7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
150s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260711-ejv1kadt81
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
4552	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2548	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5972	powershell.exe
2296	powershell.exe
3784	powershell.exe
3176	powershell.exe
4556	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\Nancy.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\rlB0bWGmR.kkp:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\Common.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\Nancy.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\Directory.Build.props:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4556	powershell.exe
4556	powershell.exe
5972	powershell.exe
5972	powershell.exe
2296	powershell.exe
2296	powershell.exe
3784	powershell.exe
3784	powershell.exe
3176	powershell.exe
3176	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeIncreaseQuotaPrivilege	4556	powershell.exe
Token: SeSecurityPrivilege	4556	powershell.exe
Token: SeTakeOwnershipPrivilege	4556	powershell.exe
Token: SeLoadDriverPrivilege	4556	powershell.exe
Token: SeSystemProfilePrivilege	4556	powershell.exe
Token: SeSystemtimePrivilege	4556	powershell.exe
Token: SeProfSingleProcessPrivilege	4556	powershell.exe
Token: SeIncBasePriorityPrivilege	4556	powershell.exe
Token: SeCreatePagefilePrivilege	4556	powershell.exe
Token: SeBackupPrivilege	4556	powershell.exe
Token: SeRestorePrivilege	4556	powershell.exe
Token: SeShutdownPrivilege	4556	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeSystemEnvironmentPrivilege	4556	powershell.exe
Token: SeRemoteShutdownPrivilege	4556	powershell.exe
Token: SeUndockPrivilege	4556	powershell.exe
Token: SeManageVolumePrivilege	4556	powershell.exe
Token: 33	4556	powershell.exe
Token: 34	4556	powershell.exe
Token: 35	4556	powershell.exe
Token: 36	4556	powershell.exe
Token: SeIncreaseQuotaPrivilege	4556	powershell.exe
Token: SeSecurityPrivilege	4556	powershell.exe
Token: SeTakeOwnershipPrivilege	4556	powershell.exe
Token: SeLoadDriverPrivilege	4556	powershell.exe
Token: SeSystemProfilePrivilege	4556	powershell.exe
Token: SeSystemtimePrivilege	4556	powershell.exe
Token: SeProfSingleProcessPrivilege	4556	powershell.exe
Token: SeIncBasePriorityPrivilege	4556	powershell.exe
Token: SeCreatePagefilePrivilege	4556	powershell.exe
Token: SeBackupPrivilege	4556	powershell.exe
Token: SeRestorePrivilege	4556	powershell.exe
Token: SeShutdownPrivilege	4556	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeSystemEnvironmentPrivilege	4556	powershell.exe
Token: SeRemoteShutdownPrivilege	4556	powershell.exe
Token: SeUndockPrivilege	4556	powershell.exe
Token: SeManageVolumePrivilege	4556	powershell.exe
Token: 33	4556	powershell.exe
Token: 34	4556	powershell.exe
Token: 35	4556	powershell.exe
Token: 36	4556	powershell.exe
Token: SeDebugPrivilege	5972	powershell.exe
Token: SeIncreaseQuotaPrivilege	5972	powershell.exe
Token: SeSecurityPrivilege	5972	powershell.exe
Token: SeTakeOwnershipPrivilege	5972	powershell.exe
Token: SeLoadDriverPrivilege	5972	powershell.exe
Token: SeSystemProfilePrivilege	5972	powershell.exe
Token: SeSystemtimePrivilege	5972	powershell.exe
Token: SeProfSingleProcessPrivilege	5972	powershell.exe
Token: SeIncBasePriorityPrivilege	5972	powershell.exe
Token: SeCreatePagefilePrivilege	5972	powershell.exe
Token: SeBackupPrivilege	5972	powershell.exe
Token: SeRestorePrivilege	5972	powershell.exe
Token: SeShutdownPrivilege	5972	powershell.exe
Token: SeDebugPrivilege	5972	powershell.exe
Token: SeSystemEnvironmentPrivilege	5972	powershell.exe
Token: SeRemoteShutdownPrivilege	5972	powershell.exe
Token: SeUndockPrivilege	5972	powershell.exe
Token: SeManageVolumePrivilege	5972	powershell.exe
Token: 33	5972	powershell.exe
Token: 34	5972	powershell.exe
Token: 35	5972	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
460	Setup.exe
460	Setup.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 5412	460	Setup.exe	86
PID 460 wrote to memory of 264	460	Setup.exe	88
PID 460 wrote to memory of 2072	460	Setup.exe	90
PID 460 wrote to memory of 3532	460	Setup.exe	92
PID 3532 wrote to memory of 4556	3532	cmd.exe	94
PID 460 wrote to memory of 5856	460	Setup.exe	96
PID 5856 wrote to memory of 5972	5856	cmd.exe	98
PID 460 wrote to memory of 4228	460	Setup.exe	99
PID 4228 wrote to memory of 2296	4228	cmd.exe	101
PID 460 wrote to memory of 3692	460	Setup.exe	102
PID 3692 wrote to memory of 3784	3692	cmd.exe	104
PID 460 wrote to memory of 428	460	Setup.exe	105
PID 428 wrote to memory of 3176	428	cmd.exe	107
PID 460 wrote to memory of 4552	460	Setup.exe	108
PID 4552 wrote to memory of 4828	4552	forfiles.exe	109
PID 4828 wrote to memory of 5868	4828	cmd.exe	111
PID 4828 wrote to memory of 3888	4828	cmd.exe	112
PID 3888 wrote to memory of 5380	3888	conhost.exe	113
PID 5380 wrote to memory of 2548	5380	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:5412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:2072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3176
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI /m rlB0bWGmR.kkp /c "cmd /c ren @file rlB0bWGmR.bat && call rlB0bWGmR.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "rlB0bWGmR.kkp" rlB0bWGmR.bat && call rlB0bWGmR.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:5868
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\rlB0bWGmR.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3888
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\rlB0bWGmR.bat /launched
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5380
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\Nancy.csproj" /nologo /v:q
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 52c3278fd60a3fa44f4491584a21a403090cfe12204f9e4b7f45f40e7d10f9b3
MD5 ebebd4ee9e273954a351a240d6b7a5d3
SHA1 87dfcd8ea5bc34269e6b2b325ba1e3b4f1ea5f97
SHA512 dd00237be24baaae5556304bd9b26d35a4ab8adbd884f8f4cb25f92697aa4a63aa55d0ede1ecc8b56f1646047402a714a378ea47644e45a9a4ca14d78fdec405
TLSH
T17B318637F3DC8611CC9A003A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 288f44d667c969f3b31c4b6ba62dd9523e58c9fc78fbe404cedae12b901e1be1
MD5 98251a26007c6046f1075d862230aaaa
SHA1 7d86d84a9589a978df08e59b51a79825d8ba2d09
SHA512 c5a2e9f7be8f1dce7488d522331de51f9869ea658ca618b2c4bb04a3cbf9812723abc7ea0290772fdcdc07562d16981ab08eaaff978024755b7be59cdb65b29f
TLSH
T1B3217633F3DC8254C8A9013A10DDAC5436B7C7DB40DECF9B6B85E169A42F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c11ba17dffd1ec3a5a6a5007ff7d65ce3e4b45a168312f3ee8fd0ba259e721c1
MD5 a260df5887ad9dd47cacaff566fe9f3e
SHA1 465bc8987b1dfa7bde36052af2e143a5b7558c8d
SHA512 4a375038e82e9beff9898f7c02d384ea50df84708c39f26d955cc2e1bb8e0fe09106e22919423d20c70e79fb4ee9ac7fb51754537a40d691c8d48adea77fcd30
TLSH
T13C217633B3DC8624C899013A10DDAC1036B687CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4f5a192ee7a093453ab6cd376ea03e565419e6274a42fbd78026e4eefe46b178
MD5 55d9497de18df5e0ec0727271a6763ed
SHA1 43daf19107c9b3457d2f74cc317aa0780dd90da7
SHA512 d50a50ade3cf02b670a348f118e984df097796f1db2773ef2e8754ca1e6030fba838062f3764832c0290381d7cd7552cd450698eb233bdcced6bffd4fdbcd9bf
TLSH
T150217633B3DC8224C899013A10DDAC1036B687CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mhkyifcg.gir.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mhkyifcg.gir.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Common.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\Common.targets
Size 889KB
SHA256 5bfde13b9eadc0ee74216bd3413eff5dcee272edd2866a7f9a1c27f61775cb59
MD5 7c4bca399a1dca9e8c18249b82d8c474
SHA1 fbb572d7555f52f1c20876e7939316970ec381dd
SHA512 4ee203ebc7e2fcec2deaafff9fbba08d34e286edad27a30eb184dc8a216a80afdcbe12f5254f2bb5d1b0c8cd5ef58a77e730e824b8cbff51b0216e65487e6d1b
SSDEEP 6144:IrsXdiUpQU+RVzBaayA7HLvLPp7Mrml9ZH2reqCaT:sipQVpdXPp7hlP2rn
TLSH
T13B1551B8E5CB40B4F6AFC51565BC7E650173B0CBD7C22DA4436CE4309AE9F963E09889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Directory.Build.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\Directory.Build.props
Size 296KB
SHA256 754368bccd1bebf741bc74287b132c52092e994fad9e3452e3baee0ee276fd58
MD5 c5b55aad5d223f4f55e9f57532c4b881
SHA1 99b7aef08ea4f694d419a109cc92e1a82c7e439f
SHA512 ff3da2c41d15ee529a4dfcbed0062bbe4bbaef4f514a57e0c143222a621cf3a15b4a0bd52a6d49cc63664f8fca25d8025e0534fef6e67a0bc1adae5d1dac5ffe
SSDEEP 6144:uvMLjNCCql2dQvdvwzPL5x8opsCANS1MJbfeCy6KG10jw3:mR
TLSH
T1025410E15647DA829E28DE1B93C86B0B8B73330B91815F90FD49F4C69BDE74171F8886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nancy.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\Nancy.csproj
Size 9.3MB
SHA256 3c9629bac2bcec040e7486052a613785deb258b30e8b0a5d89c1dab300fa8b29
MD5 19e70c41d453f67b545edd1e0b4009a2
SHA1 dea958fda479a0ae0bbe10e3181772a965edcbf2
SHA512 5821bea6c095007426dd554ac8209d0e805616e1a744943f5b414cf80c40da689cf090d1774bd98544a389a2e78e16f6ba94a8b4a1985ad1e364687f7bea2a14
SSDEEP 1536:VqPgZ6HjVWohrCP+taYPo6SikORLx3tIfU4bT3hIK88K54VDkOhefz5DxkJ0OSPU:r
TLSH
T1CFA6237A07D087BBF3D407C4441A356E26F9E259B924219AAB7369FFBC1E9C34078643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nancy.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\Nancy.csproj.user
Size 610KB
SHA256 77430e32556e5457e82b629c4a4e9175d5d11b1089da137f3c2110b695417df7
MD5 fe7aff41b60e1b7164c56b85c7f73ff5
SHA1 78d5f126179d40885bae7c79797d7b32b7f47dd5
SHA512 649e8a43bdd4a382ef43d77a2afd2b725180d5694874491748674952ee9b037ca0948405e71b4452b0459b1601c0cf356f061a881332cbf179e116241836d11e
SSDEEP 6144:iw5siCk6eCBF216rIwV4oK48MpPyKzLehv1Qv21OmDY6xZMgrwZCEQ0pwX/QsVob:ABasmyb
TLSH
T1B2D433F094EF50E1E35B8D0166ECBE644572314BDFCA3AA8339AF1518FA9B62371844D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nancy.csproj:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\Nancy.csproj:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

rlB0bWGmR.kkp

Path C:\Users\Admin\AppData\Local\Temp\tmp-81000-oJxazZxE5IDI\rlB0bWGmR.kkp
Size 1KB
SHA256 57286bce32aa9748cd235fc0db410b0aa20824d10956e89f1b7230ef8f71959b
MD5 ff87be56f89a29db81650bb889bca5a3
SHA1 b99708cb64faecfd009120b67a6a8631c2b57e0c
SHA512 54d2176094b90db577bf98dff1d6388b0372a38716c1ef06f86b445f258c1e4c632d194f95573b1ecf02deca6524c5e478c54f49317442f2d5a12f798412030d
TLSH
T198219897B122095DC4E532BA37B58733120D72D33884F5BDB1C4C9AE749F46FAAA12D4
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/2548-323-0x00000000000F0000-0x0000000000130000-memory.dmp

Download

memory/2548-325-0x0000000002810000-0x000000000282A000-memory.dmp

Download

memory/2548-335-0x0000000012100000-0x000000001240C000-memory.dmp

Download

memory/2548-334-0x00000000089D0000-0x0000000008AB6000-memory.dmp

Download

memory/2548-329-0x0000000004C70000-0x0000000004CA0000-memory.dmp

Download

memory/2548-326-0x0000000004E70000-0x0000000004FCA000-memory.dmp

Download

memory/4556-267-0x00007FFF009B0000-0x00007FFF01354000-memory.dmp

Download

memory/4556-274-0x00000203CACB0000-0x00000203CACBA000-memory.dmp

Download

memory/4556-272-0x00000203CAC90000-0x00000203CACAE000-memory.dmp

Download

memory/4556-269-0x00007FFF009B0000-0x00007FFF01354000-memory.dmp

Download

memory/4556-268-0x00007FFF009B0000-0x00007FFF01354000-memory.dmp

Download

memory/4556-277-0x00007FFF009B0000-0x00007FFF01354000-memory.dmp

Download

memory/4556-260-0x00007FFF00B3F000-0x00007FFF00B40000-memory.dmp

Download

memory/4556-273-0x00000203E3120000-0x00000203E31D2000-memory.dmp

Download

memory/4556-279-0x00007FFF009B0000-0x00007FFF01354000-memory.dmp

Download

memory/4556-276-0x00000203E3210000-0x00000203E3234000-memory.dmp

Download

memory/4556-266-0x00007FFF009B0000-0x00007FFF01354000-memory.dmp

Download

memory/4556-265-0x00007FFF009B0000-0x00007FFF01354000-memory.dmp

Download

memory/4556-264-0x00000203CAAC0000-0x00000203CAAE2000-memory.dmp

Download

memory/4556-263-0x00007FFF009B0000-0x00007FFF01354000-memory.dmp

Download

memory/4556-275-0x00000203E3210000-0x00000203E323A000-memory.dmp

Download

memory/5972-285-0x000001EF6A520000-0x000001EF6A5D2000-memory.dmp

Download