7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Resubmissions

27/07/2026, 20:51

260727-zngzqasscz7

27/07/2026, 20:47

260727-zktjca11fz7

Analysis

user interaction
yes
max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 20:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260727-zktjca11fz
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
240	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2420	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3248	powershell.exe
2444	powershell.exe
4792	powershell.exe
3892	powershell.exe
5036	powershell.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4836	cmd.exe
3708	cmd.exe
5896	cmd.exe
5956	cmd.exe
5552	cmd.exe
4512	cmd.exe
1468	cmd.exe
4644	cmd.exe
712	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\FluentAssertions.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\Build.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\bxYX5UHqF.56:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\Directory.Build.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\FluentAssertions.csproj:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4792	powershell.exe
4792	powershell.exe
3892	powershell.exe
3892	powershell.exe
5036	powershell.exe
5036	powershell.exe
3248	powershell.exe
3248	powershell.exe
3248	powershell.exe
2444	powershell.exe
2444	powershell.exe
2444	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeIncreaseQuotaPrivilege	4792	powershell.exe
Token: SeSecurityPrivilege	4792	powershell.exe
Token: SeTakeOwnershipPrivilege	4792	powershell.exe
Token: SeLoadDriverPrivilege	4792	powershell.exe
Token: SeSystemProfilePrivilege	4792	powershell.exe
Token: SeSystemtimePrivilege	4792	powershell.exe
Token: SeProfSingleProcessPrivilege	4792	powershell.exe
Token: SeIncBasePriorityPrivilege	4792	powershell.exe
Token: SeCreatePagefilePrivilege	4792	powershell.exe
Token: SeBackupPrivilege	4792	powershell.exe
Token: SeRestorePrivilege	4792	powershell.exe
Token: SeShutdownPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeSystemEnvironmentPrivilege	4792	powershell.exe
Token: SeRemoteShutdownPrivilege	4792	powershell.exe
Token: SeUndockPrivilege	4792	powershell.exe
Token: SeManageVolumePrivilege	4792	powershell.exe
Token: 33	4792	powershell.exe
Token: 34	4792	powershell.exe
Token: 35	4792	powershell.exe
Token: 36	4792	powershell.exe
Token: SeIncreaseQuotaPrivilege	4792	powershell.exe
Token: SeSecurityPrivilege	4792	powershell.exe
Token: SeTakeOwnershipPrivilege	4792	powershell.exe
Token: SeLoadDriverPrivilege	4792	powershell.exe
Token: SeSystemProfilePrivilege	4792	powershell.exe
Token: SeSystemtimePrivilege	4792	powershell.exe
Token: SeProfSingleProcessPrivilege	4792	powershell.exe
Token: SeIncBasePriorityPrivilege	4792	powershell.exe
Token: SeCreatePagefilePrivilege	4792	powershell.exe
Token: SeBackupPrivilege	4792	powershell.exe
Token: SeRestorePrivilege	4792	powershell.exe
Token: SeShutdownPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeSystemEnvironmentPrivilege	4792	powershell.exe
Token: SeRemoteShutdownPrivilege	4792	powershell.exe
Token: SeUndockPrivilege	4792	powershell.exe
Token: SeManageVolumePrivilege	4792	powershell.exe
Token: 33	4792	powershell.exe
Token: 34	4792	powershell.exe
Token: 35	4792	powershell.exe
Token: 36	4792	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeIncreaseQuotaPrivilege	3892	powershell.exe
Token: SeSecurityPrivilege	3892	powershell.exe
Token: SeTakeOwnershipPrivilege	3892	powershell.exe
Token: SeLoadDriverPrivilege	3892	powershell.exe
Token: SeSystemProfilePrivilege	3892	powershell.exe
Token: SeSystemtimePrivilege	3892	powershell.exe
Token: SeProfSingleProcessPrivilege	3892	powershell.exe
Token: SeIncBasePriorityPrivilege	3892	powershell.exe
Token: SeCreatePagefilePrivilege	3892	powershell.exe
Token: SeBackupPrivilege	3892	powershell.exe
Token: SeRestorePrivilege	3892	powershell.exe
Token: SeShutdownPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeSystemEnvironmentPrivilege	3892	powershell.exe
Token: SeRemoteShutdownPrivilege	3892	powershell.exe
Token: SeUndockPrivilege	3892	powershell.exe
Token: SeManageVolumePrivilege	3892	powershell.exe
Token: 33	3892	powershell.exe
Token: 34	3892	powershell.exe
Token: 35	3892	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4316	Setup.exe
4316	Setup.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4512	4316	Setup.exe	90
PID 4316 wrote to memory of 1468	4316	Setup.exe	92
PID 4316 wrote to memory of 3708	4316	Setup.exe	94
PID 4316 wrote to memory of 4644	4316	Setup.exe	96
PID 4644 wrote to memory of 4792	4644	cmd.exe	98
PID 4316 wrote to memory of 712	4316	Setup.exe	99
PID 712 wrote to memory of 3892	712	cmd.exe	101
PID 4316 wrote to memory of 5896	4316	Setup.exe	102
PID 5896 wrote to memory of 5036	5896	cmd.exe	104
PID 4316 wrote to memory of 5956	4316	Setup.exe	105
PID 5956 wrote to memory of 3248	5956	cmd.exe	107
PID 4316 wrote to memory of 5552	4316	Setup.exe	108
PID 5552 wrote to memory of 2444	5552	cmd.exe	110
PID 4316 wrote to memory of 240	4316	Setup.exe	111
PID 240 wrote to memory of 264	240	forfiles.exe	112
PID 264 wrote to memory of 4840	264	cmd.exe	114
PID 264 wrote to memory of 3320	264	cmd.exe	115
PID 3320 wrote to memory of 4836	3320	conhost.exe	116
PID 4836 wrote to memory of 2420	4836	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:3708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2444
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh /m bxYX5UHqF.56 /c "cmd /c ren @file bxYX5UHqF.bat && call bxYX5UHqF.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "bxYX5UHqF.56" bxYX5UHqF.bat && call bxYX5UHqF.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:264
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:4840
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\bxYX5UHqF.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\bxYX5UHqF.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4836
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\FluentAssertions.csproj" /nologo /v:q
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 52c3278fd60a3fa44f4491584a21a403090cfe12204f9e4b7f45f40e7d10f9b3
MD5 ebebd4ee9e273954a351a240d6b7a5d3
SHA1 87dfcd8ea5bc34269e6b2b325ba1e3b4f1ea5f97
SHA512 dd00237be24baaae5556304bd9b26d35a4ab8adbd884f8f4cb25f92697aa4a63aa55d0ede1ecc8b56f1646047402a714a378ea47644e45a9a4ca14d78fdec405
TLSH
T17B318637F3DC8611CC9A003A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dcf0b6b9ceae7e42f33fa311e6f2f7e9cddcbc2f7cc99020cd1225cb5255f1d7
MD5 ff716885cfab581801ade5f78056e885
SHA1 c7a0f18e5f661d54157995429aa32a7cdb074214
SHA512 10c5af78c7cf4792dfa7e48910dd89e6ce1ce1df483512cd9e2ac743ca9d7e2c9a95202a5816613b6ad1842fb8cbf50d225d466ea61b88e8548e1031e07f71eb
TLSH
T1A6217633F3DC8694C899013A10DDAC1032B7C7CB40DECF9B6B85D129A42F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 995278b017a17c081037c71e72044cffe2bee9e2d8337e0e4f2614da913d20af
MD5 40d4f8f764c9cb4249fb0b8b23dcd45f
SHA1 790f01bd9489afcfcec05fbff6392d27d236c6af
SHA512 762a4c7bfa282dbde0a2ca122d544b9eaf996ae22e4a018d19000da263f734c1a1df4099e13912873a00a28153e68d77c9037f8799826c08d736adbc94e8ace1
TLSH
T1E9217633F3DC8694C899013A10DDAC1032BB87CB40DECF9B6B85D129A42F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fd996b3d9506a85dab9305780d0c359f01ac36b5645add6889a223e6ebc5edff
MD5 f8075ebc8afa86449b9965118d622130
SHA1 7420d42aa5870b140abd6968e58c615bc1045771
SHA512 6e6cb891be07eadb6fa68a64b7ffc77ffe6cf45ed6210504290d4a9eada4f8723bcf67ef6fdcd712b40d853fd09e15bdee11f530eb68167e1b25ca61d274c188
TLSH
T19F216837F3DD8614DCA9403A10DDAD1036B6C7DB40DECF5B6B85E159A42F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cjsgrssx.tsj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cjsgrssx.tsj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1785185392.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1785185392.tmp
Size 1KB
SHA256 9ed6d8855df2177e29b7bdc5f5b1bc8235ddd15aa9c8ab33d37d8d48fbffa38f
MD5 89e6a75c89040e3bdc2e056eaba69547
SHA1 0bb9542dc0696bd7615ebe082df7efd35d74dcde
SHA512 473afd9484ba9a1fbec7a469748516245c9c77ffdccdfd426efe2303e0557f1b5614b9ca5813f64a39b2186cca9623741aac304a7ba13621d34ac968432e1752
TLSH
T1BC312733BA114F1B0309773020F84ADE59353FEB0097A82D9182B00BDCB9A3152B2DEA
MD5 SHA1 SHA512 TLSH

Submit Download

Build.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\Build.props
Size 139KB
SHA256 fae363f62d4cf15928f36d2ac0cae7edf6c20b5fea115e58792359740f244626
MD5 b7d559b0476954a6ba2e652988515fc3
SHA1 6c310b5b779187d126c7c913189c4b4ae54e513f
SHA512 469311d88a6552604e7c6cb8f1f05b655eec32f49490d605b157701ff2977d90808aa9aeac503bfb0b0084f1fab6426bda7dca0ecb933a66fb1795d88a47b960
SSDEEP 1536:N85QODViYscHTWKzl06ls1hoZ4G9htjrmeVLzYLsi:N85QOLHl06ls1hoi4G
TLSH
T140E378784ACE5665F697D91129FCBD79A17375C789EA3A05232CE0300BF8F623F05A48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Directory.Build.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\Directory.Build.targets
Size 402KB
SHA256 91d2972c824a73210c44c187532eb5f2d51275494b4f1c3f6dab3a7a0296980f
MD5 b465d4bb1b3de57a1bdaf5295f2aa151
SHA1 ec360c26774bceac4d62a99540554cfbe8f47782
SHA512 39fb685450d4ce6cf1266770fb438866a185789dfe977b35509a86dc114bf5e2c6e37269cb126839599743fe55058edcf3c9a41a89848714bc7b9edfff80df9b
SSDEEP 1536:JUVBIxN5nVFF7cpIZrZADrUJ8krirMXbm/Pu258tyXz2ncQ15sCm7D83ToACTVwo:DypKAUFkT1
TLSH
T12F94856CF88BA5B4F9BF916166E83E550572318B53C25DE0DB7CE004A3E7BCA6D850C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Directory.Build.targets:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\Directory.Build.targets:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

FluentAssertions.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\FluentAssertions.csproj
Size 8.9MB
SHA256 deb11925d021c99d6e8e2df4a4d3872c33e658c8983cd16f2cb10bb586cc3ddf
MD5 10a3fb510fdad66bcddf983aaa896da0
SHA1 29b92374b7134a0b7ddd1c4533b78563da60e283
SHA512 26ef83ccd8e9db794ffc019ab8c2aa4eea9ce3aa85abc2a3f45004d7434fd1339b26d78db06b44c9fa2a15c55856847b2a9d748778047bfebeed74dd0f4a673b
SSDEEP 1536:Dy9n82H9vxT9BKBEB/jlUzG/ipyUTwG4Tx05OYMDKlhvs3WnS2MIlP8MkpoeOJ8m:9
TLSH
T1EA96C07B078047BAF3D447C8849B241E26F4E115BA253059FB736DEEBC2A9DB8078647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FluentAssertions.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\FluentAssertions.csproj.user
Size 415KB
SHA256 e25fe24ae901d1dc14612eceb49eb35a777b4f7c5cc1003a81b7ee657791214e
MD5 6061d14283203d8b5333b900acc3a04a
SHA1 922be92dc6ba30050464c7e597cdc181be6ee625
SHA512 ccf61c241654e6ec7998cb67921950d9a72ea031091d4786c6dbcbbf809730d4fa4a155bc893c295bdda7841949a3242ca2756bea416a34287f493fa349d872b
SSDEEP 6144:SSIEf3ypMxPOPjWwrAvO/oE9toBH4oWyya+KsA:9OHovWymi
TLSH
T17A94F0B49CAE21B5F35BD90126BCBE7451733087DFCA3568239EF2218FA87262B0551D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bxYX5UHqF.56

Path C:\Users\Admin\AppData\Local\Temp\tmp-85067-BFMkKv46swQh\bxYX5UHqF.56
Size 1KB
SHA256 45de1fbdbd29ea7c4a3943e6cd5c08589ea5099a56211395cd15d9e00a5ba9cb
MD5 14f36f60fe8b39d4865cc4f223e039c7
SHA1 b3b39dc56c5fbf9c0e4c8780a3b5a703174b5608
SHA512 8a34d45a0e401ef2d2e731807c602498b8d18d107eddaca01a81996ee4c43b8d4ecb78e617a804538607ba3b3cc04ae584bee4d3ca8719320cf96df5c5d30a63
TLSH
T1FB219796B1214968C4A1337A27758733120E72832480F4BD70C4C99D348F12EAA962D8
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/2420-330-0x0000000003270000-0x000000000328A000-memory.dmp

Download

memory/2420-328-0x0000000000CE0000-0x0000000000D20000-memory.dmp

Download

memory/2420-332-0x00000000059E0000-0x0000000005B3A000-memory.dmp

Download

memory/2420-333-0x0000000005B40000-0x0000000005B70000-memory.dmp

Download

memory/2420-354-0x0000000009590000-0x000000000960C000-memory.dmp

Download

memory/2420-355-0x0000000005F80000-0x000000000626C000-memory.dmp

Download

memory/2420-357-0x00000000018D0000-0x000000000194C000-memory.dmp

Download

memory/3248-303-0x000002E1E0980000-0x000002E1E0A32000-memory.dmp

Download

memory/3892-288-0x000001786DCE0000-0x000001786DD92000-memory.dmp

Download

memory/3892-290-0x000001786D8B0000-0x000001786D9DF000-memory.dmp

Download

memory/4792-272-0x00007FFFA9F20000-0x00007FFFAA8C4000-memory.dmp

Download

memory/4792-271-0x00007FFFA9F20000-0x00007FFFAA8C4000-memory.dmp

Download

memory/4792-281-0x0000022240250000-0x000002224037F000-memory.dmp

Download

memory/4792-263-0x00007FFFA9F20000-0x00007FFFAA8C4000-memory.dmp

Download

memory/4792-278-0x00000222408E0000-0x000002224090A000-memory.dmp

Download

memory/4792-279-0x00000222408E0000-0x0000022240904000-memory.dmp

Download

memory/4792-277-0x00000222401F0000-0x00000222401FA000-memory.dmp

Download

memory/4792-275-0x0000022240580000-0x000002224059E000-memory.dmp

Download

memory/4792-260-0x00007FFFAA0AF000-0x00007FFFAA0B0000-memory.dmp

Download

memory/4792-276-0x00000222405A0000-0x0000022240652000-memory.dmp

Download

memory/4792-282-0x00007FFFA9F20000-0x00007FFFAA8C4000-memory.dmp

Download

memory/4792-270-0x00007FFFA9F20000-0x00007FFFAA8C4000-memory.dmp

Download

memory/4792-269-0x00007FFFA9F20000-0x00007FFFAA8C4000-memory.dmp

Download

memory/4792-268-0x00007FFFA9F20000-0x00007FFFAA8C4000-memory.dmp

Download

memory/4792-267-0x00007FFFA9F20000-0x00007FFFAA8C4000-memory.dmp

Download

memory/4792-266-0x00007FFFA9F20000-0x00007FFFAA8C4000-memory.dmp

Download

memory/4792-265-0x00007FFFA9F20000-0x00007FFFAA8C4000-memory.dmp

Download

memory/4792-264-0x00000222401A0000-0x00000222401C2000-memory.dmp

Download

memory/5036-297-0x0000010D6D8A0000-0x0000010D6D9CF000-memory.dmp

Download