7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260812-a4276aswcs
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
4304	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4900	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5612	powershell.exe
5844	powershell.exe
5376	powershell.exe
3268	powershell.exe
5284	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1912	cmd.exe
5760	cmd.exe
5560	cmd.exe
3564	cmd.exe
2004	cmd.exe
2776	cmd.exe
2836	cmd.exe
5024	cmd.exe
6016	cmd.exe
5048	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\BPgtO6m9z.60:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\MicrosoftDataEdm.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\MicrosoftDataEdm.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\Internal.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\MicrosoftDataEdm.csproj:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5612	powershell.exe
5612	powershell.exe
5844	powershell.exe
5844	powershell.exe
5376	powershell.exe
5376	powershell.exe
3268	powershell.exe
3268	powershell.exe
5284	powershell.exe
5284	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5612	powershell.exe
Token: SeIncreaseQuotaPrivilege	5612	powershell.exe
Token: SeSecurityPrivilege	5612	powershell.exe
Token: SeTakeOwnershipPrivilege	5612	powershell.exe
Token: SeLoadDriverPrivilege	5612	powershell.exe
Token: SeSystemProfilePrivilege	5612	powershell.exe
Token: SeSystemtimePrivilege	5612	powershell.exe
Token: SeProfSingleProcessPrivilege	5612	powershell.exe
Token: SeIncBasePriorityPrivilege	5612	powershell.exe
Token: SeCreatePagefilePrivilege	5612	powershell.exe
Token: SeBackupPrivilege	5612	powershell.exe
Token: SeRestorePrivilege	5612	powershell.exe
Token: SeShutdownPrivilege	5612	powershell.exe
Token: SeDebugPrivilege	5612	powershell.exe
Token: SeSystemEnvironmentPrivilege	5612	powershell.exe
Token: SeRemoteShutdownPrivilege	5612	powershell.exe
Token: SeUndockPrivilege	5612	powershell.exe
Token: SeManageVolumePrivilege	5612	powershell.exe
Token: 33	5612	powershell.exe
Token: 34	5612	powershell.exe
Token: 35	5612	powershell.exe
Token: 36	5612	powershell.exe
Token: SeIncreaseQuotaPrivilege	5612	powershell.exe
Token: SeSecurityPrivilege	5612	powershell.exe
Token: SeTakeOwnershipPrivilege	5612	powershell.exe
Token: SeLoadDriverPrivilege	5612	powershell.exe
Token: SeSystemProfilePrivilege	5612	powershell.exe
Token: SeSystemtimePrivilege	5612	powershell.exe
Token: SeProfSingleProcessPrivilege	5612	powershell.exe
Token: SeIncBasePriorityPrivilege	5612	powershell.exe
Token: SeCreatePagefilePrivilege	5612	powershell.exe
Token: SeBackupPrivilege	5612	powershell.exe
Token: SeRestorePrivilege	5612	powershell.exe
Token: SeShutdownPrivilege	5612	powershell.exe
Token: SeDebugPrivilege	5612	powershell.exe
Token: SeSystemEnvironmentPrivilege	5612	powershell.exe
Token: SeRemoteShutdownPrivilege	5612	powershell.exe
Token: SeUndockPrivilege	5612	powershell.exe
Token: SeManageVolumePrivilege	5612	powershell.exe
Token: 33	5612	powershell.exe
Token: 34	5612	powershell.exe
Token: 35	5612	powershell.exe
Token: 36	5612	powershell.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeIncreaseQuotaPrivilege	5844	powershell.exe
Token: SeSecurityPrivilege	5844	powershell.exe
Token: SeTakeOwnershipPrivilege	5844	powershell.exe
Token: SeLoadDriverPrivilege	5844	powershell.exe
Token: SeSystemProfilePrivilege	5844	powershell.exe
Token: SeSystemtimePrivilege	5844	powershell.exe
Token: SeProfSingleProcessPrivilege	5844	powershell.exe
Token: SeIncBasePriorityPrivilege	5844	powershell.exe
Token: SeCreatePagefilePrivilege	5844	powershell.exe
Token: SeBackupPrivilege	5844	powershell.exe
Token: SeRestorePrivilege	5844	powershell.exe
Token: SeShutdownPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeSystemEnvironmentPrivilege	5844	powershell.exe
Token: SeRemoteShutdownPrivilege	5844	powershell.exe
Token: SeUndockPrivilege	5844	powershell.exe
Token: SeManageVolumePrivilege	5844	powershell.exe
Token: 33	5844	powershell.exe
Token: 34	5844	powershell.exe
Token: 35	5844	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4172	Setup.exe
4172	Setup.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 6016	4172	Setup.exe	88
PID 4172 wrote to memory of 5048	4172	Setup.exe	90
PID 4172 wrote to memory of 1912	4172	Setup.exe	92
PID 4172 wrote to memory of 5760	4172	Setup.exe	94
PID 5760 wrote to memory of 5612	5760	cmd.exe	96
PID 4172 wrote to memory of 5560	4172	Setup.exe	98
PID 5560 wrote to memory of 5844	5560	cmd.exe	100
PID 4172 wrote to memory of 3564	4172	Setup.exe	101
PID 3564 wrote to memory of 5376	3564	cmd.exe	103
PID 4172 wrote to memory of 2776	4172	Setup.exe	104
PID 2776 wrote to memory of 3268	2776	cmd.exe	106
PID 4172 wrote to memory of 2004	4172	Setup.exe	107
PID 2004 wrote to memory of 5284	2004	cmd.exe	109
PID 4172 wrote to memory of 4304	4172	Setup.exe	110
PID 4304 wrote to memory of 3300	4304	forfiles.exe	111
PID 3300 wrote to memory of 4928	3300	cmd.exe	113
PID 3300 wrote to memory of 2760	3300	cmd.exe	114
PID 3300 wrote to memory of 2836	3300	cmd.exe	115
PID 2836 wrote to memory of 1740	2836	cmd.exe	116
PID 2836 wrote to memory of 5236	2836	cmd.exe	117
PID 3300 wrote to memory of 5896	3300	cmd.exe	118
PID 5896 wrote to memory of 5024	5896	conhost.exe	119
PID 5024 wrote to memory of 4468	5024	cmd.exe	120
PID 5024 wrote to memory of 4900	5024	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:6016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:1912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5284
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8 /m BPgtO6m9z.60 /c "cmd /c ren @file BPgtO6m9z.bat && call BPgtO6m9z.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "BPgtO6m9z.60" BPgtO6m9z.bat && call BPgtO6m9z.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4928
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:2760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:1740
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:5236
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\BPgtO6m9z.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5896
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\BPgtO6m9z.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5024
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4468
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\MicrosoftDataEdm.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 52c3278fd60a3fa44f4491584a21a403090cfe12204f9e4b7f45f40e7d10f9b3
MD5 ebebd4ee9e273954a351a240d6b7a5d3
SHA1 87dfcd8ea5bc34269e6b2b325ba1e3b4f1ea5f97
SHA512 dd00237be24baaae5556304bd9b26d35a4ab8adbd884f8f4cb25f92697aa4a63aa55d0ede1ecc8b56f1646047402a714a378ea47644e45a9a4ca14d78fdec405
TLSH
T17B318637F3DC8611CC9A003A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d3be88af67112f38cf5e050cee27e850f127c8dcfd004088ddd92fe3f1dacb3e
MD5 51adbfe14e9829847014c9398b58a4c1
SHA1 35549294cb3a50eee4949082195ba41ff4970401
SHA512 ef80bf230a356c7fcd8c74bc2621268ff8ad259d94ce479d8879b2fbb41e6e7104681b6943f6186904f8776f16f014620bf0d2102b818e5e4cedab311e74f389
TLSH
T1E3219833F3DC8214CC99403A10DDAC1036B6C7CB40DECF9B6B81E159A42F299CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 606ea2b5e0c803bcb6a4ba52e8df9cc72ff66158225b17ee1303a69cfd694910
MD5 68a920aadf415dbad5b78eafec154340
SHA1 928537ba764a652a3622507248683ffddba3fe4a
SHA512 ac723094adaee2791de662e04fb4ae9b6a90c96a88c5e005e6f54bb5210b4e1bddcdc415069aef7e75ad02ee36e71b40249679d12c3fe9ed8e027a48f2973aef
TLSH
T138219837F3DC8214CCA9003A10DDAD0036B6CBCB40DECF5B6B81E159A42F298CFA0060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 719467140ac68a2adc3b08fec73d91e75b1170afaef74f18c0b6956d453b670a
MD5 efb13eb02dac996dba39425e2e38219d
SHA1 8392e4b3cdf86b730c17a7e0fe3295713ba9feb4
SHA512 af5d9a40e5d667bfc9bf4b16fc5c729646f09ac2ea0c8e5a44744ae8c42ae97f2f215cd3ba52b9986209e88e385daa08139e88e5e48f6760bb2c699ac24c3f5f
TLSH
T1D7219833F3DC8224CC99413A10DDAC1036B6C7CB40DECF9B6B81E159A82F698DF61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5m4zqua3.0ea.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5m4zqua3.0ea.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1786495828.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1786495828.tmp
Size 1KB
SHA256 e98c8c39f3bf9546bed8975fa3d454c2a48ae478a06d568918697028ffe98f03
MD5 63bbb45ad2a46f19776e1b7910d15d9d
SHA1 ae1dcb5c813d19fea6328c9d0654085e3222e29c
SHA512 9414fc761f2628f882f24388b5d4d24c3f1cd0f2e9b535df72ec88bbc7d5a44f72344208484c79ec5dc96ed403514ba656dd16adf0c0c345a6504de5b901cc35
TLSH
T11231C8BC9754D68A8ACCA271880053C980A1869C957A36E6A460996FF2B6ACD0B8021F
MD5 SHA1 SHA512 TLSH

Submit Download

BPgtO6m9z.60

Path C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\BPgtO6m9z.60
Size 1KB
SHA256 fa20e3430b3517121caf9c0cbb752661e92aabc92877e62e06c5ffac6c6627b3
MD5 0d8a3c03bcc157761d44492c0b4346a1
SHA1 3852adbe7bc399774ab09fcb74380ca77e029cae
SHA512 1f69fb6e5d2d2520fcc213132a6dfb839a0ba256778e5379b1239896cf5eb43235441b0523074fe360730dd0b91e4073cf590206e9a442feb5e20e2e226733fc
TLSH
T1B931CF86B0150449C4F1727B67B18733135EA2D33884F9BC70C8DDAC749F16FAA951E8
MD5 SHA1 SHA512 TLSH

Submit Download

Internal.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\Internal.props
Size 113KB
SHA256 9be8b46c7d50fbdba9936debe1a8c43b0516cc3f084b5608258b1d9866842c16
MD5 91727e2bcda8c7ed852f46832197349a
SHA1 010461d1196c0bdd126a27061d6e1fc1de12c15f
SHA512 fa4381b6486db5587b681f33d2ebece9ab8556f13f0b1128093747a7600c1e022089a722f9b711bc68b424c6e8df9d9054832bc74123fa6942e5446b0706f4f7
SSDEEP 1536:8kj4rYF65MfIUHaYNiGIdZpoyp1/kf4Pq2yQANrO1YVtApEeiid3kVK8z94eKF1+:uZXLgI+
TLSH
T1D2B3F43885DE40A5E3DFC8142DAEBF71117335DBEBEA6950036DE4210A7CDB72E89909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftDataEdm.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\MicrosoftDataEdm.csproj
Size 9.3MB
SHA256 270d202e6153d3e838f9abf564787f2486324d177997cf487306d225dc4459b1
MD5 5f65819d06c82cd1ce700cc63a57412e
SHA1 c4cb21c8e7cd5152e5f33ee5e0c4a15a056e562f
SHA512 01255ce5b30286fa7c67c3ffb5751964cbeadf0aaca512f685202eb212d0de9936df99fd441bad20739cd3876b5d817789ea8619ebce9d101cc934583e77db8e
SSDEEP 1536:Ulw0l4IzgU2+UCrRZzsZRNGwPd0X1J1Ah5x9gEr8d/nQoZc4W8Rl+kpIQj1DB50Y:M
TLSH
T1D3A6CF7A078047BAF3D447C0845B255E36F8E155BA282159AB7369FFBC2E9DBC038643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftDataEdm.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\MicrosoftDataEdm.csproj.user
Size 483KB
SHA256 fe93eb356f192c12924d876bcb30d867fdccf7f9eef9492b6f6e47c69e982cb8
MD5 164daa5b5486c67f156a87f029b38854
SHA1 37bcbd30918565de7127c74db409c1cf57299fb0
SHA512 223fb50f9ebeb8b44f80d1c5af426d13699e62278f9f736d4958de865220336277e12859a169e5e7f5d9196a5b86b1b8430a3aeafef7ab6beaaf1aed5dce8161
SSDEEP 6144:l2rewJH69aL6mhg69lE7vOI8D9I1C+2QjLOFMR5jIstONd1LRDIPM1JGbvlTBCeR:lagX
TLSH
T1C9B4E2F895AF20A4F257D90029BCBE6481B131C79BCA3A6423BDE255DFE9B563F4004D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftDataEdm.csproj.user:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\MicrosoftDataEdm.csproj.user:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

MicrosoftDataEdm.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-85280-WPZThTsHTnr8\MicrosoftDataEdm.targets
Size 728KB
SHA256 6539465b053db434d10a6bcf5e368a774d9c06de8ab394083c1efbcf5b563704
MD5 6f4946a85ef5930f7797cbf85264a970
SHA1 0e8c4a0bd62dc871053b8fe09ef5bc2dc972d5f5
SHA512 aeb112044968ffb9243257d5facda57a4cab3f65c4e91826762a9eb18ded15384fb599e32c9ffc5026469249da57ff9eb3fd76a4a671231e3f56348d836b8ee5
SSDEEP 3072:R9bWtkpNgOqeI5XBZFt/Wrmy+SX/c/T0e57B7:3GgWFtermy+SX/c/T0ev
TLSH
T1C3F4DD7896CB50B4FAAF851135AC7D111172318B97CA2EA0877CE100DBEAFDA3F5948D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/4900-331-0x0000000004EA0000-0x0000000004EBA000-memory.dmp

Download

memory/4900-330-0x0000000000430000-0x0000000000470000-memory.dmp

Download

memory/4900-332-0x0000000005060000-0x00000000051BA000-memory.dmp

Download

memory/4900-333-0x0000000004F70000-0x0000000004FA0000-memory.dmp

Download

memory/4900-352-0x0000000008B70000-0x0000000008C1A000-memory.dmp

Download

memory/4900-355-0x00000000112A0000-0x00000000115AC000-memory.dmp

Download

memory/4900-356-0x0000000012190000-0x0000000012216000-memory.dmp

Download

memory/5376-295-0x0000020AAF050000-0x0000020AAF102000-memory.dmp

Download

memory/5612-272-0x00007FFC70B10000-0x00007FFC714B4000-memory.dmp

Download

memory/5612-260-0x00007FFC70C9F000-0x00007FFC70CA0000-memory.dmp

Download

memory/5612-282-0x00007FFC70B10000-0x00007FFC714B4000-memory.dmp

Download

memory/5612-281-0x00007FFC70B10000-0x00007FFC714B4000-memory.dmp

Download

memory/5612-278-0x00000153E0DB0000-0x00000153E0DDA000-memory.dmp

Download

memory/5612-279-0x00000153E0DB0000-0x00000153E0DD4000-memory.dmp

Download

memory/5612-277-0x00000153E0D70000-0x00000153E0D7A000-memory.dmp

Download

memory/5612-276-0x00000153E0E00000-0x00000153E0EB2000-memory.dmp

Download

memory/5612-275-0x00000153C8C40000-0x00000153C8C5E000-memory.dmp

Download

memory/5612-261-0x00007FFC70B10000-0x00007FFC714B4000-memory.dmp

Download

memory/5612-271-0x00007FFC70B10000-0x00007FFC714B4000-memory.dmp

Download

memory/5612-270-0x00007FFC70B10000-0x00007FFC714B4000-memory.dmp

Download

memory/5612-269-0x00007FFC70B10000-0x00007FFC714B4000-memory.dmp

Download

memory/5612-268-0x00007FFC70B10000-0x00007FFC714B4000-memory.dmp

Download

memory/5612-267-0x00007FFC70B10000-0x00007FFC714B4000-memory.dmp

Download

memory/5612-266-0x00007FFC70B10000-0x00007FFC714B4000-memory.dmp

Download

memory/5612-263-0x00000153C8B90000-0x00000153C8BB2000-memory.dmp

Download

memory/5612-262-0x00007FFC70B10000-0x00007FFC714B4000-memory.dmp

Download

memory/5844-288-0x000001C760830000-0x000001C7608E2000-memory.dmp

Download