d31ffb26b414932a7906dd4bc83ec1d891c62a6ab65e54fccfd442fa0827649d6b6397173a0164cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
f590bce48b93e6fdd38db494afcd7165

SHA1
3b1d98c181e945358ef26c357a0b618ddf9bc06e

SHA256
6729dae825aaad672497498018cc153fbe6a7d1c1f6aa0452c651460af9ef5ac

SHA512
e65a5305dff3e431b6038b8f9a7ddaa5a7de06d2d9003da06b0fe3c744d6c9b7a20c8cb727ef9a5385b27e28f4db22bf6b792acd91003d607004770f75d87b0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
ddaef564102cd55cb688d51dc100a28d

SHA1
4d3b769c7f35cb475e056b077e03d1cc3e9d7423

SHA256
07456a8bdc32a16fc9e6a211e77c7c40b8e5b5a5059cf7ac0f298ced817fa1b6

SHA512
75b8ba79370e641a00a28df6dd22472d64c4b20f63e84c7eac000325d6691ec404739cb35cc0471e8112b4dfe9f861e9d93d41b480fddc7c5560d83c5d9a868a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp5D30.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241123201953_000_vcRuntimeMinimum_x86.log

Filesize
2KB

MD5
07751d97d556d73b0dfe2fedd1f5529d

SHA1
4a41e2dd958c98bcfa019a7f856fd48040caa7ef

SHA256
e145cbbe89ccc84067f2aa4ef40341d83b6617e51c7809efd63d3fc92f64c6c7

SHA512
b9ddec1167652d088406a627c40e1c22544a097adb59c8815b57ca6293c295851d8abd664ca3adb343e8c4ab1765361d1334b32e0708862c1b328e9c54b7bd8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20241123201953_001_vcRuntimeAdditional_x86.log

Filesize
2KB

MD5
9a0f2b2ca8f89b2290f17f21091b1e81

SHA1
67d592ddfd8e446f67a104b851fa9730e3adf778

SHA256
d62e82dd25b9e45a61ff9694599afcf0a5225971b72b7225548c1d6bdc6a38e4

SHA512
0b2c010d7de474041d902dcaac2414452c2beccc210f60bc62409bdf2ce02e33f8ae48bd64be8e52f8ba609b64f68ce32f038f35119ac5d33f00241843d735f7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3227495264-2217614367-4027411560-1000\76b53b3ec448f7ccdda2063b15d2bfc3_423fd5c7-8559-4b8c-bf1f-c9d05c9f0fd3

Filesize
2KB

MD5
22bdf9e52c16154b975a8fd776bd796e

SHA1
85178725fdc0402a81f9fb5e0c2ba0467fc846c2

SHA256
a97d4d4ed8d01f5f53189b67c48d408b05476c5ffabd129174c53ac4d5e218d9

SHA512
e64c51256044f3f06e3044a53f2ac7079eefe70b3b29bf227f5dc2e0d0f30e8b000c721b5043557fffedb924e2ccdc4abad3dacd8242b45919b00e63a4594baf

Download Submit
C:\Users\Admin\Desktop\GitHub.Installer\Engine.js

Filesize
1.7MB

MD5
bc647cffd94c397f082fde790cf89ed0

SHA1
167d905425eba6c6356caf54366a8478eb4f7ca8

SHA256
20c8687e1b6bf93662201372b5f822d7aaabd4ec910049a9284aab0a1cf65807

SHA512
11b65b799ee7be287ce84a982f9b07b0d4eecc6147000cfff572442259374109d571360fddf2818659a14801660b55f9a2a63d19d48d4405e5017e7beb1767a1

Download Submit
C:\Users\Admin\Desktop\GitHub.Installer\Instruction.txt

Filesize
665B

MD5
020b23309be6ad43a4684be4afa57982

SHA1
1e3c76c45c4c8c94f275c4c83fe88f3258ca7a7f

SHA256
4492460f115876142628b75eee706beeabde5a698c964d6886ef4ac8b945e5e7

SHA512
e63f56ddfe0894a60e6b7554c07416ebb27dbb0f3d0ed3259d145071e63ac611d3ea7b277aa5c356b7001ca3b69a521cc3754e5375607f7d3c6325638e2013a8

Download Submit
C:\Users\Admin\Desktop\GitHub.Installer\Launcher.exe

Filesize
823KB

MD5
1a7c1cdedfe2ec2a02268337359045cb

SHA1
b02945f751a0b130ebc3d6bc30bef896cceaea04

SHA256
2f2413654c9b24998e670ed4589eb9c43620295aa010f6d4ad1aa707ab2b514f

SHA512
09faef200b01d333b91f4a10c51d30f604bc74252727a8f1b5b97487a7034aa0428853494c473e45b1a2ca8876f8bc2d5bf290f6aab7cd1c5317ca09fe4e0845

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
48c9fe1757ec5826b0b3b2675a59b0f8

SHA1
6a4670a34ed716d0264d93051de150365b97ed9e

SHA256
2577efea8c9909f139ef4d2c785b6463592bf5214c2b45ac7bf8c1a686947fa6

SHA512
314351a0f270291c9ae0ac41fa461e5190b8b8db1affa04c971cdc437cea5925dbfd4fc0124ee39225205fbc20dd3ec635e9761727fa765a85756f9ed95e7014

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 2080.crdownload

Filesize
13.3MB

MD5
8a6f4f3282236325360a9ac4413b7bc3

SHA1
cb617803813e969be73f2e0e175a67620e53aa59

SHA256
dd1a8be03398367745a87a5e35bebdab00fdad080cf42af0c3f20802d08c25d4

SHA512
2c1facb8567a052b4fa65d173b0bda64fa5fded2cddb9073b7c28507ed95414c17d2839d06d5e961617c754cda54d6134964b1aff5c9e9cdfbace71f1de2ac3a

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
4f1fae46f14d885c56dde9a00f70a18f

SHA1
e05ec8abab59d0295f30e7595b792e444180825e

SHA256
f5343dd41d28e1b18cdb7dc2b53ec402f015e662cb4955256ab1e4024be389d6

SHA512
4fe0fcea4ee158c5a64a42a3c80b2d2508522bed4a4eada21e996fb04a210d51e3769bec23096a799722e2adf242896e6e593bb883acd2ab6f61f8fea7dd1aae

Download Submit
C:\Windows\Temp\{29550F41-A5A6-43DB-BFD0-D4C6777C10A1}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{32140EFA-7E64-4BC7-930F-8C59934DB604}\.cr\VC_redist.x86.exe

Filesize
669KB

MD5
f7aca1ef43beaa02107214482e6b51d6

SHA1
fb5cec36519b148119dec501cec92d894eb3b60a

SHA256
169b8f7025b301ffce5402c98c07f9e01bbadce52a2961175b777279f92624a7

SHA512
82cf5ebaa0a16e229b82e2dd550d7ab76409c89b4cfb7f163d1cce6d156db737ec5a09a3aa832b4076039665a6044aaeca3a6d311f8264492707ae281bbe7443

Download Submit
C:\Windows\Temp\{DD7D8969-CC62-472B-B764-BE9688E8BBAE}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{DD7D8969-CC62-472B-B764-BE9688E8BBAE}\.ba\wixstdba.dll

Filesize
215KB

MD5
f68f43f809840328f4e993a54b0d5e62

SHA1
01da48ce6c81df4835b4c2eca7e1d447be893d39

SHA256
e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

SHA512
a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

Download Submit
C:\Windows\Temp\{DD7D8969-CC62-472B-B764-BE9688E8BBAE}\cab54A5CABBE7274D8A22EB58060AAB7623

Filesize
842KB

MD5
a04f3e3bd8684cf660619e0f6af4d751

SHA1
2b5b1a39de1faa20d9a5774ec7b27dee5f6fc065

SHA256
b31b87a09f3aa2df573050949e87a68eeda01cb80dc974714d0603cea2c0708b

SHA512
fb3c081ad9f23661ed6f167ca878469d702f5cb60c15bb6d04c21331b43f8b88d98a680ad74ff5855e4c286260452be9e25b49b5b245d14fa30297cc8add5828

Download Submit
C:\Windows\Temp\{DD7D8969-CC62-472B-B764-BE9688E8BBAE}\cabB3E1576D1FEFBB979E13B1A5379E0B16

Filesize
4.9MB

MD5
654f67c3c99d57a0008427141bd1cfc6

SHA1
60887d57c8910a5034379ddc7a0ad5e2c2bfcde6

SHA256
d87d9b997b91f9e375bf3cf994b67882ce21c0fbd4d0c4611dd6f593d4a8f3be

SHA512
0f3182a9c923a51f9ffed2e8639f9bcb72ace859c6253aa860a95c2c67c6b9d80d7945042460a7f73e357614b149c9d906c101f800724825279f07902571a064

Download Submit
C:\Windows\Temp\{DD7D8969-CC62-472B-B764-BE9688E8BBAE}\vcRuntimeAdditional_x86

Filesize
200KB

MD5
95715c58dd2864b361dbd9e651b2f5ad

SHA1
c8b19282b7950e7b8e106b5bbccad4fc7b3aa661

SHA256
a6447de0d0d5b56b50988ae350432d68e9d83fbb566e2fcaa3f758a2b2574fea

SHA512
10eb258d1c1ab690e03fd782316133305530a7a50769263176765862a754dcf5ec258ca5805d2be447a53b29b3557b519a6cec812208d88982201c86ea8d5fb3

Download Submit
C:\Windows\Temp\{DD7D8969-CC62-472B-B764-BE9688E8BBAE}\vcRuntimeMinimum_x86

Filesize
200KB

MD5
975e07089d93c2540f0e91da7e1e0142

SHA1
e65a155b9f88cabf6fc34111751051f8872f1dc2

SHA256
16547c99e9dc8602603beda79bb9099d06b2f0e06273660aaffd3193d82e8bf5

SHA512
047ca9eaf996b5b89cedf0f9e9d7544cb8700bba02e10aa90fbd283fdebb2e1ec98295569f145e0dc9bbf3dbd44f64e4d02429cbcdff7e149f2804c135ee2595

Download Submit
memory/692-506-0x0000000004BC0000-0x0000000004C52000-memory.dmp

Filesize
584KB

Download
memory/692-608-0x0000000006CA0000-0x0000000006D34000-memory.dmp

Filesize
592KB

Download
memory/692-502-0x0000000000350000-0x00000000003A2000-memory.dmp

Filesize
328KB

Download
memory/692-507-0x0000000004B70000-0x0000000004B7A000-memory.dmp

Filesize
40KB

Download
memory/692-609-0x0000000008F90000-0x0000000009094000-memory.dmp

Filesize
1.0MB

Download
memory/692-524-0x00000000058E0000-0x0000000005956000-memory.dmp

Filesize
472KB

Download
memory/692-525-0x0000000006470000-0x000000000648E000-memory.dmp

Filesize
120KB

Download
memory/692-528-0x0000000006E00000-0x0000000007418000-memory.dmp

Filesize
6.1MB

Download
memory/692-529-0x0000000006970000-0x0000000006A7A000-memory.dmp

Filesize
1.0MB

Download
memory/692-530-0x00000000068A0000-0x00000000068B2000-memory.dmp

Filesize
72KB

Download
memory/692-531-0x0000000006900000-0x000000000693C000-memory.dmp

Filesize
240KB

Download
memory/692-532-0x0000000006A80000-0x0000000006ACC000-memory.dmp

Filesize
304KB

Download
memory/692-505-0x0000000005170000-0x0000000005714000-memory.dmp

Filesize
5.6MB

Download
memory/768-562-0x00000000009D0000-0x0000000000A22000-memory.dmp

Filesize
328KB

Download
memory/1088-452-0x0000000000C40000-0x0000000000CB7000-memory.dmp

Filesize
476KB

Download
memory/1404-29-0x0000000000B20000-0x0000000000B72000-memory.dmp

Filesize
328KB

Download
memory/2188-584-0x0000000000DA0000-0x0000000000DF2000-memory.dmp

Filesize
328KB

Download
memory/2248-451-0x0000000000C40000-0x0000000000CB7000-memory.dmp

Filesize
476KB

Download
memory/2268-555-0x0000000001150000-0x00000000011A2000-memory.dmp

Filesize
328KB

Download
memory/2304-18-0x0000000074E2E000-0x0000000074E2F000-memory.dmp

Filesize
4KB

Download
memory/2304-14-0x0000000000AF0000-0x0000000000B42000-memory.dmp

Filesize
328KB

Download
memory/2848-568-0x00000000010C0000-0x0000000001112000-memory.dmp

Filesize
328KB

Download
memory/3832-22-0x0000000000E00000-0x0000000000E52000-memory.dmp

Filesize
328KB

Download
memory/3868-578-0x0000000000A20000-0x0000000000A72000-memory.dmp

Filesize
328KB

Download
memory/4108-495-0x0000000000850000-0x00000000008A2000-memory.dmp

Filesize
328KB

Download
memory/4264-572-0x00000000011E0000-0x0000000001232000-memory.dmp

Filesize
328KB

Download
memory/4352-656-0x0000000000360000-0x00000000003B2000-memory.dmp

Filesize
328KB

Download
memory/4496-534-0x00000000012F0000-0x0000000001342000-memory.dmp

Filesize
328KB

Download
memory/4832-493-0x000002405A220000-0x000002405ACE1000-memory.dmp

Filesize
10.8MB

Download
memory/5024-414-0x0000000000C40000-0x0000000000CB7000-memory.dmp

Filesize
476KB

Download
memory/5068-682-0x0000000000940000-0x0000000000992000-memory.dmp

Filesize
328KB

Download