Overview

overview

10

Static

static

1

RedBooster-Setup.exe

windows10-2004-x64

10

RedBooster-Setup.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    65s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 02:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RedBooster-Setup.exe
  • Size 65.1MB
  • Sample260712-dcffvsb18r
  • SHA256 984e2f2b664ebd0b4cfb21b00ebb86c0107da1518cbb933f1678b377552370ec
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutioninstallerpersistencespywaretrojan

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

    Using powershell.exe command.

    execution
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 56 IoCs
  • Executes dropped EXE 9 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 17 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Loads dropped DLL 12 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 4 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RedBooster-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\RedBooster-Setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4652
    • C:\Users\Admin\AppData\Local\Temp\is-54B4A5LGRB.tmp\RedBooster-Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-54B4A5LGRB.tmp\RedBooster-Setup.tmp" /SL5="$400AA,66094623,973824,C:\Users\Admin\AppData\Local\Temp\RedBooster-Setup.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /F /IM RedBooster.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3908
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /F /IM LibreHardwareMonitor.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4512
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /F /IM PresentMon.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1140
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /F /IM rbframegen.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5040
      • C:\Users\Admin\AppData\Local\Temp\is-OJK7E4LJSM.tmp\windowsdesktop-runtime-8-x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-OJK7E4LJSM.tmp\windowsdesktop-runtime-8-x64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2636
        • C:\Windows\Temp\{E00B2CA8-C776-41E5-BA9B-1ACA59A044E3}\.cr\windowsdesktop-runtime-8-x64.exe
          "C:\Windows\Temp\{E00B2CA8-C776-41E5-BA9B-1ACA59A044E3}\.cr\windowsdesktop-runtime-8-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-OJK7E4LJSM.tmp\windowsdesktop-runtime-8-x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1924
          • C:\Windows\Temp\{F4D4F438-ECC5-4479-A4E7-BBB4AED32195}\.be\windowsdesktop-runtime-8.0.28-win-x64.exe
            "C:\Windows\Temp\{F4D4F438-ECC5-4479-A4E7-BBB4AED32195}\.be\windowsdesktop-runtime-8.0.28-win-x64.exe" -q -burn.elevated BurnPipe.{5C605F03-9E2D-4E5F-81E0-23DB152893E2} {D0E4604A-9DEE-49D0-A3C0-071E3F4D1944} 1924
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:2568
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 1600
            5⤵
            • Program crash
            PID:6048
      • C:\Users\Admin\AppData\Local\Programs\RedBooster\RedBooster.exe
        "C:\Users\Admin\AppData\Local\Programs\RedBooster\RedBooster.exe"
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Modifies trusted root certificate store through registry
        • Modifies system certificate store
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3348
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -NonInteractive -NoLogo -Command " [Console]::OutputEncoding=[System.Text.Encoding]::UTF8 $ErrorActionPreference='Continue' $ProgressPreference='SilentlyContinue' while ($true) { $line = [Console]::In.ReadLine() if ($null -eq $line) { break } if ($line.Length -eq 0) { continue } $p = $line.Split(':', 2) $id = $p[0] $script = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($p[1])) $err = '' try { # Collect the script's output into an array FIRST, then iterate it. Piping # the scriptblock straight into a live \"| ForEach-Object\" breaks any command # that auto-loads its module mid-pipeline (e.g. Get-PhysicalDisk throws # \"MoveNext / Invalid property\" and silently drops all output). Collecting to # @(...) runs the module load to completion before we enumerate. $items = @(& ([scriptblock]::Create($script)) 2>&1) foreach ($item in $items) { if ($item -is [System.Management.Automation.ErrorRecord]) { $err += ($item.ToString() + [Environment]::NewLine) } elseif ($item -is [string]) { [Console]::Out.WriteLine($item) } else { [Console]::Out.WriteLine((($item | Out-String -Width 100000).TrimEnd())) } } } catch { $err += ($_.Exception.Message + [Environment]::NewLine) } $code = if ($err) { 1 } else { 0 } [Console]::Out.WriteLine(\"<<<RBERR:$($id)>>>\") [Console]::Out.Write($err) [Console]::Out.WriteLine(\"<<<RBDONE:$($id):$($code)>>>\") [Console]::Out.Flush() }"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4988
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RedBooster.exe --webview-exe-version=3.4.1 --user-data-dir="C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3348.4960.16348520920885572550 /pfhostedapp:fca9d754a548ef85b895d2e2de762439990dfc32
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          PID:3548
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView /prefetch:4 /pfhostedapp:fca9d754a548ef85b895d2e2de762439990dfc32 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcf3405fd8,0x7ffcf3405fe4,0x7ffcf3405ff0
            5⤵
              PID:6048
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView" --webview-exe-name=RedBooster.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,16338169202823723706,9851668236130462516,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:fca9d754a548ef85b895d2e2de762439990dfc32
              5⤵
                PID:5668
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView" --webview-exe-name=RedBooster.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2212 --field-trial-handle=1756,i,16338169202823723706,9851668236130462516,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:fca9d754a548ef85b895d2e2de762439990dfc32
                5⤵
                  PID:5372
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView" --webview-exe-name=RedBooster.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1916 --field-trial-handle=1756,i,16338169202823723706,9851668236130462516,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:fca9d754a548ef85b895d2e2de762439990dfc32
                  5⤵
                    PID:5376
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView" --webview-exe-name=RedBooster.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3492 --field-trial-handle=1756,i,16338169202823723706,9851668236130462516,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:fca9d754a548ef85b895d2e2de762439990dfc32 /prefetch:1
                    5⤵
                      PID:4952
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue'; $ProgressPreference='SilentlyContinue' # 1) Re-register App Installer if it's installed but not registered for this user (instant, common case). Get-AppxPackage Microsoft.DesktopAppInstaller | ForEach-Object { Add-AppxPackage -DisableDevelopmentMode -Register (\"$($_.InstallLocation)\AppXManifest.xml\") } # 2) Still missing -> download + install the official App Installer (winget) bundle + its VCLibs dependency. if (-not (Get-Command winget -ErrorAction SilentlyContinue)) { $tmp = Join-Path $env:TEMP 'rb_winget'; New-Item -ItemType Directory -Force -Path $tmp | Out-Null try { $vc = Join-Path $tmp 'vclibs.appx'; Invoke-WebRequest 'https://aka.ms/Microsoft.VCLibs.x64.14.00.Desktop.appx' -OutFile $vc -UseBasicParsing; Add-AppxPackage $vc } catch {} try { $b = Join-Path $tmp 'winget.msixbundle'; Invoke-WebRequest 'https://aka.ms/getwinget' -OutFile $b -UseBasicParsing; Add-AppxPackage $b } catch {} }"
                    4⤵
                    • Badlisted process makes network request
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3356
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command $null
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3036
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct -ErrorAction SilentlyContinue | Select-Object UUID | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4648
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct -ErrorAction SilentlyContinue | Select-Object UUID | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1340
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_BaseBoard -ErrorAction SilentlyContinue | Select-Object SerialNumber | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3264
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct -ErrorAction SilentlyContinue | Select-Object UUID | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1988
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_Processor -ErrorAction SilentlyContinue | Select-Object ProcessorId | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4520
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "$os=Get-CimInstance Win32_OperatingSystem $cpu=(Get-CimInstance Win32_Processor | Measure-Object -Property LoadPercentage -Average).Average $t=$os.TotalVisibleMemorySize; $f=$os.FreePhysicalMemory [pscustomobject]@{ cpuPct=[int]$cpu; ramPct=[int]((($t-$f)/$t)*100); ramUsedGb=[math]::Round(($t-$f)/1MB,1); ramTotalGb=[math]::Round($t/1MB,1) } | ConvertTo-Json -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2524
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct -ErrorAction SilentlyContinue | Select-Object UUID | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5660
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "$os=Get-CimInstance Win32_OperatingSystem $cpu=(Get-CimInstance Win32_Processor | Measure-Object -Property LoadPercentage -Average).Average $t=$os.TotalVisibleMemorySize; $f=$os.FreePhysicalMemory [pscustomobject]@{ cpuPct=[int]$cpu; ramPct=[int]((($t-$f)/$t)*100); ramUsedGb=[math]::Round(($t-$f)/1MB,1); ramTotalGb=[math]::Round($t/1MB,1) } | ConvertTo-Json -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:676
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct -ErrorAction SilentlyContinue | Select-Object UUID | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2920
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct -ErrorAction SilentlyContinue | Select-Object UUID | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5652
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_BaseBoard -ErrorAction SilentlyContinue | Select-Object SerialNumber | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2308
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_BaseBoard -ErrorAction SilentlyContinue | Select-Object SerialNumber | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1324
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_Processor -ErrorAction SilentlyContinue | Select-Object ProcessorId | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2776
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -ClassName Win32_Processor -ErrorAction SilentlyContinue | Select-Object ProcessorId | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3036
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "@(Get-CimInstance Win32_DiskDrive -ErrorAction SilentlyContinue | ForEach-Object { [pscustomobject]@{ index=[int]$_.Index; model=[string]$_.Model; media=[string]$_.MediaType; bus=[string]$_.InterfaceType; health=[string]$_.Status; sizeGb=[math]::Round($_.Size/1GB,0); tempC=0; wear=0; readErrors=0 } }) | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Hide Artifacts: Ignore Process Interrupts
                    PID:5276
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "@(Get-CimInstance Win32_DiskDrive -ErrorAction SilentlyContinue | ForEach-Object { [pscustomobject]@{ index=[int]$_.Index; model=[string]$_.Model; media=[string]$_.MediaType; bus=[string]$_.InterfaceType; health=[string]$_.Status; sizeGb=[math]::Round($_.Size/1GB,0); tempC=0; wear=0; readErrors=0 } }) | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Hide Artifacts: Ignore Process Interrupts
                    PID:2988
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue | Select-Object CurrentTemperature | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:1868
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "@(Get-PhysicalDisk -ErrorAction SilentlyContinue | ForEach-Object { $rc = $_ | Get-StorageReliabilityCounter -ErrorAction SilentlyContinue [pscustomobject]@{ index=[int]$_.DeviceId; temp=[int]$rc.Temperature; wear=[int]$rc.Wear; readErrors=[int]$rc.ReadErrorsTotal } }) | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Hide Artifacts: Ignore Process Interrupts
                    PID:4996
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "@(Get-PhysicalDisk -ErrorAction SilentlyContinue | ForEach-Object { $rc = $_ | Get-StorageReliabilityCounter -ErrorAction SilentlyContinue [pscustomobject]@{ index=[int]$_.DeviceId; temp=[int]$rc.Temperature; wear=[int]$rc.Wear; readErrors=[int]$rc.ReadErrorsTotal } }) | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Hide Artifacts: Ignore Process Interrupts
                    PID:6008
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -NonInteractive -Command "$since=(Get-Date).AddDays(-14); $res=@() Get-WinEvent -FilterHashtable @{LogName='System';Id=1001;ProviderName='Microsoft-Windows-WER-SystemErrorReporting';StartTime=$since} -MaxEvents 10 -ErrorAction SilentlyContinue | ForEach-Object { $res += [pscustomobject]@{time=$_.TimeCreated.ToString('g');unix=[long]([DateTimeOffset]$_.TimeCreated).ToUnixTimeSeconds();type='BSOD';detail=(($_.Message -split \"`n\")[0])} } Get-WinEvent -FilterHashtable @{LogName='System';Id=41;StartTime=$since} -MaxEvents 5 -ErrorAction SilentlyContinue | ForEach-Object { $res += [pscustomobject]@{time=$_.TimeCreated.ToString('g');unix=[long]([DateTimeOffset]$_.TimeCreated).ToUnixTimeSeconds();type='Unexpected shutdown';detail='Kernel-Power 41 - power loss or hard lock'} } Get-WinEvent -FilterHashtable @{LogName='Application';Id=1000;StartTime=$since} -MaxEvents 15 -ErrorAction SilentlyContinue | ForEach-Object { $res += [pscustomobject]@{time=$_.TimeCreated.ToString('g');unix=[long]([DateTimeOffset]$_.TimeCreated).ToUnixTimeSeconds();type='App crash';detail=(($_.Message -split \"`n\")[0])} } @($res) | Sort-Object time -Descending | ConvertTo-Json -Depth 3 -Compress"
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Hide Artifacts: Ignore Process Interrupts
                    PID:3676
            • C:\Windows\system32\msiexec.exe
              C:\Windows\system32\msiexec.exe /V
              1⤵
              • Enumerates connected drives
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2968
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 4F931676C0D308659BDD5DAB5EEB9C0D
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2756
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding FC723824D7EAE2AEACE39054B1B717FB
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2608
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 8CDA689833B9BA7A91CCB45F5B5DBD70
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:5200
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding CFE6B32C05114405B5ED5E38734033B0
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:5500
            • C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe
              "C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe" /burn.runonce
              1⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1980
              • C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe
                "C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035220.log" /install
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3664
                • C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe
                  "C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035220.log" /install
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3032
                  • C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe
                    "C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\windowsdesktop-runtime-8.0.28-win-x64.exe" -q -burn.elevated BurnPipe.{3D176769-9C7E-4586-8985-6711D6227457} {42AE7F87-DB6A-4343-8319-7EE8815E312F} 3032
                    4⤵
                    • Adds Run key to start application
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:4716
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 1076
                    4⤵
                    • Program crash
                    PID:5484
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 1924 -ip 1924
              1⤵
                PID:1428
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3032 -ip 3032
                1⤵
                  PID:3300

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      e59cba6.rbs
                      • Path C:\Config.Msi\e59cba6.rbs
                      • Size 48KB
                      • SHA256 952a0516127dc429c07193c6e5c14a15b630bfcb6ebec270552e1a595de1937e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e59cbab.rbs
                      • Path C:\Config.Msi\e59cbab.rbs
                      • Size 9KB
                      • SHA256 dc4042326eda462c8951b72867807a385060e59be5677ee1ecb99d6b48262d38
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e59cbb0.rbs
                      • Path C:\Config.Msi\e59cbb0.rbs
                      • Size 11KB
                      • SHA256 f9958dc08b2aea4e1c3f07e019f4f49b5b66d2fadbcd0099aed8752455b096da
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e59cbb5.rbs
                      • Path C:\Config.Msi\e59cbb5.rbs
                      • Size 8KB
                      • SHA256 3c343221493972c5c6cf266f1d184d1109f7c27eb7e93ebeecc1b756b6091f4e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e59cbb6.rbf
                      • Path C:\Config.Msi\e59cbb6.rbf
                      • Size 143KB
                      • SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e59cbb7.rbf
                      • Path C:\Config.Msi\e59cbb7.rbf
                      • Size 3B
                      • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
                      • MD5 SHA1 SHA512
                      Submit Download

                      e59cbbb.rbs
                      • Path C:\Config.Msi\e59cbbb.rbs
                      • Size 87KB
                      • SHA256 1c5f70335ca0769580337b8537bdd5bf132c56d9b1c69c7132df9f6a215ef5c4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      state.rsm
                      • Path C:\ProgramData\Package Cache\{7644bebe-5a2f-4e49-91b7-fdd90f230fa5}\state.rsm
                      • Size 1022B
                      • SHA256 2bbf9566d27308f92a0bc1e60cc684e9934b693c33f94f3bcb3ad858534d1557
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ModuleAnalysisCache
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                      • Size 67KB
                      • SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ModuleAnalysisCache
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                      • Size 67KB
                      • SHA256 1ff5f95c1f82988933e23cd6048bbe5074c8b73ea654564548ab89f7c37bbdd4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 7a4226da95040c344cb33a6d0e4c4324995eab218c0980c748776e23f944f0e2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 6b238ec68ce044d1821237aed626b026e894aa7cec037c6452443842dbe3e253
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 f21fe22e9889d9defca2ad6dc70812d88515bc94260362d0bca0fdaa48d495e8
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 203e1872873eff0549817bed84c7da4d74120598ac5906925c1b5f1f50ba5601
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 fc8ec9b4360be84579df4fe9c323b36b84cf6b96106b66dbf977c222f92205c7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 6c85c6bb733752dac0296e4a04c2bf920c5e01cde6d3c4bbd59b76c8b50784c5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 37f118e18a490b047dc9379e4763bbd0dd7b57c1762c6272e8658ce832cdb693
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 64B
                      • SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
                      • MD5 SHA1 SHA512
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 752354967bbb5eb16c34437c41c0cef82b4b2238e66eb76c7e48cfb58d3ff94d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 741d1f02aceafc20265fa58b4df68ce2ea3f6b288b09e2e5284a49b6ec82d0a6
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 409ac00a7419c74e0b98287f996396278d065ba4963ebb5f3f296be3db048e6a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      RedBooster.exe
                      • Path C:\Users\Admin\AppData\Local\Programs\RedBooster\RedBooster.exe
                      • Size 16.5MB
                      • SHA256 d57f746eaf9b8d5e650ecfd981edf3700189b72efd8daabbee4700ba9e6ec85f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      .hwidlock
                      • Path C:\Users\Admin\AppData\Local\RedBooster\.hwidlock
                      • Size 374B
                      • SHA256 206648c4c9decad224d8a6a70045dd7df4c79de0cd6da1bd8acc31b2c196c82a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      prefs.json
                      • Path C:\Users\Admin\AppData\Local\RedBooster\prefs.json
                      • Size 59B
                      • SHA256 d9bbe7c7c7293d4908c88cbbbb6198af560bc79bd8d8205e4062340426b098c8
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      settings.dat
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Crashpad\settings.dat
                      • Size 280B
                      • SHA256 a8afed6621d75393f70418f975fa06708b27028a8699f588f1a1f6d464c82606
                      • MD5 SHA1 SHA512
                      Submit Download

                      settings.dat
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Crashpad\settings.dat
                      • Size 280B
                      • SHA256 6ca80a7ed6c8e4b0b6358d69d24dd119c023011d556bf47bc790185493144338
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      throttle_store.dat
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Crashpad\throttle_store.dat
                      • Size 20B
                      • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                      • MD5 SHA1 SHA512
                      Submit Download

                      the-real-index
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                      • Size 120B
                      • SHA256 b1022ad3c83934c0f2f8e1586dc53ad91c2cf4e99eb505ce6dd213ad82134120
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      the-real-index
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                      • Size 48B
                      • SHA256 f3e7523f813c61c89c4ead19b8e8dc68f24bd65928c9609369d43eba6e01bf55
                      • MD5 SHA1 SHA512
                      Submit Download

                      000001.dbtmp
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Extension Rules\000001.dbtmp
                      • Size 16B
                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                      • MD5 SHA1 SHA512
                      Submit Download

                      Network Persistent State
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Network\Network Persistent State
                      • Size 111B
                      • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Network Persistent State~RFe5b1682.TMP
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Network\Network Persistent State~RFe5b1682.TMP
                      • Size 59B
                      • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      SCT Auditing Pending Reports
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Network\SCT Auditing Pending Reports
                      • Size 2B
                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                      • MD5 SHA1 SHA512
                      Submit Download

                      Preferences
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Preferences
                      • Size 6KB
                      • SHA256 1c9be05524fc6ed88f00188ac28ca73e882a65836fc8b24dffcda652bc30bf0e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Preferences
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Preferences
                      • Size 6KB
                      • SHA256 3729dbb276a4b4b5c462df5337a4376f3c7f4d76de557d611e5f7f4b6c8f8be5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Preferences~RFe5a4c6c.TMP
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Preferences~RFe5a4c6c.TMP
                      • Size 5KB
                      • SHA256 59b33f9740b5a46895946d564df81b46d3144698fb55bd9505c07827ddbc3aeb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MANIFEST-000001
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
                      • Size 41B
                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                      • MD5 SHA1 SHA512
                      Submit Download

                      data_0
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\GraphiteDawnCache\data_0
                      • Size 8KB
                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_1
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\GraphiteDawnCache\data_1
                      • Size 264KB
                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_2
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\GraphiteDawnCache\data_2
                      • Size 8KB
                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_3
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\GraphiteDawnCache\data_3
                      • Size 8KB
                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State
                      • Size 3KB
                      • SHA256 0f55292c9e043ca092e50c9abd9cec04a512dd882329aa74a3ea77a956dbdd28
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State
                      • Size 3KB
                      • SHA256 96cafb52e76c70a80563fb0608c90eb752a28e38466a2a2061d98083e524e427
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State
                      • Size 2KB
                      • SHA256 15c6086f610a4d0ab5295604714fd0694c1fbd67975cc7f3284da56842d3fff4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State
                      • Size 3KB
                      • SHA256 ff9479bedc86bce31c1a1d6b03fc88b703920f919f5a473afc73ebdd5af30f2c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State
                      • Size 15KB
                      • SHA256 5e0efc5b6569e17319dd5942edf328cbeaaddc5da02f1cf629b523bad7ad3ba8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Local State~RFe59ef67.TMP
                      • Path C:\Users\Admin\AppData\Local\RedBooster\webview2-v1_0_1\EBWebView\Local State~RFe59ef67.TMP
                      • Size 1KB
                      • SHA256 b8b8cd0268688fb198188bffe9db555b63567c2b86800ed29c12f85c0bc8581e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035220.log
                      • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035220.log
                      • Size 10KB
                      • SHA256 c2c6fcca127063d0becb47f3f99327feed73c5673c5131c5d665172c41f5a6ef
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035220_000_dotnet_runtime_8.0.28_win_x64.msi.log
                      • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.28_(x64)_20260712035220_000_dotnet_runtime_8.0.28_win_x64.msi.log
                      • Size 2KB
                      • SHA256 0bde68898f45556654d67d18635aa9d240e4942d790d47876a7f9bcec6777a2a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __PSScriptPolicyTest_fesxlolj.13h.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fesxlolj.13h.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      RedBooster-Setup.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\is-54B4A5LGRB.tmp\RedBooster-Setup.tmp
                      • Size 4.3MB
                      • SHA256 aaf88c4b1f822becd814d02330443cc73f552ab90c4f1d93084c48841d0e25b6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSID4CB.tmp
                      • Path C:\Windows\Installer\MSID4CB.tmp
                      • Size 219KB
                      • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      thm.wxl
                      • Path C:\Windows\Temp\{A64BF1F1-CBB2-4867-B060-925657899200}\.ba\1033\thm.wxl
                      • Size 5KB
                      • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      windowsdesktop-runtime-8-x64.exe
                      • Path C:\Windows\Temp\{E00B2CA8-C776-41E5-BA9B-1ACA59A044E3}\.cr\windowsdesktop-runtime-8-x64.exe
                      • Size 607KB
                      • SHA256 783abfc08b33d96d46c83948d805a3b84c8b3d499022856496e21c40673c0ee2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      bg.png
                      • Path C:\Windows\Temp\{F4D4F438-ECC5-4479-A4E7-BBB4AED32195}\.ba\bg.png
                      • Size 4KB
                      • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wixstdba.dll
                      • Path C:\Windows\Temp\{F4D4F438-ECC5-4479-A4E7-BBB4AED32195}\.ba\wixstdba.dll
                      • Size 190KB
                      • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dotnet_host_8.0.28_win_x64.msi
                      • Path C:\Windows\Temp\{F4D4F438-ECC5-4479-A4E7-BBB4AED32195}\dotnet_host_8.0.28_win_x64.msi
                      • Size 704KB
                      • SHA256 e368cbd51e46ba49b14975c858f3a6c6295890f438fbeb4e7a07b93a9b5bf00e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dotnet_hostfxr_8.0.28_win_x64.msi
                      • Path C:\Windows\Temp\{F4D4F438-ECC5-4479-A4E7-BBB4AED32195}\dotnet_hostfxr_8.0.28_win_x64.msi
                      • Size 776KB
                      • SHA256 a2241bbfa9e412ed3e0a7bc63eab3b88421bfe8172432af9152ac84709443bc3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dotnet_runtime_8.0.28_win_x64.msi
                      • Path C:\Windows\Temp\{F4D4F438-ECC5-4479-A4E7-BBB4AED32195}\dotnet_runtime_8.0.28_win_x64.msi
                      • Size 26.2MB
                      • SHA256 8e57991c99308ccc3f4ca5de726b9915bb379a1c903db61c0e28f257142da835
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      windowsdesktop_runtime_8.0.28_win_x64.msi
                      • Path C:\Windows\Temp\{F4D4F438-ECC5-4479-A4E7-BBB4AED32195}\windowsdesktop_runtime_8.0.28_win_x64.msi
                      • Size 28.9MB
                      • SHA256 167bbc995b57fec6a02beea16e607c2d4c95982384201710989c2b02fd8d1f97
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/3348-437-0x000002B0E71F0000-0x000002B0E7218000-memory.dmp
                      Download

                      memory/3356-657-0x0000022756510000-0x0000022756518000-memory.dmp
                      Download

                      memory/3356-653-0x00000227567D0000-0x00000227567FA000-memory.dmp
                      Download

                      memory/3356-669-0x00000227567B0000-0x00000227567B8000-memory.dmp
                      Download

                      memory/3356-670-0x00000227567C0000-0x00000227567C6000-memory.dmp
                      Download

                      memory/3356-671-0x0000022756840000-0x000002275684A000-memory.dmp
                      Download

                      memory/3356-651-0x0000022756940000-0x0000022756B44000-memory.dmp
                      Download

                      memory/3356-652-0x0000022756730000-0x000002275674A000-memory.dmp
                      Download

                      memory/3356-692-0x00000227567B0000-0x00000227567B8000-memory.dmp
                      Download

                      memory/3356-664-0x0000022756820000-0x000002275683C000-memory.dmp
                      Download

                      memory/3356-654-0x00000227561E0000-0x00000227561E8000-memory.dmp
                      Download

                      memory/3356-656-0x0000022756500000-0x000002275650A000-memory.dmp
                      Download

                      memory/3356-655-0x00000227561F0000-0x00000227561F6000-memory.dmp
                      Download

                      memory/3356-658-0x0000022756780000-0x00000227567A6000-memory.dmp
                      Download

                      memory/3356-662-0x0000022756800000-0x000002275681E000-memory.dmp
                      Download

                      memory/3356-663-0x0000022756770000-0x000002275677A000-memory.dmp
                      Download

                      memory/4652-1-0x0000000000260000-0x000000000035C000-memory.dmp
                      Download

                      memory/4652-8-0x0000000000260000-0x000000000035C000-memory.dmp
                      Download

                      memory/4652-257-0x0000000000260000-0x000000000035C000-memory.dmp
                      Download

                      memory/4952-564-0x00007FFD20550000-0x00007FFD20551000-memory.dmp
                      Download

                      memory/4988-256-0x000002079EFD0000-0x000002079F192000-memory.dmp
                      Download

                      memory/4988-259-0x000002079F6D0000-0x000002079FBF8000-memory.dmp
                      Download

                      memory/4988-184-0x000002079E6D0000-0x000002079E6F2000-memory.dmp
                      Download

                      memory/4988-222-0x000002079EBE0000-0x000002079EC92000-memory.dmp
                      Download

                      memory/4988-252-0x000002079EE30000-0x000002079EE54000-memory.dmp
                      Download

                      memory/4988-251-0x000002079EE30000-0x000002079EE5A000-memory.dmp
                      Download

                      memory/4988-221-0x000002079EBC0000-0x000002079EBDE000-memory.dmp
                      Download

                      memory/4988-245-0x000002079ECA0000-0x000002079ECAA000-memory.dmp
                      Download

                      memory/4996-1147-0x00000238225B0000-0x00000238225BA000-memory.dmp
                      Download

                      memory/5068-10-0x0000000000C70000-0x0000000000C71000-memory.dmp
                      Download

                      memory/5068-9-0x0000000000CA0000-0x00000000010F8000-memory.dmp
                      Download

                      memory/5068-250-0x0000000000CA0000-0x00000000010F8000-memory.dmp
                      Download

                      memory/5068-6-0x0000000000C70000-0x0000000000C71000-memory.dmp
                      Download

                      memory/5068-117-0x0000000000CA0000-0x00000000010F8000-memory.dmp
                      Download

                      memory/5668-488-0x00007FFD20550000-0x00007FFD20551000-memory.dmp
                      Download

                      memory/5668-1020-0x000001F83A240000-0x000001F83A26F000-memory.dmp
                      Download