Windows Analysis Report
TortoiseGit-2.15.0.1-Hotfix-64bit.exe

Overview

General Information

Sample name:	TortoiseGit-2.15.0.1-Hotfix-64bit.exe
Analysis ID:	1428708
MD5:	225cc0331d839e8dbea3f6dc320c59b2
SHA1:	cc0795986ae7bcc67e6733e6c83aae7e5a80a2b2
SHA256:	cb7581b6f859154ac0ed03ef7414eb5ee82002ccf3cad3aa93647d0c7efe19b7
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Drops PE files

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Signatures

Uses 32bit PE files

Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe

Static PE information: certificate valid

Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://ccsca2021.ocsp-certum.com05
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://repository.certum.pl/ccsca2021.cer0
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0A
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://s.symcd.com06
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: https://d.symcb.com/rpa0.
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe, 00000000.00000003.1700591721.00000000022C3000.00000004.00001000.00020000.00000000.sdmp, TortoiseGit-2.15.0.1-Hotfix-64bit.tmp, 00000001.00000003.1698856525.00000000025AA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tortoisegit.org
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe, 00000000.00000003.1650871083.0000000002580000.00000004.00001000.00020000.00000000.sdmp, TortoiseGit-2.15.0.1-Hotfix-64bit.tmp, 00000001.00000003.1656036498.0000000003490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tortoisegit.org.https://tortoisegit.org.https://tortoisegit.org
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.tmp, 00000001.00000003.1698856525.00000000025AA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tortoisegit.orgA
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe, 00000000.00000003.1700591721.00000000022C3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tortoisegit.orgQ6
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	String found in binary or memory: https://www.certum.pl/CPS0
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe, 00000000.00000003.1652184920.0000000002580000.00000004.00001000.00020000.00000000.sdmp, TortoiseGit-2.15.0.1-Hotfix-64bit.exe, 00000000.00000003.1652813555.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, TortoiseGit-2.15.0.1-Hotfix-64bit.tmp, 00000001.00000000.1654433570.0000000000401000.00000020.00000001.01000000.00000004.sdmp, TortoiseGit-2.15.0.1-Hotfix-64bit.tmp.0.dr	String found in binary or memory: https://www.innosetup.com/
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe, 00000000.00000003.1652184920.0000000002580000.00000004.00001000.00020000.00000000.sdmp, TortoiseGit-2.15.0.1-Hotfix-64bit.exe, 00000000.00000003.1652813555.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, TortoiseGit-2.15.0.1-Hotfix-64bit.tmp, 00000001.00000000.1654433570.0000000000401000.00000020.00000001.01000000.00000004.sdmp, TortoiseGit-2.15.0.1-Hotfix-64bit.tmp.0.dr	String found in binary or memory: https://www.remobjects.com/ps

PE file contains executable resources (Code or Archives)

Source: TortoiseGit-2.15.0.1-Hotfix-64bit.tmp.0.dr

Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Sample file is different than original file name gathered from version info

Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe, 00000000.00000000.1650550452.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs TortoiseGit-2.15.0.1-Hotfix-64bit.exe
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe, 00000000.00000003.1700591721.0000000002288000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs TortoiseGit-2.15.0.1-Hotfix-64bit.exe
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe, 00000000.00000003.1652813555.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs TortoiseGit-2.15.0.1-Hotfix-64bit.exe
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe, 00000000.00000003.1652184920.0000000002878000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs TortoiseGit-2.15.0.1-Hotfix-64bit.exe
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	Binary or memory string: OriginalFileName vs TortoiseGit-2.15.0.1-Hotfix-64bit.exe

Uses 32bit PE files

Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: clean3.winEXE@3/2@0/0

Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe

File created: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp

Jump to behavior

Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe

File read: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe "C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe"
Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe	Process created: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp "C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp" /SL5="$2043C,1792279,832512,C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe"
Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe	Process created: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp "C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp" /SL5="$2043C,1792279,832512,C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe"	Jump to behavior

Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe

Static PE information: certificate valid

Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe

Static file information: File size 2642464 > 1048576

Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains sections with non-standard names

Source: TortoiseGit-2.15.0.1-Hotfix-64bit.exe	Static PE information: section name: .didata
Source: TortoiseGit-2.15.0.1-Hotfix-64bit.tmp.0.dr	Static PE information: section name: .didata

Drops PE files

Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe	File created: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	File created: C:\Users\user\AppData\Local\Temp\is-279VF.tmp\_isetup\_setup64.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\TortoiseGit-2.15.0.1-Hotfix-64bit.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-279VF.tmp\_isetup\_setup64.tmp

Jump to dropped file

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1428708
Product:	CloudBasic
Start time:	12:33:16
Start date:	19.04.2024
Sample:	TortoiseGit-2.15.0.1-Hotfix-64bit.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	225cc0331d839e8dbea3f6dc320c59b2
SHA1:	cc0795986ae7bcc67e6733e6c83aae7e5a80a2b2
SHA256:	cb7581b6f859154ac0ed03ef7414eb5ee82002ccf3cad3aa93647d0c7efe19b7
Filetype:	Win32 Executable (generic) a (10002005/4) 98.04%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\is-279VF.tmp\_isetup\_setup64.tmp	PE32+ executable (console) x86-64, for MS Windows	E4211D6D009757C078A9FAC7FF4F03D4	019CD56BA687D39D12D4B13991C9A42EA6BA03DA	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
C:\Users\user\AppData\Local\Temp\is-C5IQ9.tmp\TortoiseGit-2.15.0.1-Hotfix-64bit.tmp	PE32 executable (GUI) Intel 80386, for MS Windows	F7545D5A5837D3B545E0B0C77BA6D8C5	6F66EEA352C84D19243161B3A0F8C5B9DB041B01	75C5D113B9E9E678A89EBD19C6BA63F0869197673BCE53A9866C60E3A03A6C3B

Windows Analysis Report
TortoiseGit-2.15.0.1-Hotfix-64bit.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Windows Analysis Report TortoiseGit-2.15.0.1-Hotfix-64bit.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
TortoiseGit-2.15.0.1-Hotfix-64bit.exe