Resubmissions

25/06/2026, 04:15

260625-evbfasht8k7

25/06/2026, 01:34

260625-by89ysgx6x8

Analysis

  • geolocation tags

    cacanadananorth-americatoronto
  • user interaction
    yes
  • max time kernel
    599s
  • max time network
    555s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/06/2026, 04:15

General

  • Target
    Archive_free_968795.zip
  • Size 781.7MB
  • Sample260625-evbfasht8k
  • SHA256 38da9c1afdbe6dd04607fbc07be4ae1fcb5e8e67609c62ad772205fdfbc2f211
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Indirect Command Execution 1 TTPs 1 IoCs

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

  • Loads dropped DLL 7 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • NTFS ADS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Archive_free_968795.zip
    1⤵
      PID:4888
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3284
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\" -ad -an -ai#7zMap30850:118:7zEvent29315
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:1292
      • C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\Setup.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • NTFS ADS
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2264
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ver"
          2⤵
            PID:1536
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            2⤵
              PID:4456
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "ver"
              2⤵
                PID:2204
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2024
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Get-PSDrive C | Select-Object Used,Free"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3832
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3724
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3804
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3144
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5076
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4788
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1096
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:896
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4512
              • C:\Windows\SYSTEM32\forfiles.exe
                forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-01116-Ugn9qVeMHznY /m akq0lPBla.gy /c "cmd /c ren @file akq0lPBla.bat && call akq0lPBla.bat"
                2⤵
                • Indirect Command Execution
                • Suspicious use of WriteProcessMemory
                PID:5116
                • C:\Windows\SYSTEM32\cmd.exe
                  /c ren "akq0lPBla.gy" akq0lPBla.bat && call akq0lPBla.bat
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4708
                  • C:\Windows\system32\where.exe
                    where conhost.exe
                    4⤵
                      PID:1784
                    • C:\Windows\System32\conhost.exe
                      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-01116-Ugn9qVeMHznY\akq0lPBla.bat" /launched
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3192
                      • C:\Windows\System32\cmd.exe
                        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-01116-Ugn9qVeMHznY\akq0lPBla.bat /launched
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1616
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-01116-Ugn9qVeMHznY\TelemetryExporter.csproj" /nologo /v:q
                          6⤵
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:1280

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    Setup.exe

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\Setup.exe
                    • Size 102KB
                    • SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    Setup.py

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\Setup.py
                    • Size 8KB
                    • SHA256 5a2d8e648e3f4cbdcd32cbd2bb0ba48d10de32fe14042e201a8bb7088cefad79
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    libpython3.9.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\py3-windows-x86_64\libpython3.9.dll
                    • Size 8.3MB
                    • SHA256 ff051213109bca8ae55d458c3eb8c9c0aae12a765ecbb45e6b4b20d4b97b8da7
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    librenpython.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\py3-windows-x86_64\librenpython.dll
                    • Size 18.2MB
                    • SHA256 29d7304930809804502f331e47d06b72f07b3a1569eb29e0a12dbc71932915d6
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    libwinpthread-1.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\py3-windows-x86_64\libwinpthread-1.dll
                    • Size 344KB
                    • SHA256 00d784e7e002c1b01f3146c87f30030f169843988f87c9631cb2df211979286b
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    pythonw.exe

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\py3-windows-x86_64\pythonw.exe
                    • Size 101KB
                    • SHA256 092c282f21cdedf3d533dfbc3c77401856de863833904fc09a1d3668e8d50181
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    __future__.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\__future__.pyc
                    • Size 4KB
                    • SHA256 791de268946ce6bca07aea7fb44c9ad0172b374bea4b290c38fa6e9c1efd5e44
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    _collections_abc.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\_collections_abc.pyc
                    • Size 31KB
                    • SHA256 2cbbd85b65288eafacdd1078886412b4db7028b2426e9e78fc0966ac9c72dca7
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    _sitebuiltins.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\_sitebuiltins.pyc
                    • Size 3KB
                    • SHA256 5c6211bf1ea5ab94ddbdb19020f32f7b5cb9d9873f1f451417893013cecc3eec
                    • MD5 SHA1 SHA512 TLSH

                    _weakrefset.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\_weakrefset.pyc
                    • Size 7KB
                    • SHA256 f5a5dc1b0f6b04e1f4cfaac2de9a7d725cc36714cb3f6c6877ff1337744ff2e5
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    abc.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\abc.pyc
                    • Size 5KB
                    • SHA256 ff626b3784358e901e4471455590b498976ca5b8a00f03e4dfbddef18fccb713
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    codecs.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\codecs.pyc
                    • Size 33KB
                    • SHA256 2ff36394b0709a01d9d8f462c9e3b5b560889cc3a5fbe220806fd4d2eae22b03
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    __init__.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\collections\__init__.pyc
                    • Size 47KB
                    • SHA256 8a50a5cb03a19117bcf9d7ea411c986035897507a3cd2f47fe4fecc19bba477e
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    abc.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\collections\abc.pyc
                    • Size 284B
                    • SHA256 f2e80650020264ca35992599f5bb32350c52e956eb9a1fbe4652f252f3fcdec1
                    • MD5 SHA1 SHA512 TLSH

                    contextlib.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\contextlib.pyc
                    • Size 19KB
                    • SHA256 fd59bf2c48669be1353f2cd5363b094dca4ece15d42ec6f01a5ee7532308a1a2
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    copyreg.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\copyreg.pyc
                    • Size 4KB
                    • SHA256 92a632830334a081aa962a82cb41c58798c762ef7eb693f2b302da48213310de
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    __init__.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\encodings\__init__.pyc
                    • Size 3KB
                    • SHA256 ea7759ddcd2fea6a218baffb964e980f842993f1b82e4e5cc09703569f802cc9
                    • MD5 SHA1 SHA512 TLSH

                    aliases.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\encodings\aliases.pyc
                    • Size 6KB
                    • SHA256 622ce6d00d83ce8c4b6096217fe765fc84ab782165e695fcc2def4f683bb03c2
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    latin_1.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\encodings\latin_1.pyc
                    • Size 1KB
                    • SHA256 c122fc9b16cd093a58d7bdaf0ac2b2b08c44bf26ac43e4c57ae69873c6fb657b
                    • MD5 SHA1 SHA512 TLSH

                    utf_8.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\encodings\utf_8.pyc
                    • Size 1KB
                    • SHA256 b8a8831c682363f6d143667ac4533b5947ccfcd454232f7913cb84f8d31af623
                    • MD5 SHA1 SHA512 TLSH

                    enum.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\enum.pyc
                    • Size 25KB
                    • SHA256 ab2ad5047f9420eede96de4c3bf8553a68ad295874bed0281c1b9ccaa84e37c7
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    functools.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\functools.pyc
                    • Size 28KB
                    • SHA256 441df0cea8c40aa2942a64d5e24ed2c8aede292255cb61a8673b21e4d1a15164
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    __init__.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\future\__init__.pyc
                    • Size 3KB
                    • SHA256 9b94f1946cd8f5f3520d6ab8fda5e172fd3fd766a57f733da5d73556465ca99c
                    • MD5 SHA1 SHA512 TLSH

                    __init__.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\future\standard_library\__init__.pyc
                    • Size 18KB
                    • SHA256 a2373bfeee80c5fe5854b7c520c2a0f2140a464676ad3dd7fa1f32941e3ed4cd
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    genericpath.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\genericpath.pyc
                    • Size 3KB
                    • SHA256 1c7edaf8642fe225d01e166650d467aec970af443d5a013f90600629a1df6d78
                    • MD5 SHA1 SHA512 TLSH

                    heapq.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\heapq.pyc
                    • Size 13KB
                    • SHA256 a1bb7ac85755385cd8b0f2972aae0e4aecc63d7b88479b508bf9390ba622497b
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    imp.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\imp.pyc
                    • Size 9KB
                    • SHA256 26470b44c10338153505cb2a87b2770f6178101ec11bc9314c0afd0bf7f989c6
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    __init__.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\importlib\__init__.pyc
                    • Size 3KB
                    • SHA256 a90725104ae3fd25fb5a9ba43110fe2b603a363af153986d547a07dc78ccdc4d
                    • MD5 SHA1 SHA512 TLSH

                    abc.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\importlib\abc.pyc
                    • Size 16KB
                    • SHA256 317fc4c9d22f8d48b443b8b84b3aefafb1a9a815b41d617f700f9693daa1800a
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    machinery.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\importlib\machinery.pyc
                    • Size 1011B
                    • SHA256 a7451871fbb96ff6883611498cc2661148db87716fc300aefda02b9269bc24cd
                    • MD5 SHA1 SHA512 TLSH

                    util.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\importlib\util.pyc
                    • Size 9KB
                    • SHA256 50d3e8d57a98b50f0bab2aafc5e066d8f3c786c5c380d4aa13f3dee687889a47
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    io.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\io.pyc
                    • Size 3KB
                    • SHA256 d129d7d5fa5f369d85033e08f9f223323355712688d8b995dedd2f33a4a9a9a5
                    • MD5 SHA1 SHA512 TLSH

                    keyword.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\keyword.pyc
                    • Size 963B
                    • SHA256 59c18df59a88a2c2c8c6b7cd821751d85318f0a3517f52bfa17996fd1715d31b
                    • MD5 SHA1 SHA512 TLSH

                    linecache.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\linecache.pyc
                    • Size 3KB
                    • SHA256 743b6c55a6c0e9c5b6303dfef54140d034732eadcf20b6e737b4f972bb37f413
                    • MD5 SHA1 SHA512 TLSH

                    locale.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\locale.pyc
                    • Size 33KB
                    • SHA256 38f7d6fddecdc701d9f6343fec87cb687193d545eb5d3d3fe051cc07d8f9cb99
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    __init__.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\logging\__init__.pyc
                    • Size 64KB
                    • SHA256 5fc644d3bb7818eb8bb37fcf844d58ccad7de83bb411d1712e451c1aac222d11
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    ntpath.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\ntpath.pyc
                    • Size 14KB
                    • SHA256 e67087ed8b7835158580df1a84b98cd12e3e3993329d8418c98f5e9bdc1767a4
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    operator.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\operator.pyc
                    • Size 13KB
                    • SHA256 1b82559e5e53971c4ef571aa4704877f68b5a0619cf1856a2299282297fa7da0
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    os.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\os.pyc
                    • Size 30KB
                    • SHA256 1fd102e2b05ca9889bf25625f3db398e6305343e127ebdb4fc7d0919a77c962b
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    re.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\re.pyc
                    • Size 14KB
                    • SHA256 f5e0647828b7caf2355e9ece7c97f8f8e41ede1f35db2669752f1b48185c5e36
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    reprlib.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\reprlib.pyc
                    • Size 5KB
                    • SHA256 42e0ac9554af6601b7af02b30c9c489222c874552d59f3ba798cc7a872fe0aba
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    site.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\site.pyc
                    • Size 16KB
                    • SHA256 a8a3d47b0e8a7b4f111026dce262fdd32a5b954d43cd9697a7e827e8b85fa650
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    sitecustomize.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\sitecustomize.pyc
                    • Size 5KB
                    • SHA256 d05677a8f439b633d6a29474ebab583dde83f9b88becd84b4072e72b94219bfd
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    sre_compile.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\sre_compile.pyc
                    • Size 14KB
                    • SHA256 97ce5d36b2ff331c036da03abd172d59a85501b7e9925b5b1eefe5e0f9142982
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    sre_constants.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\sre_constants.pyc
                    • Size 6KB
                    • SHA256 980c99840cbe23d12c2e400fc9be373dbf7b0a18a1f6fff45f67cb2b1277e8f4
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    sre_parse.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\sre_parse.pyc
                    • Size 21KB
                    • SHA256 fafd87deb894dd05b78bd28736b917380265b57dcebe7c440c8e905072125d8d
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    stat.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\stat.pyc
                    • Size 4KB
                    • SHA256 360b2f6c4248755cb154ddbf7baeb46d27f26ea2ca7eba167f50c3e0d0ec4686
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    string.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\string.pyc
                    • Size 7KB
                    • SHA256 ec3d0279d3d98b5458eca797b8f749223a6f82db48403efa7a2c44ddec2ca7c7
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    threading.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\threading.pyc
                    • Size 41KB
                    • SHA256 c0911342956b5ce53453b29686c48235f98e613bec9369550a8d27e8a0768918
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    token.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\token.pyc
                    • Size 2KB
                    • SHA256 0b9ec584817c34d22d4f3d0af2cb6de0359c92057141d91cfe74b19258036c73
                    • MD5 SHA1 SHA512 TLSH

                    tokenize.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\tokenize.pyc
                    • Size 16KB
                    • SHA256 8721f4975c6bbf926ac10a57e641b7e547f51453d009e47f41808a548ea8ce35
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    traceback.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\traceback.pyc
                    • Size 20KB
                    • SHA256 63b8c8bca6ad8415a1da6488dcf9a8d2f2df11c53c1fcc7f65e17df7d0a4c02c
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    types.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\types.pyc
                    • Size 9KB
                    • SHA256 14531ca22b6ab26a53157df162c8cf1901a08be94f35e178c21bd17b47fe7438
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    typing.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\typing.pyc
                    • Size 70KB
                    • SHA256 9ff5c47cc20bae83a5c0d475aed306e5ffccf06bf76200a83397e366af527c97
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    warnings.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\warnings.pyc
                    • Size 13KB
                    • SHA256 3c899c03b86a394a9e2257a3dd324898a349d0a2ac8f5d8fb257261761471e46
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    weakref.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\lib\python3.9\weakref.pyc
                    • Size 19KB
                    • SHA256 10be71ddb15458f87d6fea6bd9e1e61ce3ca02a1b575f95ef0c3ca37bc19b6c0
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    __init__.py

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\renpy\__init__.py
                    • Size 20KB
                    • SHA256 184db7fc523fc7a1f174ed9c60375122bd51fe3ed15b1f5ab5a31837d3d537cf
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    __init__.cpython-39.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\renpy\__pycache__\__init__.cpython-39.pyc
                    • Size 14KB
                    • SHA256 dc6dde52a321cd63199141ebf0516694cf685e338039240f5be7888b1c551f05
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    __init__.py

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\renpy\compat\__init__.py
                    • Size 6KB
                    • SHA256 14ba7a9a302c7e857a8dc919159e3c04b6484fb1814228544f8f187c82e6f239
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    __init__.cpython-39.pyc

                    • Path C:\Users\Admin\AppData\Local\Temp\Archive_free_968795\renpy\compat\__pycache__\__init__.cpython-39.pyc
                    • Size 4KB
                    • SHA256 a5c254e0f3b6e69bb7700640a260f32039c83e8a8bb3bf02d57fb1cd2dd6db4d
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    __PSScriptPolicyTest_ra1ws3js.3bn.ps1

                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ra1ws3js.3bn.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH

                    Compile.targets:Zone.Identifier

                    • Path C:\Users\Admin\AppData\Local\Temp\tmp-01116-Ugn9qVeMHznY\Compile.targets:Zone.Identifier
                    • Size 28B
                    • SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
                    • MD5 SHA1 SHA512

                    text.txt

                    • Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
                    • Size 5B
                    • SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
                    • MD5 SHA1 SHA512

                    memory/1096-3205-0x0000018896BE0000-0x00000188976A1000-memory.dmp

                    memory/1280-3240-0x00000207555A0000-0x00000207555DE000-memory.dmp

                    memory/1280-3241-0x0000020755990000-0x00000207559AA000-memory.dmp

                    memory/1280-3248-0x000002076F630000-0x000002076F6AA000-memory.dmp

                    memory/1280-3247-0x000002076F350000-0x000002076F62E000-memory.dmp

                    memory/1280-3246-0x000002076FF10000-0x00000207700A0000-memory.dmp

                    memory/1280-3245-0x00000207572F0000-0x0000020757320000-memory.dmp

                    memory/1280-3242-0x000002076FB70000-0x000002076FCCA000-memory.dmp

                    memory/3804-3173-0x0000013D94260000-0x0000013D94D21000-memory.dmp

                    memory/3804-3171-0x0000013DAD520000-0x0000013DAD5D5000-memory.dmp

                    memory/3832-3150-0x000001B254600000-0x000001B2546B5000-memory.dmp

                    memory/3832-3149-0x000001B2545E0000-0x000001B2545FC000-memory.dmp

                    memory/3832-3139-0x000001B254020000-0x000001B254042000-memory.dmp

                    memory/3832-3151-0x000001B23BF90000-0x000001B23BF9A000-memory.dmp

                    memory/3832-3152-0x000001B254830000-0x000001B25485A000-memory.dmp

                    memory/3832-3156-0x000001B23B1D0000-0x000001B23BC91000-memory.dmp

                    memory/3832-3153-0x000001B254830000-0x000001B254854000-memory.dmp

                    memory/4512-3221-0x000002ECAC650000-0x000002ECAD111000-memory.dmp

                    memory/5076-3189-0x0000024F45FD0000-0x0000024F46A91000-memory.dmp