7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260701-nc4tkaev8w
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
2512	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
776	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1744	powershell.exe
5732	powershell.exe
5892	powershell.exe
4732	powershell.exe
5620	powershell.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3208	776	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\kys6DcqwO.m2:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\TransactionMonitor.Compile.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\TransactionMonitor.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\TransactionMonitor.Internal.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\TransactionMonitor.csproj.user:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1744	powershell.exe
1744	powershell.exe
5732	powershell.exe
5732	powershell.exe
5892	powershell.exe
5892	powershell.exe
4732	powershell.exe
4732	powershell.exe
5620	powershell.exe
5620	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeIncreaseQuotaPrivilege	1744	powershell.exe
Token: SeSecurityPrivilege	1744	powershell.exe
Token: SeTakeOwnershipPrivilege	1744	powershell.exe
Token: SeLoadDriverPrivilege	1744	powershell.exe
Token: SeSystemProfilePrivilege	1744	powershell.exe
Token: SeSystemtimePrivilege	1744	powershell.exe
Token: SeProfSingleProcessPrivilege	1744	powershell.exe
Token: SeIncBasePriorityPrivilege	1744	powershell.exe
Token: SeCreatePagefilePrivilege	1744	powershell.exe
Token: SeBackupPrivilege	1744	powershell.exe
Token: SeRestorePrivilege	1744	powershell.exe
Token: SeShutdownPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeSystemEnvironmentPrivilege	1744	powershell.exe
Token: SeRemoteShutdownPrivilege	1744	powershell.exe
Token: SeUndockPrivilege	1744	powershell.exe
Token: SeManageVolumePrivilege	1744	powershell.exe
Token: 33	1744	powershell.exe
Token: 34	1744	powershell.exe
Token: 35	1744	powershell.exe
Token: 36	1744	powershell.exe
Token: SeIncreaseQuotaPrivilege	1744	powershell.exe
Token: SeSecurityPrivilege	1744	powershell.exe
Token: SeTakeOwnershipPrivilege	1744	powershell.exe
Token: SeLoadDriverPrivilege	1744	powershell.exe
Token: SeSystemProfilePrivilege	1744	powershell.exe
Token: SeSystemtimePrivilege	1744	powershell.exe
Token: SeProfSingleProcessPrivilege	1744	powershell.exe
Token: SeIncBasePriorityPrivilege	1744	powershell.exe
Token: SeCreatePagefilePrivilege	1744	powershell.exe
Token: SeBackupPrivilege	1744	powershell.exe
Token: SeRestorePrivilege	1744	powershell.exe
Token: SeShutdownPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeSystemEnvironmentPrivilege	1744	powershell.exe
Token: SeRemoteShutdownPrivilege	1744	powershell.exe
Token: SeUndockPrivilege	1744	powershell.exe
Token: SeManageVolumePrivilege	1744	powershell.exe
Token: 33	1744	powershell.exe
Token: 34	1744	powershell.exe
Token: 35	1744	powershell.exe
Token: 36	1744	powershell.exe
Token: SeDebugPrivilege	5732	powershell.exe
Token: SeIncreaseQuotaPrivilege	5732	powershell.exe
Token: SeSecurityPrivilege	5732	powershell.exe
Token: SeTakeOwnershipPrivilege	5732	powershell.exe
Token: SeLoadDriverPrivilege	5732	powershell.exe
Token: SeSystemProfilePrivilege	5732	powershell.exe
Token: SeSystemtimePrivilege	5732	powershell.exe
Token: SeProfSingleProcessPrivilege	5732	powershell.exe
Token: SeIncBasePriorityPrivilege	5732	powershell.exe
Token: SeCreatePagefilePrivilege	5732	powershell.exe
Token: SeBackupPrivilege	5732	powershell.exe
Token: SeRestorePrivilege	5732	powershell.exe
Token: SeShutdownPrivilege	5732	powershell.exe
Token: SeDebugPrivilege	5732	powershell.exe
Token: SeSystemEnvironmentPrivilege	5732	powershell.exe
Token: SeRemoteShutdownPrivilege	5732	powershell.exe
Token: SeUndockPrivilege	5732	powershell.exe
Token: SeManageVolumePrivilege	5732	powershell.exe
Token: 33	5732	powershell.exe
Token: 34	5732	powershell.exe
Token: 35	5732	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5260	Setup.exe
5260	Setup.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5260 wrote to memory of 2948	5260	Setup.exe	88
PID 5260 wrote to memory of 1052	5260	Setup.exe	90
PID 5260 wrote to memory of 2064	5260	Setup.exe	92
PID 5260 wrote to memory of 1688	5260	Setup.exe	94
PID 1688 wrote to memory of 1744	1688	cmd.exe	96
PID 5260 wrote to memory of 4956	5260	Setup.exe	98
PID 4956 wrote to memory of 5732	4956	cmd.exe	100
PID 5260 wrote to memory of 3348	5260	Setup.exe	101
PID 3348 wrote to memory of 5892	3348	cmd.exe	103
PID 5260 wrote to memory of 3840	5260	Setup.exe	104
PID 3840 wrote to memory of 4732	3840	cmd.exe	106
PID 5260 wrote to memory of 464	5260	Setup.exe	107
PID 464 wrote to memory of 5620	464	cmd.exe	109
PID 5260 wrote to memory of 2512	5260	Setup.exe	110
PID 2512 wrote to memory of 1388	2512	forfiles.exe	111
PID 1388 wrote to memory of 5708	1388	cmd.exe	113
PID 1388 wrote to memory of 3816	1388	cmd.exe	114
PID 3816 wrote to memory of 4052	3816	conhost.exe	115
PID 4052 wrote to memory of 776	4052	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:1052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:2064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5620
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf /m kys6DcqwO.m2 /c "cmd /c ren @file kys6DcqwO.bat && call kys6DcqwO.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "kys6DcqwO.m2" kys6DcqwO.bat && call kys6DcqwO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:5708
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\kys6DcqwO.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3816
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\kys6DcqwO.bat /launched
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4052
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\TransactionMonitor.csproj" /nologo /v:q
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 1688
        7⤵
        Program crash
        
        PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 776 -ip 776
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dc2792f062d276c3a6c95202b5d40b7db678fc5e67e7be45890b62eccbdd2b33
MD5 2b5b9a7e9f9855dc264a676d2dce0c4e
SHA1 2dcd1444e248fee74a0c176cfbdbb80d20efaaa2
SHA512 ffbcf4624dd138466dffc151f9f4d1b5c21e5a5d23efd6c25fa11b9f6ad72a68a9cf5371469443747898cae7929e915dfce891e52321708f11fa57c8b5bb0535
TLSH
T19A317437F3DC8611CC9A013A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2435a74e9485cb28a74db9f27500c9fedca7cb94b839dbd6f20234d63d41714c
MD5 c12d7ecc4d5da7b9b7b6db60f08f8de9
SHA1 ee9fdfe12a2b5a2edac3d040607fbbde89b6d625
SHA512 6a4347c39dbc00325b50089fc9b6661ec9f8315911e60fdadbd0cc1e59b44e8ec9d9790f971aa677b569c2c863bf05d82a09c94acb7701158a6924fbf45cd9cf
TLSH
T140219833F3DC8214CC99403A10DDAC1036B6C7CB40DECF9B6B81E169A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 625fdc6d56354cbb4eb7ecb6e710aed014a3dc8952fd727b0f6eb28d863a64c6
MD5 60a135e209d613afa9986f1ca1202810
SHA1 3b5943ce5bcadbd581b4dc91935839ea180f838d
SHA512 a10f77702c3bea591960ad2609ae28214df8f3a008f9bac539fd88fb8949e5d03ce235c03a952a3c5e05c3ace5e8f06b01c0d58ce3d24e74afb6a79250bdd334
TLSH
T146219837F3DC8614CCA9003A10DDAD1036B6C7CB40DECF5B6B85E159A42F298CFA0060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9b1677492ae8ffc9a5a357056e8f1cdb1b2d284bfaf1f7e560784d3267cef64b
MD5 7968baef19c42a081701ad23fc58b712
SHA1 cb071f381d1482139f0b1fe16f519a219853a7ed
SHA512 eb0c97208fe101732e5b945c9d854f0edaf212121dd1f76d793679d6df5dde4011fa003135518d7b6cf1cf29ff0d2960c76713916de47107776fa4be541b86dc
TLSH
T141216837F3DD8614DCA9403A10DDAD1036B6C7DB40DECF5B6B85E159A42F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nua3ug1a.m3y.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nua3ug1a.m3y.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

TransactionMonitor.Compile.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\TransactionMonitor.Compile.targets
Size 420KB
SHA256 4be6e1678ed0514c1531778a5fb5085f46c569b5955d8eb843473d3d21b6e70b
MD5 bf2398c69ead533574cf1e09a86be518
SHA1 57f1ac443bc34ea797b9c8f492315807bf7d9ab0
SHA512 b8d08508bea5629853e3f5c00d9ebe873fb0ffb9f60ece58a21b4ffd1452ce01227e3a5abfd742651acbbd6417add848a8cabd1ecb4358091c396aaf34a0cb3a
SSDEEP 6144:ovrwt2tbULab2kaP3QB8VkahkP+Th5cM5kxO7M83qJ+tdkvw+w/jndbrvYBlRSzm:o0t2OLa6BZ70+5dbrvYBlRSbGr
TLSH
T13F947C3095A6FDC73B2A3CD0E8043FA25C649757D7B80A88FA89489795E9564FF3C0B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransactionMonitor.Compile.targets:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\TransactionMonitor.Compile.targets:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

TransactionMonitor.Internal.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\TransactionMonitor.Internal.props
Size 61KB
SHA256 78e426ac585ceef4df36af358311565c0352757e199e1dff92163468be942c89
MD5 cf5195e00480b2a3e91e96b0327ccfd0
SHA1 a9894bd57f3ac520aa58eee3353bc5df19ded85e
SHA512 0b7d1d440310fb76003ab37f63196f2bcd9ca91801a45c3572fb5607714d4fc3c6cac5993c04379e8fa504371328652fdae4a140f5f5c66aac587592d9352939
SSDEEP 1536:BurYTAuisf/UBImriPrVPX0nBr2XjHh96d3QL5K+kUvyURHBbn:Burmis89ezKBr2XjPIsn
TLSH
T180536E025959B8263037AD6D9D0B2521C811B64AF3F464EB354EBF018B7EEBC0BFB195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransactionMonitor.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\TransactionMonitor.csproj
Size 8.8MB
SHA256 a0f544c2c3335cc7a6261b402f872eea335e7cc9382a330f1351b69317c9f9fe
MD5 7f581b0bca2e1ee4c66166f2c1a31ae9
SHA1 efeaea7db084b62babbf1e79413a782f00582ab6
SHA512 f3237ae86baa4138fdb80a8ba47cd320085410cc48207092f3d52d9b84308320d685d421c5906a0c5da61cda71bdb1afd0a35b32fb8c507950b2718c59621b27
SSDEEP 1536:UvS8oRE31w624gvJAELeenh+K6I5ntzjw9PNkvsXDoHfBD5EQDjW0AGqGP65kZF9:sid
TLSH
T17296037B0BC087BAF3D407C4451A345E2AF9E215B929215AAB6329FFBC1E9D7407C643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransactionMonitor.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\TransactionMonitor.csproj.user
Size 182KB
SHA256 b2f5c0da624abb208d5785043a5cfc573a2524d1f4c2823ef45c3bcdc9ec231d
MD5 4c5130446fb573d9c78f229ae949cbf6
SHA1 8abb51c244ee3f2f24a8255741415c086457d832
SHA512 c8a35fde44eb68ddd7c17b568e678e0edbe0967f669d4367b71f02f9b44b9f83bdc813aa3f2dbd515797707d8fa81d1d595147d2631b9b4157064fa631782cfa
SSDEEP 3072:/XnxwcjMZUZ3JajJLOsrTS4vzgpmYOsSrBSAEOLTbrVoiCU/2+YuZfc3bIf:/XxvjMmZ3JajLrTS2M0YOsSrBSAEOLfR
TLSH
T17E044C731207BCD5227F0E48B648A5605D487EFBF28280397AC84BEE61B549CCF9DA75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kys6DcqwO.m2

Path C:\Users\Admin\AppData\Local\Temp\tmp-24105-bywfl5etxgtf\kys6DcqwO.m2
Size 1KB
SHA256 d040b112d3ea31431ed8c02be8a58b43bec65d163d652d3d0a5076a209f69bfc
MD5 2f995e390b56efab0d261f93041f5e70
SHA1 caa633187e5db6f62b261d1a201764444c1b9ee5
SHA512 774604f29cff4f04f6a72016dbd2084d277a16ec76628d4600272b14c074ef4a99d31690946820e135e5d5f67d5081622f595e85bc5f9efd8c7d4bab75141b85
TLSH
T1E621A996B122155DC4E132BA67B98733220D72833884F5BDB0C4CD9D789F42FAAA12E4
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/776-359-0x0000000005650000-0x0000000005680000-memory.dmp

Download

memory/776-358-0x0000000005830000-0x000000000598A000-memory.dmp

Download

memory/776-357-0x00000000030F0000-0x000000000310A000-memory.dmp

Download

memory/776-356-0x0000000000AD0000-0x0000000000B10000-memory.dmp

Download

memory/776-364-0x000000000BAA0000-0x000000000BB22000-memory.dmp

Download

memory/776-365-0x0000000005DA0000-0x000000000608E000-memory.dmp

Download

memory/776-366-0x00000000110D0000-0x000000001114C000-memory.dmp

Download

memory/1744-265-0x00007FFDE32C0000-0x00007FFDE3C64000-memory.dmp

Download

memory/1744-269-0x00007FFDE32C0000-0x00007FFDE3C64000-memory.dmp

Download

memory/1744-282-0x00007FFDE32C0000-0x00007FFDE3C64000-memory.dmp

Download

memory/1744-279-0x0000024C31D00000-0x0000024C31D2A000-memory.dmp

Download

memory/1744-280-0x0000024C31D00000-0x0000024C31D24000-memory.dmp

Download

memory/1744-278-0x0000024C31CC0000-0x0000024C31CCA000-memory.dmp

Download

memory/1744-277-0x0000024C32050000-0x0000024C32102000-memory.dmp

Download

memory/1744-276-0x0000024C31CA0000-0x0000024C31CBE000-memory.dmp

Download

memory/1744-268-0x00007FFDE32C0000-0x00007FFDE3C64000-memory.dmp

Download

memory/1744-253-0x00007FFDE32C0000-0x00007FFDE3C64000-memory.dmp

Download

memory/1744-267-0x00007FFDE32C0000-0x00007FFDE3C64000-memory.dmp

Download

memory/1744-252-0x00007FFDE344F000-0x00007FFDE3450000-memory.dmp

Download

memory/1744-266-0x00007FFDE32C0000-0x00007FFDE3C64000-memory.dmp

Download

memory/1744-264-0x00007FFDE32C0000-0x00007FFDE3C64000-memory.dmp

Download

memory/1744-263-0x00007FFDE32C0000-0x00007FFDE3C64000-memory.dmp

Download

memory/1744-261-0x00007FFDE32C0000-0x00007FFDE3C64000-memory.dmp

Download

memory/1744-255-0x00007FFDE32C0000-0x00007FFDE3C64000-memory.dmp

Download

memory/1744-254-0x0000024C31BD0000-0x0000024C31BF2000-memory.dmp

Download

memory/5732-296-0x000001E14D190000-0x000001E14D242000-memory.dmp

Download