Overview
overview
7Static
static
3Setup.exe
windows10-2004-x64
7data/pytho...t__.py
windows10-2004-x64
3data/pytho...net.py
windows10-2004-x64
3data/pytho...eck.py
windows10-2004-x64
3data/pytho...ile.py
windows10-2004-x64
3data/pytho...pec.py
windows10-2004-x64
3lib/py3-wi...47.dll
windows10-2004-x64
1lib/py3-wi...GL.dll
windows10-2004-x64
1lib/py3-wi...v2.dll
windows10-2004-x64
1lib/py3-wi....9.dll
windows10-2004-x64
1lib/py3-wi...on.dll
windows10-2004-x64
1lib/py3-wi...-1.dll
windows10-2004-x64
1lib/py3-wi...rs.dll
windows10-2004-x64
1lib/py3-wi...on.exe
windows10-2004-x64
1lib/py3-wi...nw.exe
windows10-2004-x64
1lib/python...__.pyc
windows10-2004-x64
3lib/python...le.pyc
windows10-2004-x64
3lib/python...ss.pyc
windows10-2004-x64
3lib/python...bc.pyc
windows10-2004-x64
3lib/python...le.pyc
windows10-2004-x64
3lib/python...on.pyc
windows10-2004-x64
3lib/python...se.pyc
windows10-2004-x64
3lib/python...rt.pyc
windows10-2004-x64
3lib/python...bc.pyc
windows10-2004-x64
3lib/python...al.pyc
windows10-2004-x64
3lib/python...io.pyc
windows10-2004-x64
3lib/python...ns.pyc
windows10-2004-x64
3lib/python...me.pyc
windows10-2004-x64
3lib/python...al.pyc
windows10-2004-x64
3lib/python...et.pyc
windows10-2004-x64
3lib/python3.9/abc.pyc
windows10-2004-x64
3lib/python...__.pyc
windows10-2004-x64
3Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/06/2026, 10:35
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
data/python-packages/sys_config/__init__.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
data/python-packages/sys_config/access_internet.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
data/python-packages/sys_config/sys_check.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
data/python-packages/sys_config/sys_file.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
data/python-packages/sys_config/sys_spec.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
lib/py3-windows-x86_64/d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
lib/py3-windows-x86_64/libEGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
lib/py3-windows-x86_64/libGLESv2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
lib/py3-windows-x86_64/libpython3.9.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
lib/py3-windows-x86_64/librenpython.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
lib/py3-windows-x86_64/libwinpthread-1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
lib/py3-windows-x86_64/nvdrs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
lib/py3-windows-x86_64/python.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
lib/py3-windows-x86_64/pythonw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
lib/python3.9/__future__.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
lib/python3.9/_bootlocale.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
lib/python3.9/_bootsubprocess.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
lib/python3.9/_collections_abc.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
lib/python3.9/_compat_pickle.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
lib/python3.9/_compression.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
lib/python3.9/_markupbase.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
lib/python3.9/_osx_support.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
lib/python3.9/_py_abc.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
lib/python3.9/_pydecimal.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
lib/python3.9/_pyio.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
lib/python3.9/_sitebuiltins.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
lib/python3.9/_strptime.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
lib/python3.9/_threading_local.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
lib/python3.9/_weakrefset.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
lib/python3.9/abc.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
lib/python3.9/android/__init__.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target Setup.exe
- Size 102KB
- Sample260628-mm3htagv9t
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Indirect Command Execution 1 TTPs 1 IoCs
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
pid Process 3652 forfiles.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5016 MSBuild.exe -
pid Process 2756 powershell.exe 1476 powershell.exe 2536 powershell.exe 460 powershell.exe 2172 powershell.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 Setup.exe - NTFS ADS 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\IffM5NnM1.9sm:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\Internal.props:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\TreasuryManager.Internal.targets:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\TreasuryManager.csproj:Zone.Identifier Setup.exe File created C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\TreasuryManager.csproj.user:Zone.Identifier Setup.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2756 powershell.exe 2756 powershell.exe 1476 powershell.exe 1476 powershell.exe 2536 powershell.exe 2536 powershell.exe 460 powershell.exe 460 powershell.exe 2172 powershell.exe 2172 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2756 powershell.exe Token: SeIncreaseQuotaPrivilege 2756 powershell.exe Token: SeSecurityPrivilege 2756 powershell.exe Token: SeTakeOwnershipPrivilege 2756 powershell.exe Token: SeLoadDriverPrivilege 2756 powershell.exe Token: SeSystemProfilePrivilege 2756 powershell.exe Token: SeSystemtimePrivilege 2756 powershell.exe Token: SeProfSingleProcessPrivilege 2756 powershell.exe Token: SeIncBasePriorityPrivilege 2756 powershell.exe Token: SeCreatePagefilePrivilege 2756 powershell.exe Token: SeBackupPrivilege 2756 powershell.exe Token: SeRestorePrivilege 2756 powershell.exe Token: SeShutdownPrivilege 2756 powershell.exe Token: SeDebugPrivilege 2756 powershell.exe Token: SeSystemEnvironmentPrivilege 2756 powershell.exe Token: SeRemoteShutdownPrivilege 2756 powershell.exe Token: SeUndockPrivilege 2756 powershell.exe Token: SeManageVolumePrivilege 2756 powershell.exe Token: 33 2756 powershell.exe Token: 34 2756 powershell.exe Token: 35 2756 powershell.exe Token: 36 2756 powershell.exe Token: SeIncreaseQuotaPrivilege 2756 powershell.exe Token: SeSecurityPrivilege 2756 powershell.exe Token: SeTakeOwnershipPrivilege 2756 powershell.exe Token: SeLoadDriverPrivilege 2756 powershell.exe Token: SeSystemProfilePrivilege 2756 powershell.exe Token: SeSystemtimePrivilege 2756 powershell.exe Token: SeProfSingleProcessPrivilege 2756 powershell.exe Token: SeIncBasePriorityPrivilege 2756 powershell.exe Token: SeCreatePagefilePrivilege 2756 powershell.exe Token: SeBackupPrivilege 2756 powershell.exe Token: SeRestorePrivilege 2756 powershell.exe Token: SeShutdownPrivilege 2756 powershell.exe Token: SeDebugPrivilege 2756 powershell.exe Token: SeSystemEnvironmentPrivilege 2756 powershell.exe Token: SeRemoteShutdownPrivilege 2756 powershell.exe Token: SeUndockPrivilege 2756 powershell.exe Token: SeManageVolumePrivilege 2756 powershell.exe Token: 33 2756 powershell.exe Token: 34 2756 powershell.exe Token: 35 2756 powershell.exe Token: 36 2756 powershell.exe Token: SeDebugPrivilege 1476 powershell.exe Token: SeIncreaseQuotaPrivilege 1476 powershell.exe Token: SeSecurityPrivilege 1476 powershell.exe Token: SeTakeOwnershipPrivilege 1476 powershell.exe Token: SeLoadDriverPrivilege 1476 powershell.exe Token: SeSystemProfilePrivilege 1476 powershell.exe Token: SeSystemtimePrivilege 1476 powershell.exe Token: SeProfSingleProcessPrivilege 1476 powershell.exe Token: SeIncBasePriorityPrivilege 1476 powershell.exe Token: SeCreatePagefilePrivilege 1476 powershell.exe Token: SeBackupPrivilege 1476 powershell.exe Token: SeRestorePrivilege 1476 powershell.exe Token: SeShutdownPrivilege 1476 powershell.exe Token: SeDebugPrivilege 1476 powershell.exe Token: SeSystemEnvironmentPrivilege 1476 powershell.exe Token: SeRemoteShutdownPrivilege 1476 powershell.exe Token: SeUndockPrivilege 1476 powershell.exe Token: SeManageVolumePrivilege 1476 powershell.exe Token: 33 1476 powershell.exe Token: 34 1476 powershell.exe Token: 35 1476 powershell.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2732 Setup.exe 2732 Setup.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2732 wrote to memory of 4004 2732 Setup.exe 84 PID 2732 wrote to memory of 4764 2732 Setup.exe 86 PID 2732 wrote to memory of 1376 2732 Setup.exe 88 PID 2732 wrote to memory of 920 2732 Setup.exe 90 PID 920 wrote to memory of 2756 920 cmd.exe 92 PID 2732 wrote to memory of 5032 2732 Setup.exe 96 PID 5032 wrote to memory of 1476 5032 cmd.exe 98 PID 2732 wrote to memory of 1280 2732 Setup.exe 99 PID 1280 wrote to memory of 2536 1280 cmd.exe 101 PID 2732 wrote to memory of 4872 2732 Setup.exe 103 PID 4872 wrote to memory of 460 4872 cmd.exe 105 PID 2732 wrote to memory of 4960 2732 Setup.exe 106 PID 4960 wrote to memory of 2172 4960 cmd.exe 108 PID 2732 wrote to memory of 3652 2732 Setup.exe 110 PID 3652 wrote to memory of 4728 3652 forfiles.exe 111 PID 4728 wrote to memory of 2884 4728 cmd.exe 115 PID 4728 wrote to memory of 3364 4728 cmd.exe 116 PID 3364 wrote to memory of 4740 3364 conhost.exe 117 PID 4740 wrote to memory of 5016 4740 cmd.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:4004
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:4764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵PID:1376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""2⤵
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-PSDrive C | Select-Object Used,Free"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""2⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""2⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""2⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:460
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""2⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
-
-
C:\Windows\SYSTEM32\forfiles.exeforfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA /m IffM5NnM1.9sm /c "cmd /c ren @file IffM5NnM1.bat && call IffM5NnM1.bat"2⤵
- Indirect Command Execution
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SYSTEM32\cmd.exe/c ren "IffM5NnM1.9sm" IffM5NnM1.bat && call IffM5NnM1.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\system32\where.exewhere conhost.exe4⤵PID:2884
-
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\IffM5NnM1.bat" /launched4⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\System32\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\IffM5NnM1.bat /launched5⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\TreasuryManager.csproj" /nologo /v:q6⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:5016
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 4KB
- SHA256 15d5db2d709306df16fb0ebf06aec3ef91af94ad8e40f66cb6466d0f37edcb50
- MD5 92f60af406d2b80d372ba1a490ea18d4
- SHA1 40607747a3551da0aa1fd80ae5e7bf0375f1fe32
- SHA512 8a7a9a072d42c60c84c64322c3f01b7264d904ebd16bcf9e6cfc8d6ce5e39db00f8ecfe864fcaf09fff50deade44516c5ec7fdaa632218b3da232809f754a1bf
- SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fBPOIzoZcm0vmlvWPfsNySI:iqdYqGAjdx4qKkq3qktznEuZq6cIzooB
- TLSH T1EB81CD323375B0D4C8667F072A2819D063AF4396EA94AF4CB25C621ED92751BDB122F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 88a96111a743541f7e0634c7e78a315994f413838a40fe0dd92d971ac96f4fa0
- MD5 2cb9571a1638c0df95e76d898b29d473
- SHA1 72890fd7f83ba4b8f4358aaba4b72a0828e13499
- SHA512 856618d15945768c39f175558d13c586d9a83c0fa8bf142200b92fce0ac9db6eae5d7f032a0f639ff29da39f1957566ed48e67ba6b83cf9749a7a031e06144df
- TLSH T16B316627B3DC8822DCC9153B209C9C1172A682C7819EDF9B6FC0D225957FAD9CB61594
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c4877f5f2dc599370abc9ec51794573cb0b97e20f3b5fa5f6d888cd89319b7bf
- MD5 cfb4d2c4cda36d3cd4e07b44d36bfa4d
- SHA1 e55b7409e8bceaeccdbf5006c97cd0b0cb687356
- SHA512 508a5db5f084ec2b771dec89b6c7e0e29160c02c607c631af78ef831168e98b3f485a9ea1018b7ad65b464bc189733609bd16e15ac024f0d6feb76fad0462ae2
- TLSH T135216527B39CD8A1CCC5253A209CAC1172B783C7409ECF8F6AC0C224A57FA94CB61250
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 dd63d617a9607de67ecf702ea93f02e805d11eafbd2c6e9f705c620b1e685a22
- MD5 740951544b69d9a5a00aa693bf1e2d73
- SHA1 c46fdae6979a08b5e9db05046686f0d1edf38caa
- SHA512 e5fbfb1346aa56c358b6970e0caddb424ef416daba7ed3a2014dc18dabd2d0d5ec42f4a10518ca1453e7dc4da1893ee23b0cd18d4e91887637ce5ae9577db398
- TLSH T1BB216827B39CD9A1CC95153A109C9C1172B783C7409ECF8F6AC0D224A17F694CB61550
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 6fa9e2383011bb63b475b42dbc83c1e1db57135ac2590bec0a9003e7f036eeb7
- MD5 4a1ecdb31d7a3d9699351208166883cb
- SHA1 b62a03b1a9e94f731427b5e19bd57bbc4a53e742
- SHA512 ec94fd098e3c3674eb2fd6704414d179f1ac118c566f0b57be40050f3688e5b60bd6fd528631e827058b49f25d74d1f6f939a9c4c1ad9e0256534a83d8b491b6
- TLSH T1B2216527B39CD9A1CC95253A209DAC5172B783C7809ECF8F6AC0D224A17FAD4CB61590
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zinwxuzs.hdr.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\IffM5NnM1.9sm
- Size 1KB
- SHA256 817213d8d615821a01221a2af4a77c696e791f878682f37e5be319c3f2c82ec3
- MD5 4339c2f3b8c9e7d854ff6fa4da16bd44
- SHA1 325a4fff1482e957923ddfa9d63f1d81e3dc41f7
- SHA512 83b1e786ea72d958f8b8d76385672193495989b98a68fec48048dcab3e30ee3813c2565821cf31bee8264fa129afb63ab95318090c3cbf71c0552702d57a319c
- TLSH T156216497B5220559C4E4327B6BB98733120D72933484F5BCB0C4D9AD749F52FABA12D4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\Internal.props
- Size 512KB
- SHA256 789a5a40eb8ce329949bf3024b96e573dd855308075af85b9dabd8b7c7003ce4
- MD5 5bac43c16eebc5aaff7459e253f200d2
- SHA1 f4c433a2758c7a0e1401050486e500f8cd2ba6d9
- SHA512 09b60ba2bcbe05c86b507073978f83e10403ee7bda7d9acab6f6e43d2f5efc42d5bec5437f73114dc1c90bcb4b083ed1ab3cdaeb699dc644cfe40153658425c8
- SSDEEP 6144:q4Dv9ciKYNcmjq+PDxe+tv+PCdxBduxqqR2Q0jLLA+FklJLscQkjjRMSypV1P1ww:fKi3Xj2Bsb3BP1B1cPEy1GA/1qecl
- TLSH T150B4E873154BFC9E73161E8142013E638CBC952F23184A7DBB58429727A7BC6EEE4972
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\TreasuryManager.Internal.targets
- Size 953KB
- SHA256 24d0bd16b2073e593f2261ed46b71b36a8f31ffe4d288b3e78f26b914e263ad4
- MD5 ce1b5fc40031439b31c5a8de5aca7940
- SHA1 3de448e40b88124b1818ab8b79dbc742d1a6a34d
- SHA512 233ff53317e60a268e21b4ade26a7b1904902dc60d03b46f8336e53e14c0e43efa3031407b42f3aeafb5573d54f5659d28db57c09592938e315362badf1afbc8
- SSDEEP 12288:bjk4L8zKYP2G+3pqzidRbNoE99rgJQj0ax9eT2hfJ:9ugpqzmrgJQj0axTfJ
- TLSH T1122595B36644BDA6A7770E80CA2417227CA437979A34D07C7D0AC04776DB294C8BDFB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\TreasuryManager.csproj
- Size 8.7MB
- SHA256 346c31eb49352392e858cf2cf0d7e282b3ba825e54a2d31a59d192b0ddab8ba3
- MD5 4638a4a1ed5f65e61027ca5b6f60cde0
- SHA1 af15a6e1121483848ba2e4e342957c00c9634450
- SHA512 e1b5a613bfebb0ab4651ff317f736ee0b7561f1aade6182f09a95fa8f46490507f55c2284104d58e8a90b00ce6b8caa41a7161e55dea4dce6b2954a7db361443
- SSDEEP 1536:J1e6PbUo+5BC6D3QpRcREuhASdZ/EoWGerGpVeDY9OhIkMcMIbuVNtngGhTKgV3H:E
- TLSH T12396CF7A0780477AE3D447C4885B611E36F5E525BA243259B73369FFBC2A9CB803CA53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\TreasuryManager.csproj.user
- Size 1.0MB
- SHA256 179cfc9f0bdb327f02f19db274b008dd9917e6f71eb98ae0a865e6559562442a
- MD5 a9893f1da0e7a00ba8680e961724b738
- SHA1 fb54a2fddd5fcfc7b1192f0bdd47cf1b53f549e5
- SHA512 469e80a58f6a27b618553be78ecee355b339c6410ecd2551c51bb071d6623a3e138be5d7fa57ab857832655a0aacfdf2fb693ba45db889d7d717137afeea959b
- SSDEEP 12288:V3orN1OAxHpsxOB+BKUIgNCMk/OkLCiQee9MEqj7F:ixCxOB+BKUIgNCMk/OOCLqj7F
- TLSH T15135C671140BFD9A0D3BCA4BF88994015C413473F60AA45AF5C85D6F92F68AB9EB8CF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp-40404-bpvXKLHJiFsA\TreasuryManager.csproj:Zone.Identifier
- Size 28B
- SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
- MD5 c0c0eb75aca089cf8c188e9fb51417d4
- SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
- SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
- Size 5B
- SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
- MD5 f4020e91252aafd4b18d8acd17f883db
- SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
- SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
- MD5 SHA1 SHA512