7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
149s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260810-mry17afe83
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
3968	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3328	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4440	powershell.exe
2548	powershell.exe
4492	powershell.exe
5444	powershell.exe
6020	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2908	cmd.exe
2768	cmd.exe
1300	cmd.exe
1900	cmd.exe
1484	cmd.exe
2996	cmd.exe
2804	cmd.exe
6100	cmd.exe
4252	cmd.exe
1156	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\X1MeC3NRV.e2:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\Directory.Build.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\Iced.Internal.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\Iced.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\Iced.csproj.user:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4440	powershell.exe
4440	powershell.exe
2548	powershell.exe
2548	powershell.exe
4492	powershell.exe
4492	powershell.exe
5444	powershell.exe
5444	powershell.exe
6020	powershell.exe
6020	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeIncreaseQuotaPrivilege	4440	powershell.exe
Token: SeSecurityPrivilege	4440	powershell.exe
Token: SeTakeOwnershipPrivilege	4440	powershell.exe
Token: SeLoadDriverPrivilege	4440	powershell.exe
Token: SeSystemProfilePrivilege	4440	powershell.exe
Token: SeSystemtimePrivilege	4440	powershell.exe
Token: SeProfSingleProcessPrivilege	4440	powershell.exe
Token: SeIncBasePriorityPrivilege	4440	powershell.exe
Token: SeCreatePagefilePrivilege	4440	powershell.exe
Token: SeBackupPrivilege	4440	powershell.exe
Token: SeRestorePrivilege	4440	powershell.exe
Token: SeShutdownPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeSystemEnvironmentPrivilege	4440	powershell.exe
Token: SeRemoteShutdownPrivilege	4440	powershell.exe
Token: SeUndockPrivilege	4440	powershell.exe
Token: SeManageVolumePrivilege	4440	powershell.exe
Token: 33	4440	powershell.exe
Token: 34	4440	powershell.exe
Token: 35	4440	powershell.exe
Token: 36	4440	powershell.exe
Token: SeIncreaseQuotaPrivilege	4440	powershell.exe
Token: SeSecurityPrivilege	4440	powershell.exe
Token: SeTakeOwnershipPrivilege	4440	powershell.exe
Token: SeLoadDriverPrivilege	4440	powershell.exe
Token: SeSystemProfilePrivilege	4440	powershell.exe
Token: SeSystemtimePrivilege	4440	powershell.exe
Token: SeProfSingleProcessPrivilege	4440	powershell.exe
Token: SeIncBasePriorityPrivilege	4440	powershell.exe
Token: SeCreatePagefilePrivilege	4440	powershell.exe
Token: SeBackupPrivilege	4440	powershell.exe
Token: SeRestorePrivilege	4440	powershell.exe
Token: SeShutdownPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeSystemEnvironmentPrivilege	4440	powershell.exe
Token: SeRemoteShutdownPrivilege	4440	powershell.exe
Token: SeUndockPrivilege	4440	powershell.exe
Token: SeManageVolumePrivilege	4440	powershell.exe
Token: 33	4440	powershell.exe
Token: 34	4440	powershell.exe
Token: 35	4440	powershell.exe
Token: 36	4440	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeIncreaseQuotaPrivilege	2548	powershell.exe
Token: SeSecurityPrivilege	2548	powershell.exe
Token: SeTakeOwnershipPrivilege	2548	powershell.exe
Token: SeLoadDriverPrivilege	2548	powershell.exe
Token: SeSystemProfilePrivilege	2548	powershell.exe
Token: SeSystemtimePrivilege	2548	powershell.exe
Token: SeProfSingleProcessPrivilege	2548	powershell.exe
Token: SeIncBasePriorityPrivilege	2548	powershell.exe
Token: SeCreatePagefilePrivilege	2548	powershell.exe
Token: SeBackupPrivilege	2548	powershell.exe
Token: SeRestorePrivilege	2548	powershell.exe
Token: SeShutdownPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeSystemEnvironmentPrivilege	2548	powershell.exe
Token: SeRemoteShutdownPrivilege	2548	powershell.exe
Token: SeUndockPrivilege	2548	powershell.exe
Token: SeManageVolumePrivilege	2548	powershell.exe
Token: 33	2548	powershell.exe
Token: 34	2548	powershell.exe
Token: 35	2548	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4676	Setup.exe
4676	Setup.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 2908	4676	Setup.exe	89
PID 4676 wrote to memory of 1300	4676	Setup.exe	91
PID 4676 wrote to memory of 1900	4676	Setup.exe	93
PID 4676 wrote to memory of 1484	4676	Setup.exe	95
PID 1484 wrote to memory of 4440	1484	cmd.exe	97
PID 4676 wrote to memory of 2996	4676	Setup.exe	99
PID 2996 wrote to memory of 2548	2996	cmd.exe	101
PID 4676 wrote to memory of 2804	4676	Setup.exe	102
PID 2804 wrote to memory of 4492	2804	cmd.exe	104
PID 4676 wrote to memory of 6100	4676	Setup.exe	105
PID 6100 wrote to memory of 5444	6100	cmd.exe	107
PID 4676 wrote to memory of 4252	4676	Setup.exe	108
PID 4252 wrote to memory of 6020	4252	cmd.exe	110
PID 4676 wrote to memory of 3968	4676	Setup.exe	111
PID 3968 wrote to memory of 4452	3968	forfiles.exe	112
PID 4452 wrote to memory of 2056	4452	cmd.exe	114
PID 4452 wrote to memory of 2632	4452	cmd.exe	115
PID 4452 wrote to memory of 1156	4452	cmd.exe	116
PID 1156 wrote to memory of 4596	1156	cmd.exe	117
PID 1156 wrote to memory of 2108	1156	cmd.exe	118
PID 4452 wrote to memory of 4424	4452	cmd.exe	119
PID 4424 wrote to memory of 2768	4424	conhost.exe	120
PID 2768 wrote to memory of 5892	2768	cmd.exe	121
PID 2768 wrote to memory of 3328	2768	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:1300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6020
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y /m X1MeC3NRV.e2 /c "cmd /c ren @file X1MeC3NRV.bat && call X1MeC3NRV.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "X1MeC3NRV.e2" X1MeC3NRV.bat && call X1MeC3NRV.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2056
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:2632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1156
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:4596
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:2108
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\X1MeC3NRV.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4424
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\X1MeC3NRV.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2768
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5892
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\Iced.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 52c3278fd60a3fa44f4491584a21a403090cfe12204f9e4b7f45f40e7d10f9b3
MD5 ebebd4ee9e273954a351a240d6b7a5d3
SHA1 87dfcd8ea5bc34269e6b2b325ba1e3b4f1ea5f97
SHA512 dd00237be24baaae5556304bd9b26d35a4ab8adbd884f8f4cb25f92697aa4a63aa55d0ede1ecc8b56f1646047402a714a378ea47644e45a9a4ca14d78fdec405
TLSH
T17B318637F3DC8611CC9A003A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c36b229e535eca1616bfb76a12b96e95059ee886706c37c82e7ec6384b01e51a
MD5 f19522ffd5f619cc48c8216fe86ed534
SHA1 2f32d95e4577370b4bc81338c85389e5fa2c7156
SHA512 b698b10c92c7e608e0701c9b28ec00e5bc8c936fab7aa507e2aa9ca1afd88da8d7fba82968866215f4032e2828aa1e200aa90f4e85bad9696c9ae00e913b1490
TLSH
T1B4217633B3DC8224C899403A10DDAC1036B687DB40DECF9B6B81E159A42F299CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3203209200177d187b36fc77c69b1073dae1601f695c20ced54f89d9adb175af
MD5 a52d442e84141b6cbc1c0883a953dee6
SHA1 d9c7404f5d0b624f4278f3e48dbc4e568efb0886
SHA512 b4c8397fe141950a10bda490c29caad6351393ce18209ca675ea03f2eeb8e089c0ba73a45805d6ab33bef3b3271cc188792aa65592fe45bdfe40724cd5a6fd01
TLSH
T1D3219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 94d46bf6480771ff90c7dca5f3e32270a686b65728f0cd22130ea97516bbdda1
MD5 1f19e2f9dded3c8e62c5d8b6200fcaf7
SHA1 d9232aac68676c051d0ec1f861a856518643d8b6
SHA512 6f0d054cdaaab5db919756aa1d7cee8aee02d5a3038f4078bafe3004b6adfa2799d2219c62dc04c8fc48603b7558aad0457577e3c2fb2b76cf34fb7d6172897a
TLSH
T1AB219837F3DC8214CCA9003A10DDAD0036B6C7CB40DECF5B6B85E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5g4w3ihn.wim.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5g4w3ihn.wim.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1786359885.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1786359885.tmp
Size 1KB
SHA256 2780e2fdcac965f492a80679fac3a1cf6f5ef40c189d2c5dd431318e21f6249d
MD5 a54d7aad7a68d2179ef46aaa52343d5a
SHA1 6d8cec4f3b2dba52524006e1f851f2c0d664df5b
SHA512 0a3c1a3e40f39ba7351fc4a6034bdf1905f4960c03da4a1286c9435a03e72a2cc11363302acc28ed63732acc81333f82147d89076aded18656c3d850c7ee460a
TLSH
T160310ABE977303CA050515A1D1AF4C6B0F450E6C99DA952AD472D10C9570234A2B1AB3
MD5 SHA1 SHA512 TLSH

Submit Download

Directory.Build.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\Directory.Build.props
Size 679KB
SHA256 3dfc62072ae78b460b0535768b30df5270d63b9245713cf9546bc8afc6751672
MD5 f8fa26ce03ff28643be215b020a74d2f
SHA1 599e5102cca658b4f105307a23b3ef4dd714412b
SHA512 243b865a8817d7655378c136cf29572f15587be21706fc7d5d992139fc2c5fb5ca74a3f41fe939cd2410e503a3ebd2ace36a5a83514505844bd74fc325d87ff1
SSDEEP 3072:JdGWjUDuTyrN84eUaTXphc/YhcUlLa9mfOjuwhIj9ozeYZAWOjF/:JdkeU6cmfOjuwhIKhZw/
TLSH
T1EBE491B85DEB0095FB5BC470A5FDBE7452F33193BBD71E900B2DA50C1B78A522E9060A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Directory.Build.props:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\Directory.Build.props:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

Iced.Internal.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\Iced.Internal.targets
Size 1.6MB
SHA256 9d50cb87bdde8807114598757a5e171b1ae93068beba56eedb5a36006a063258
MD5 c239d907e746ce0b69deaecb5dde56e8
SHA1 ef589554ce9df118d3b3fc9f3f4b08331a0d2453
SHA512 390b4e8afbc240b4ad09afe1971dec5fc350c2b296525069c194d453d8d4f945bf51d7d85694048e9163abc83b7742b34488b8cb0d9ecc2a1970c35907725a62
SSDEEP 6144:CJ+dxeoiN7ecGrpigyunLeBsH60lKpZQ+ypVALMEFv9jV3McJafgttHF8HWlD6oe:CtoiwLeeH60lKp/ypVA4EFN8
TLSH
T13B7569B816EF4070F79B8C3563FEBD745172328B97DA7D44062CA4405BAAB613E21E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iced.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\Iced.csproj
Size 9.2MB
SHA256 8f0152760c67632c2d970cb2ff32ff50aa17a16aef79bbef7a766f600e299851
MD5 4db4c33b34d033c82f88695c4ae927ce
SHA1 f7fe863cea0cdd30f5e0ef93d9e37f75ac8c21b3
SHA512 691cd5d759d0b6c5816a0884d03b90763c0a63f65b1032714c3e98519a6660f0799a0c0a5a1721ce15c4c15f02fe6b5ff7b4677d337f5691c9377e8ada68cd65
SSDEEP 1536:tKWvyTtWBg4bk18FMv7/bd/+GqE1P02LV7sIxIA4WlaMX5+S2b5Yf9Nzl9EekqSg:e
TLSH
T1E7A6AC7A078047BAE3D447C0885B215E3AF4E525BA253159F73369EFBC2A8DB8078753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iced.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\Iced.csproj.user
Size 1.4MB
SHA256 b5a61b799e30029d5b50f88543449e2327b685b48ec932eac7a24dce26e0d310
MD5 f524c3a9c5c95afea82cb628b3f42461
SHA1 16dbb0ec89e1037a70e65e345e4bca3466c1a43a
SHA512 9759cf3cf550d6137c7097ad56b1bd1eb528a231ce8c8f1e8535966fb59bb19b3b356414af65a59cf19def170f4f1d77c0d277b8a111dbaa83d542c31b325fda
SSDEEP 6144:b2t+lazHFWlJlxZpJ05o1i1hN4c2pc5o8f1IdY2/Fhli6O2+Oe2GmOyqInR+Alfp:dNDg/nTAZOA
TLSH
T170652FF4ACBD5459D21BCDA03AACFF7901F2B0DB9BC85B144362A3654BD8A257E42C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X1MeC3NRV.e2

Path C:\Users\Admin\AppData\Local\Temp\tmp-67286-7FfibdSsiu8Y\X1MeC3NRV.e2
Size 1KB
SHA256 0d26f773e13cdedc19b47ca7aa05bb5755f5919921aa66b692556af2d3a75689
MD5 34dcdeb1c2436cd90a2ee2d8f45f390c
SHA1 c9c1831c859e5b041bab4aa29d0ca458dc2d469a
SHA512 0b29a92bf44836e1a9c3e9924a16fe450158a88cab6c5e4566298504bb38c0408e4dee41df2df12953a98bc248186cdcc4686cb4059cc1412d62010faeafcf4b
TLSH
T11631B89271111449C4E1B6BB67B18733134EB2C33884F9BC70C8DDAC749F56FAAA51E9
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/2548-286-0x0000020F2E920000-0x0000020F2E9D2000-memory.dmp

Download

memory/3328-329-0x0000000003190000-0x00000000031AA000-memory.dmp

Download

memory/3328-328-0x0000000000B70000-0x0000000000BB0000-memory.dmp

Download

memory/3328-352-0x000000000FB10000-0x000000000FE1A000-memory.dmp

Download

memory/3328-351-0x00000000092C0000-0x000000000949E000-memory.dmp

Download

memory/3328-345-0x00000000056B0000-0x00000000056E0000-memory.dmp

Download

memory/3328-330-0x00000000058A0000-0x00000000059FA000-memory.dmp

Download

memory/4440-268-0x00007FFCF3230000-0x00007FFCF3BD4000-memory.dmp

Download

memory/4440-267-0x00007FFCF3230000-0x00007FFCF3BD4000-memory.dmp

Download

memory/4440-274-0x000002555FF40000-0x000002555FFF2000-memory.dmp

Download

memory/4440-270-0x00007FFCF3230000-0x00007FFCF3BD4000-memory.dmp

Download

memory/4440-269-0x00007FFCF3230000-0x00007FFCF3BD4000-memory.dmp

Download

memory/4440-280-0x00007FFCF3230000-0x00007FFCF3BD4000-memory.dmp

Download

memory/4440-279-0x00007FFCF3230000-0x00007FFCF3BD4000-memory.dmp

Download

memory/4440-260-0x00007FFCF33BF000-0x00007FFCF33C0000-memory.dmp

Download

memory/4440-277-0x0000025560250000-0x0000025560274000-memory.dmp

Download

memory/4440-275-0x000002555FCB0000-0x000002555FCBA000-memory.dmp

Download

memory/4440-276-0x0000025560250000-0x000002556027A000-memory.dmp

Download

memory/4440-266-0x00007FFCF3230000-0x00007FFCF3BD4000-memory.dmp

Download

memory/4440-265-0x0000025547AD0000-0x0000025547AF2000-memory.dmp

Download

memory/4440-262-0x00007FFCF3230000-0x00007FFCF3BD4000-memory.dmp

Download

memory/4440-261-0x00007FFCF3230000-0x00007FFCF3BD4000-memory.dmp

Download

memory/4440-273-0x000002555FCC0000-0x000002555FCDE000-memory.dmp

Download

memory/4492-293-0x0000021DE9DC0000-0x0000021DE9E72000-memory.dmp

Download