7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 05:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260724-f85rqsstdx
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
3732	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
892	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4788	powershell.exe
4856	powershell.exe
6016	powershell.exe
2280	powershell.exe
2952	powershell.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3864	cmd.exe
4356	cmd.exe
2932	cmd.exe
5132	cmd.exe
2296	cmd.exe
3228	cmd.exe
6040	cmd.exe
4476	cmd.exe
928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\Zxing.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\Zxing.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\nZjd33KnH.v1:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\Zxing.Internal.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\Directory.Build.props:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4856	powershell.exe
4856	powershell.exe
6016	powershell.exe
6016	powershell.exe
2280	powershell.exe
2280	powershell.exe
2952	powershell.exe
2952	powershell.exe
4788	powershell.exe
4788	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeIncreaseQuotaPrivilege	4856	powershell.exe
Token: SeSecurityPrivilege	4856	powershell.exe
Token: SeTakeOwnershipPrivilege	4856	powershell.exe
Token: SeLoadDriverPrivilege	4856	powershell.exe
Token: SeSystemProfilePrivilege	4856	powershell.exe
Token: SeSystemtimePrivilege	4856	powershell.exe
Token: SeProfSingleProcessPrivilege	4856	powershell.exe
Token: SeIncBasePriorityPrivilege	4856	powershell.exe
Token: SeCreatePagefilePrivilege	4856	powershell.exe
Token: SeBackupPrivilege	4856	powershell.exe
Token: SeRestorePrivilege	4856	powershell.exe
Token: SeShutdownPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeSystemEnvironmentPrivilege	4856	powershell.exe
Token: SeRemoteShutdownPrivilege	4856	powershell.exe
Token: SeUndockPrivilege	4856	powershell.exe
Token: SeManageVolumePrivilege	4856	powershell.exe
Token: 33	4856	powershell.exe
Token: 34	4856	powershell.exe
Token: 35	4856	powershell.exe
Token: 36	4856	powershell.exe
Token: SeIncreaseQuotaPrivilege	4856	powershell.exe
Token: SeSecurityPrivilege	4856	powershell.exe
Token: SeTakeOwnershipPrivilege	4856	powershell.exe
Token: SeLoadDriverPrivilege	4856	powershell.exe
Token: SeSystemProfilePrivilege	4856	powershell.exe
Token: SeSystemtimePrivilege	4856	powershell.exe
Token: SeProfSingleProcessPrivilege	4856	powershell.exe
Token: SeIncBasePriorityPrivilege	4856	powershell.exe
Token: SeCreatePagefilePrivilege	4856	powershell.exe
Token: SeBackupPrivilege	4856	powershell.exe
Token: SeRestorePrivilege	4856	powershell.exe
Token: SeShutdownPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeSystemEnvironmentPrivilege	4856	powershell.exe
Token: SeRemoteShutdownPrivilege	4856	powershell.exe
Token: SeUndockPrivilege	4856	powershell.exe
Token: SeManageVolumePrivilege	4856	powershell.exe
Token: 33	4856	powershell.exe
Token: 34	4856	powershell.exe
Token: 35	4856	powershell.exe
Token: 36	4856	powershell.exe
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeIncreaseQuotaPrivilege	6016	powershell.exe
Token: SeSecurityPrivilege	6016	powershell.exe
Token: SeTakeOwnershipPrivilege	6016	powershell.exe
Token: SeLoadDriverPrivilege	6016	powershell.exe
Token: SeSystemProfilePrivilege	6016	powershell.exe
Token: SeSystemtimePrivilege	6016	powershell.exe
Token: SeProfSingleProcessPrivilege	6016	powershell.exe
Token: SeIncBasePriorityPrivilege	6016	powershell.exe
Token: SeCreatePagefilePrivilege	6016	powershell.exe
Token: SeBackupPrivilege	6016	powershell.exe
Token: SeRestorePrivilege	6016	powershell.exe
Token: SeShutdownPrivilege	6016	powershell.exe
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeSystemEnvironmentPrivilege	6016	powershell.exe
Token: SeRemoteShutdownPrivilege	6016	powershell.exe
Token: SeUndockPrivilege	6016	powershell.exe
Token: SeManageVolumePrivilege	6016	powershell.exe
Token: 33	6016	powershell.exe
Token: 34	6016	powershell.exe
Token: 35	6016	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1784	Setup.exe
1784	Setup.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 6040	1784	Setup.exe	89
PID 1784 wrote to memory of 4476	1784	Setup.exe	91
PID 1784 wrote to memory of 5132	1784	Setup.exe	93
PID 1784 wrote to memory of 928	1784	Setup.exe	95
PID 928 wrote to memory of 4856	928	cmd.exe	97
PID 1784 wrote to memory of 2296	1784	Setup.exe	99
PID 2296 wrote to memory of 6016	2296	cmd.exe	101
PID 1784 wrote to memory of 3228	1784	Setup.exe	102
PID 3228 wrote to memory of 2280	3228	cmd.exe	104
PID 1784 wrote to memory of 3864	1784	Setup.exe	105
PID 3864 wrote to memory of 2952	3864	cmd.exe	107
PID 1784 wrote to memory of 4356	1784	Setup.exe	108
PID 4356 wrote to memory of 4788	4356	cmd.exe	110
PID 1784 wrote to memory of 3732	1784	Setup.exe	111
PID 3732 wrote to memory of 4632	3732	forfiles.exe	112
PID 4632 wrote to memory of 2508	4632	cmd.exe	114
PID 4632 wrote to memory of 932	4632	cmd.exe	115
PID 932 wrote to memory of 2932	932	conhost.exe	116
PID 2932 wrote to memory of 892	2932	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:6040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:5132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4788
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc /m nZjd33KnH.v1 /c "cmd /c ren @file nZjd33KnH.bat && call nZjd33KnH.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "nZjd33KnH.v1" nZjd33KnH.bat && call nZjd33KnH.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:2508
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\nZjd33KnH.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:932
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\nZjd33KnH.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2932
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\Zxing.csproj" /nologo /v:q
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 52c3278fd60a3fa44f4491584a21a403090cfe12204f9e4b7f45f40e7d10f9b3
MD5 ebebd4ee9e273954a351a240d6b7a5d3
SHA1 87dfcd8ea5bc34269e6b2b325ba1e3b4f1ea5f97
SHA512 dd00237be24baaae5556304bd9b26d35a4ab8adbd884f8f4cb25f92697aa4a63aa55d0ede1ecc8b56f1646047402a714a378ea47644e45a9a4ca14d78fdec405
TLSH
T17B318637F3DC8611CC9A003A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 66c3841b9fb976c9b32778de78a5e769e0368576ecb0b55b62837e2e80b0c71a
MD5 e4c882439074ea53015ecb9d93d0be5c
SHA1 cf132df247fc5824f03caa4b8dfd1a4b3bf57e03
SHA512 a39f1742d21b3e4f412747b9bd73c91bcd332393bc6e3341132a072c86174b751fd1abbd2598a8bc197176b5afaf7690bc3984ae87c5efd396f5fff94fc83d1b
TLSH
T16D217633B3DC8214C8A9403A10DDAC1036B687CB40DECF9B6B81E169B42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ce63074cd611e46aec66a20772bdeab281b3c8459f7846e678c56f8ae86f2711
MD5 7db77264832de10765f32aeb8029789b
SHA1 7dbc51a6fa7031536e20ae88df1680044dbe7a2a
SHA512 daf6d32a12ba4481f7b864dae617a338cc4a6bb1823dab221f70df4f5c6c58f196187a4437ef785e95364fd4d15c7193da08305c9b1fd91912c890c8f326b506
TLSH
T1C4219837F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1f36ce6b96306efdb0b9b0fd82c259033ffb3042d02dbd1f416a59a1ee803a8
MD5 617b22636f19ad8c73dd78f6ecce8323
SHA1 46c6e97f54d82b55118a9b4e1d14809c0cbe3e66
SHA512 3a27652ab7c1ecfa8b2b481cc3e96b1bd83375a9f317facae6a0b3fa9efad6ccb514f578712eb89055e344340a77855e8a7cdb05315da356b2a015c671ae27c7
TLSH
T156219837F3DC8214DCA9003A10DDAD0036B6C7CB40DECF5B6B81E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vrwy30ui.qtn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vrwy30ui.qtn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1784871409.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1784871409.tmp
Size 1KB
SHA256 e3077a316a59df21a1a3fbe37b088b83d3935b4363a7f1dfed1d1ffdd443ec28
MD5 f80a47a076069e4bc67a748846441c29
SHA1 7472c63aad29d0d271be49279761df626a978433
SHA512 90d5291e3ed9c6a4e47aa8a67826741920ab383c08120156b4652f3ef1841cd23eb664e82cccbda27546c778d7e0e6db991c87925435ffe391309edf2443b11c
TLSH
T10431E83E26E25C27649F557586F00BB6496830A69C63D07240337B66C1C53E67899973
MD5 SHA1 SHA512 TLSH

Submit Download

Directory.Build.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\Directory.Build.props
Size 177KB
SHA256 ae5fd6eca6c8b69e2c73a1e27cd2fa4a1d278a1c555d9f3f50c4c54e3dfc4a8a
MD5 36cf3fb406f71ee7620ae6b279cbdc78
SHA1 1cb46ad21ad0f77f5708e71e011bc7299ec6751f
SHA512 c6af92205e12332a000f942d09647ef1357e66a7109fc7cb674dcb33f9ea71091bdbab10a90c069e3c18bf9d3d702fc980d6a32b0244be4a8b33a892a4771d1c
SSDEEP 1536:f6x+GD6Euw/Hq/Ezk5nh77plPKsK19hyYgFtiQSGJ8VWvohIn5ky0s4NR5ZY7wbC:CXuwydhHW5yntnJvoe5v0sbarW
TLSH
T16D048A78D9DE00A5E3C7CD102EACBEA5427374CBDBDB3618136DE5214F68BA63B44909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Zxing.Internal.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\Zxing.Internal.targets
Size 499KB
SHA256 39dd927d74b863edcfc985185a375ae17e9cd0097e59166943f996c31687f0ec
MD5 91840c13f9004b13b9dedc526bc6882c
SHA1 ddb09593e98cd5e08e59a99700a4187e12a2b618
SHA512 91d68d1da5a7399372e3d0b0d43553d9f739a5529776e39627ee1b62efbffb9e577ccc0c7238e686e2398105263e2d03d03c8d39193e1e31f21c7ac7b8962861
SSDEEP 3072:osKrdvYFaxxExgHphX/5GZlxPRtcJvRWc34sb8tui:royFobXg5rp5D
TLSH
T1D5B40DB8A58F9090F69FC5227AAC7EA5013235CB9AC61E51437CE1501BF9F963F8580F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Zxing.Internal.targets:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\Zxing.Internal.targets:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

Zxing.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\Zxing.csproj
Size 8.2MB
SHA256 3cd3bb1418c2a518acfb3647d3827e83414941dade25b3fa649ecf1b03d89bd1
MD5 9efc985f45081815d5eb7d424656f631
SHA1 eb4c891e50cfe401e33a19c214b8a69e1a009c09
SHA512 2be312fb6cc6f26040d8ed7354e4bb21e0c8edf590978b091249460b172597da721d923710e075b7716a34dfbe3371af6a0aafbbc601d2a03fc60d44aed303f4
SSDEEP 1536:JH5JSBnIki0y3XTKsiiW5tWX/J9OKuY5BPz1gw5MQVNWQRjVZEQM03hmtfSeLU/V:N
TLSH
T11D96C07B07C087BAF3D447C4446A241E26F9E166B925355ABB33A9EFBC1A8C7403C647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Zxing.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\Zxing.csproj.user
Size 415KB
SHA256 5bb944cf091fa0bb824f04be46ff82b6ee912c704a1b117c0c291d061795affc
MD5 8d372d2328038d7ba3ac364f5b6f3f56
SHA1 b5f0ac7d65c0a231ddbaaa898353b73c699b5f8f
SHA512 e283280b0047693f9c8fa7bba58c2c8710c611dfcf86c27952962571f5020d14840cd13976a4d034c57a80ecfbedfefba11549c28557ac5d8f019378a87bd122
SSDEEP 3072:xT1ifMwzVbq2S0O5A/cncNlIV2oxcGfpO:x1ifMwzVbq2S0sA/cncNlIV2oxcGQ
TLSH
T1A89401F4F8AE25B2E38BC54556ACBE7846B231C3D7CA3528639FE2454F9975A6F0400C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nZjd33KnH.v1

Path C:\Users\Admin\AppData\Local\Temp\tmp-43162-eG32JPravimc\nZjd33KnH.v1
Size 1KB
SHA256 fd8e8b0e60da31d5648cdffc7f1f2b741291fe7532261bbde520d77e07b40c6e
MD5 0074362035f617c9b85a6fb1531bbbc8
SHA1 cd346616c2d08a01dba56482356b2b23909061aa
SHA512 bcebdd7f09d5dddcbbe6bab06092a54feb49e7765c514d0410fb14f485fe694ea3feb8c84c3c1552053ed4a979e8b03e95fe15da2e4022289f57431b93ea7446
TLSH
T13A21BB97B522455DC4E072BA27B58733130D72C33880F4BDB0C4C9ADB49F52FAAA12E8
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/892-320-0x00000000056D0000-0x0000000005700000-memory.dmp

Download

memory/892-315-0x0000000000C90000-0x0000000000CD0000-memory.dmp

Download

memory/892-316-0x0000000003170000-0x000000000318A000-memory.dmp

Download

memory/892-317-0x00000000058A0000-0x00000000059FA000-memory.dmp

Download

memory/892-342-0x0000000005E10000-0x00000000060D2000-memory.dmp

Download

memory/892-341-0x0000000009430000-0x00000000094BE000-memory.dmp

Download

memory/1784-337-0x0000000002070000-0x00000000034A4000-memory.dmp

Download

memory/1784-305-0x0000000002070000-0x00000000034A4000-memory.dmp

Download

memory/4856-268-0x00000206E9F10000-0x00000206E9F3A000-memory.dmp

Download

memory/4856-267-0x00000206D1C90000-0x00000206D1C9A000-memory.dmp

Download

memory/4856-266-0x00000206EA190000-0x00000206EA242000-memory.dmp

Download

memory/4856-265-0x00000206D1CA0000-0x00000206D1CBE000-memory.dmp

Download

memory/4856-269-0x00000206E9F10000-0x00000206E9F34000-memory.dmp

Download

memory/4856-260-0x00000206D1BD0000-0x00000206D1BF2000-memory.dmp

Download