7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260701-nc4tkaev8w
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
2108	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3588	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2232	powershell.exe
1668	powershell.exe
2356	powershell.exe
1132	powershell.exe
4536	powershell.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3280	3588	WerFault.exe	113

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\TransactionMonitor.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\TransactionMonitor.Internal.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\TransactionMonitor.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\kys6DcqwO.zsr:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\TransactionMonitor.Compile.targets:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1668	powershell.exe
1668	powershell.exe
2356	powershell.exe
2356	powershell.exe
1132	powershell.exe
1132	powershell.exe
4536	powershell.exe
4536	powershell.exe
2232	powershell.exe
2232	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeIncreaseQuotaPrivilege	1668	powershell.exe
Token: SeSecurityPrivilege	1668	powershell.exe
Token: SeTakeOwnershipPrivilege	1668	powershell.exe
Token: SeLoadDriverPrivilege	1668	powershell.exe
Token: SeSystemProfilePrivilege	1668	powershell.exe
Token: SeSystemtimePrivilege	1668	powershell.exe
Token: SeProfSingleProcessPrivilege	1668	powershell.exe
Token: SeIncBasePriorityPrivilege	1668	powershell.exe
Token: SeCreatePagefilePrivilege	1668	powershell.exe
Token: SeBackupPrivilege	1668	powershell.exe
Token: SeRestorePrivilege	1668	powershell.exe
Token: SeShutdownPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeSystemEnvironmentPrivilege	1668	powershell.exe
Token: SeRemoteShutdownPrivilege	1668	powershell.exe
Token: SeUndockPrivilege	1668	powershell.exe
Token: SeManageVolumePrivilege	1668	powershell.exe
Token: 33	1668	powershell.exe
Token: 34	1668	powershell.exe
Token: 35	1668	powershell.exe
Token: 36	1668	powershell.exe
Token: SeIncreaseQuotaPrivilege	1668	powershell.exe
Token: SeSecurityPrivilege	1668	powershell.exe
Token: SeTakeOwnershipPrivilege	1668	powershell.exe
Token: SeLoadDriverPrivilege	1668	powershell.exe
Token: SeSystemProfilePrivilege	1668	powershell.exe
Token: SeSystemtimePrivilege	1668	powershell.exe
Token: SeProfSingleProcessPrivilege	1668	powershell.exe
Token: SeIncBasePriorityPrivilege	1668	powershell.exe
Token: SeCreatePagefilePrivilege	1668	powershell.exe
Token: SeBackupPrivilege	1668	powershell.exe
Token: SeRestorePrivilege	1668	powershell.exe
Token: SeShutdownPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeSystemEnvironmentPrivilege	1668	powershell.exe
Token: SeRemoteShutdownPrivilege	1668	powershell.exe
Token: SeUndockPrivilege	1668	powershell.exe
Token: SeManageVolumePrivilege	1668	powershell.exe
Token: 33	1668	powershell.exe
Token: 34	1668	powershell.exe
Token: 35	1668	powershell.exe
Token: 36	1668	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeIncreaseQuotaPrivilege	2356	powershell.exe
Token: SeSecurityPrivilege	2356	powershell.exe
Token: SeTakeOwnershipPrivilege	2356	powershell.exe
Token: SeLoadDriverPrivilege	2356	powershell.exe
Token: SeSystemProfilePrivilege	2356	powershell.exe
Token: SeSystemtimePrivilege	2356	powershell.exe
Token: SeProfSingleProcessPrivilege	2356	powershell.exe
Token: SeIncBasePriorityPrivilege	2356	powershell.exe
Token: SeCreatePagefilePrivilege	2356	powershell.exe
Token: SeBackupPrivilege	2356	powershell.exe
Token: SeRestorePrivilege	2356	powershell.exe
Token: SeShutdownPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeSystemEnvironmentPrivilege	2356	powershell.exe
Token: SeRemoteShutdownPrivilege	2356	powershell.exe
Token: SeUndockPrivilege	2356	powershell.exe
Token: SeManageVolumePrivilege	2356	powershell.exe
Token: 33	2356	powershell.exe
Token: 34	2356	powershell.exe
Token: 35	2356	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4656	Setup.exe
4656	Setup.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3044	4656	Setup.exe	84
PID 4656 wrote to memory of 3564	4656	Setup.exe	86
PID 4656 wrote to memory of 4480	4656	Setup.exe	88
PID 4656 wrote to memory of 4392	4656	Setup.exe	90
PID 4392 wrote to memory of 1668	4392	cmd.exe	92
PID 4656 wrote to memory of 2000	4656	Setup.exe	94
PID 2000 wrote to memory of 2356	2000	cmd.exe	96
PID 4656 wrote to memory of 1080	4656	Setup.exe	97
PID 1080 wrote to memory of 1132	1080	cmd.exe	99
PID 4656 wrote to memory of 4428	4656	Setup.exe	100
PID 4428 wrote to memory of 4536	4428	cmd.exe	102
PID 4656 wrote to memory of 3188	4656	Setup.exe	103
PID 3188 wrote to memory of 2232	3188	cmd.exe	105
PID 4656 wrote to memory of 2108	4656	Setup.exe	107
PID 2108 wrote to memory of 4776	2108	forfiles.exe	108
PID 4776 wrote to memory of 3280	4776	cmd.exe	110
PID 4776 wrote to memory of 3948	4776	cmd.exe	111
PID 3948 wrote to memory of 4492	3948	conhost.exe	112
PID 4492 wrote to memory of 3588	4492	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:3044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2232
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq /m kys6DcqwO.zsr /c "cmd /c ren @file kys6DcqwO.bat && call kys6DcqwO.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "kys6DcqwO.zsr" kys6DcqwO.bat && call kys6DcqwO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:3280
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\kys6DcqwO.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\kys6DcqwO.bat /launched
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4492
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\TransactionMonitor.csproj" /nologo /v:q
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1764
        7⤵
        Program crash
        
        PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3588 -ip 3588
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 15d5db2d709306df16fb0ebf06aec3ef91af94ad8e40f66cb6466d0f37edcb50
MD5 92f60af406d2b80d372ba1a490ea18d4
SHA1 40607747a3551da0aa1fd80ae5e7bf0375f1fe32
SHA512 8a7a9a072d42c60c84c64322c3f01b7264d904ebd16bcf9e6cfc8d6ce5e39db00f8ecfe864fcaf09fff50deade44516c5ec7fdaa632218b3da232809f754a1bf
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fBPOIzoZcm0vmlvWPfsNySI:iqdYqGAjdx4qKkq3qktznEuZq6cIzooB
TLSH
T1EB81CD323375B0D4C8667F072A2819D063AF4396EA94AF4CB25C621ED92751BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9efc61525898b2fa0d78a1dcd2887a66dc73bb95d57eba86bfba6af9cc1be85b
MD5 615126f3f95897490fcfe2b0d58b1657
SHA1 c86011723282015bc5b48432d0d9a206af00440f
SHA512 1db2bd16449366952675d5cd5894b64ae586efcac42e0bb72e5e7a265f46634c05fbd6863d80c34c628df00466e503841e2ad5eebf3abb0e8f43d1512c3015d2
TLSH
T142316627B3DC8822CCC9153B209C9C1172AA82C7819EDF9B6FC0D225957FAD9CB61594
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b2fd2045ab595a322955393d78fc42920ccdf7e3e68893b53d77e8bd99bfcebf
MD5 6a30aa59f1b6421a544ab39c83e75b8c
SHA1 c795f4527b60ece6a58fa6a86b217e2a9c4c68a0
SHA512 70786627658b18b59cccdc3164c3b3bb2203862d147e608b1af7a594acf71a55f871ee7a5855111dcf4973c3b36e1e2f721f634ef9c220ad7449f8addbe78479
TLSH
T128216527B39CD8A1CCC5263A209DAC5572A683CB809ECF8F6AC0C224A56FA94CB71150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c9730d10fd39a556bc3134350c8e06e4126abe61ee41cc5cd6927eab4037143f
MD5 6f93ba2bf86c51621ed901d5066fb2c8
SHA1 c476f6080fb1db89c755757e9a2586206ff33491
SHA512 ce6a78e697ef8510e39eb113df1dfaf68f714c2d2278e346e58a779e7861287a229ea26b433611db26aa12614405af0c2c13b4ab5041db76f8a5673564512401
TLSH
T19B216827B39CD9A1CC95153A109C9C1172B783C7409ECF8F6AC0D214A17F694CB61550
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 020c968aedf44573c2dc9945010abb1109638dffdd9a627c503321068b79d845
MD5 3f81481f0251165ee8051799d5487156
SHA1 dadc07e6eff95dd6fde0f3fb3eca0a4aa1941434
SHA512 c93f39f6f41ad4256c1c6e6fb5afd4a44477372c8459d369ef962b42ddcfb3b7c84ac8b93f128fac8e9e8405c84c62c8891ca05ce97a84a0e6a411fe50371efe
TLSH
T1E0216527B39CD9A1CCD5253A209CAC1172B783C7809ECF8F6EC0D224A57FAD4CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jnpzri1u.ed5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jnpzri1u.ed5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

TransactionMonitor.Compile.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\TransactionMonitor.Compile.targets
Size 420KB
SHA256 4be6e1678ed0514c1531778a5fb5085f46c569b5955d8eb843473d3d21b6e70b
MD5 bf2398c69ead533574cf1e09a86be518
SHA1 57f1ac443bc34ea797b9c8f492315807bf7d9ab0
SHA512 b8d08508bea5629853e3f5c00d9ebe873fb0ffb9f60ece58a21b4ffd1452ce01227e3a5abfd742651acbbd6417add848a8cabd1ecb4358091c396aaf34a0cb3a
SSDEEP 6144:ovrwt2tbULab2kaP3QB8VkahkP+Th5cM5kxO7M83qJ+tdkvw+w/jndbrvYBlRSzm:o0t2OLa6BZ70+5dbrvYBlRSbGr
TLSH
T13F947C3095A6FDC73B2A3CD0E8043FA25C649757D7B80A88FA89489795E9564FF3C0B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransactionMonitor.Compile.targets:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\TransactionMonitor.Compile.targets:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

TransactionMonitor.Internal.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\TransactionMonitor.Internal.props
Size 61KB
SHA256 78e426ac585ceef4df36af358311565c0352757e199e1dff92163468be942c89
MD5 cf5195e00480b2a3e91e96b0327ccfd0
SHA1 a9894bd57f3ac520aa58eee3353bc5df19ded85e
SHA512 0b7d1d440310fb76003ab37f63196f2bcd9ca91801a45c3572fb5607714d4fc3c6cac5993c04379e8fa504371328652fdae4a140f5f5c66aac587592d9352939
SSDEEP 1536:BurYTAuisf/UBImriPrVPX0nBr2XjHh96d3QL5K+kUvyURHBbn:Burmis89ezKBr2XjPIsn
TLSH
T180536E025959B8263037AD6D9D0B2521C811B64AF3F464EB354EBF018B7EEBC0BFB195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransactionMonitor.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\TransactionMonitor.csproj
Size 8.8MB
SHA256 a0f544c2c3335cc7a6261b402f872eea335e7cc9382a330f1351b69317c9f9fe
MD5 7f581b0bca2e1ee4c66166f2c1a31ae9
SHA1 efeaea7db084b62babbf1e79413a782f00582ab6
SHA512 f3237ae86baa4138fdb80a8ba47cd320085410cc48207092f3d52d9b84308320d685d421c5906a0c5da61cda71bdb1afd0a35b32fb8c507950b2718c59621b27
SSDEEP 1536:UvS8oRE31w624gvJAELeenh+K6I5ntzjw9PNkvsXDoHfBD5EQDjW0AGqGP65kZF9:sid
TLSH
T17296037B0BC087BAF3D407C4451A345E2AF9E215B929215AAB6329FFBC1E9D7407C643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransactionMonitor.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\TransactionMonitor.csproj.user
Size 182KB
SHA256 b2f5c0da624abb208d5785043a5cfc573a2524d1f4c2823ef45c3bcdc9ec231d
MD5 4c5130446fb573d9c78f229ae949cbf6
SHA1 8abb51c244ee3f2f24a8255741415c086457d832
SHA512 c8a35fde44eb68ddd7c17b568e678e0edbe0967f669d4367b71f02f9b44b9f83bdc813aa3f2dbd515797707d8fa81d1d595147d2631b9b4157064fa631782cfa
SSDEEP 3072:/XnxwcjMZUZ3JajJLOsrTS4vzgpmYOsSrBSAEOLTbrVoiCU/2+YuZfc3bIf:/XxvjMmZ3JajLrTS2M0YOsSrBSAEOLfR
TLSH
T17E044C731207BCD5227F0E48B648A5605D487EFBF28280397AC84BEE61B549CCF9DA75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kys6DcqwO.zsr

Path C:\Users\Admin\AppData\Local\Temp\tmp-00474-9x18Ic3lfeaq\kys6DcqwO.zsr
Size 1KB
SHA256 91dd645d6eea001f720a4f58cb39d18f833c425021fe3cb9ec08c8a0d0931cd9
MD5 bf1d75bfab8aea3791d48c7e546ff6b1
SHA1 818815f81f08dbde697cf1924772cef42fdf6e63
SHA512 94944f71db60a7695c5ce1ad17bb09172ef0c6f3beaf4302b6aaaaaa4e9d4482a5e4fa354ae180b3e9b92cc62e51e19f423c683c2897f13ded7776aac5afd1bf
TLSH
T1B021CB96B122555DC4E172BB67B54733220D72C33880F4BD70C4CCAD749F46FAAA12E4
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/1668-254-0x000002AE56100000-0x000002AE56122000-memory.dmp

Download

memory/1668-253-0x000002AE552B0000-0x000002AE552C0000-memory.dmp

Download

memory/1668-263-0x000002AE56600000-0x000002AE56624000-memory.dmp

Download

memory/1668-252-0x000002AE552B0000-0x000002AE552C0000-memory.dmp

Download

memory/1668-262-0x000002AE56600000-0x000002AE5662A000-memory.dmp

Download

memory/3588-319-0x0000000000EB0000-0x0000000000EF0000-memory.dmp

Download

memory/3588-320-0x00000000018C0000-0x00000000018DA000-memory.dmp

Download

memory/3588-321-0x0000000005890000-0x00000000059EA000-memory.dmp

Download

memory/3588-322-0x0000000005A60000-0x0000000005A90000-memory.dmp

Download

memory/3588-327-0x000000000BBF0000-0x000000000BC72000-memory.dmp

Download

memory/3588-328-0x0000000010E30000-0x000000001111E000-memory.dmp

Download