7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260818-3adxpaaq4v
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
1860	forfiles.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4328	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4144	powershell.exe
768	powershell.exe
4204	powershell.exe
5940	powershell.exe
2580	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2340	cmd.exe
4316	cmd.exe
4400	cmd.exe
6076	cmd.exe
928	cmd.exe
5940	cmd.exe
4600	cmd.exe
4100	cmd.exe
5624	cmd.exe
2696	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\Internal.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\MicrosoftDataEdm.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\xXdGgI4ZU.jf:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\MicrosoftDataEdm.Compile.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\MicrosoftDataEdm.csproj.user:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4144	powershell.exe
4144	powershell.exe
4144	powershell.exe
768	powershell.exe
768	powershell.exe
768	powershell.exe
4204	powershell.exe
4204	powershell.exe
4204	powershell.exe
5940	powershell.exe
5940	powershell.exe
5940	powershell.exe
2580	powershell.exe
2580	powershell.exe
2580	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeIncreaseQuotaPrivilege	4144	powershell.exe
Token: SeSecurityPrivilege	4144	powershell.exe
Token: SeTakeOwnershipPrivilege	4144	powershell.exe
Token: SeLoadDriverPrivilege	4144	powershell.exe
Token: SeSystemProfilePrivilege	4144	powershell.exe
Token: SeSystemtimePrivilege	4144	powershell.exe
Token: SeProfSingleProcessPrivilege	4144	powershell.exe
Token: SeIncBasePriorityPrivilege	4144	powershell.exe
Token: SeCreatePagefilePrivilege	4144	powershell.exe
Token: SeBackupPrivilege	4144	powershell.exe
Token: SeRestorePrivilege	4144	powershell.exe
Token: SeShutdownPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeSystemEnvironmentPrivilege	4144	powershell.exe
Token: SeRemoteShutdownPrivilege	4144	powershell.exe
Token: SeUndockPrivilege	4144	powershell.exe
Token: SeManageVolumePrivilege	4144	powershell.exe
Token: 33	4144	powershell.exe
Token: 34	4144	powershell.exe
Token: 35	4144	powershell.exe
Token: 36	4144	powershell.exe
Token: SeIncreaseQuotaPrivilege	4144	powershell.exe
Token: SeSecurityPrivilege	4144	powershell.exe
Token: SeTakeOwnershipPrivilege	4144	powershell.exe
Token: SeLoadDriverPrivilege	4144	powershell.exe
Token: SeSystemProfilePrivilege	4144	powershell.exe
Token: SeSystemtimePrivilege	4144	powershell.exe
Token: SeProfSingleProcessPrivilege	4144	powershell.exe
Token: SeIncBasePriorityPrivilege	4144	powershell.exe
Token: SeCreatePagefilePrivilege	4144	powershell.exe
Token: SeBackupPrivilege	4144	powershell.exe
Token: SeRestorePrivilege	4144	powershell.exe
Token: SeShutdownPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeSystemEnvironmentPrivilege	4144	powershell.exe
Token: SeRemoteShutdownPrivilege	4144	powershell.exe
Token: SeUndockPrivilege	4144	powershell.exe
Token: SeManageVolumePrivilege	4144	powershell.exe
Token: 33	4144	powershell.exe
Token: 34	4144	powershell.exe
Token: 35	4144	powershell.exe
Token: 36	4144	powershell.exe
Token: SeDebugPrivilege	768	powershell.exe
Token: SeIncreaseQuotaPrivilege	768	powershell.exe
Token: SeSecurityPrivilege	768	powershell.exe
Token: SeTakeOwnershipPrivilege	768	powershell.exe
Token: SeLoadDriverPrivilege	768	powershell.exe
Token: SeSystemProfilePrivilege	768	powershell.exe
Token: SeSystemtimePrivilege	768	powershell.exe
Token: SeProfSingleProcessPrivilege	768	powershell.exe
Token: SeIncBasePriorityPrivilege	768	powershell.exe
Token: SeCreatePagefilePrivilege	768	powershell.exe
Token: SeBackupPrivilege	768	powershell.exe
Token: SeRestorePrivilege	768	powershell.exe
Token: SeShutdownPrivilege	768	powershell.exe
Token: SeDebugPrivilege	768	powershell.exe
Token: SeSystemEnvironmentPrivilege	768	powershell.exe
Token: SeRemoteShutdownPrivilege	768	powershell.exe
Token: SeUndockPrivilege	768	powershell.exe
Token: SeManageVolumePrivilege	768	powershell.exe
Token: 33	768	powershell.exe
Token: 34	768	powershell.exe
Token: 35	768	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1672	Setup.exe
1672	Setup.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 5940	1672	Setup.exe	89
PID 1672 wrote to memory of 2340	1672	Setup.exe	91
PID 1672 wrote to memory of 4316	1672	Setup.exe	93
PID 1672 wrote to memory of 4600	1672	Setup.exe	95
PID 4600 wrote to memory of 4144	4600	cmd.exe	97
PID 1672 wrote to memory of 4100	1672	Setup.exe	99
PID 4100 wrote to memory of 768	4100	cmd.exe	101
PID 1672 wrote to memory of 4400	1672	Setup.exe	102
PID 4400 wrote to memory of 4204	4400	cmd.exe	104
PID 1672 wrote to memory of 5624	1672	Setup.exe	105
PID 5624 wrote to memory of 5940	5624	cmd.exe	107
PID 1672 wrote to memory of 2696	1672	Setup.exe	108
PID 2696 wrote to memory of 2580	2696	cmd.exe	110
PID 1672 wrote to memory of 1860	1672	Setup.exe	111
PID 1860 wrote to memory of 2260	1860	forfiles.exe	112
PID 2260 wrote to memory of 2504	2260	cmd.exe	114
PID 2260 wrote to memory of 6108	2260	cmd.exe	115
PID 2260 wrote to memory of 6076	2260	cmd.exe	116
PID 6076 wrote to memory of 3132	6076	cmd.exe	117
PID 6076 wrote to memory of 1772	6076	cmd.exe	118
PID 2260 wrote to memory of 3176	2260	cmd.exe	119
PID 3176 wrote to memory of 928	3176	conhost.exe	120
PID 928 wrote to memory of 2164	928	cmd.exe	121
PID 928 wrote to memory of 4328	928	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:2340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2580
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN /m xXdGgI4ZU.jf /c "cmd /c ren @file xXdGgI4ZU.bat && call xXdGgI4ZU.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "xXdGgI4ZU.jf" xXdGgI4ZU.bat && call xXdGgI4ZU.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2504
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:6108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6076
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:3132
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:1772
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\xXdGgI4ZU.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3176
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\xXdGgI4ZU.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:928
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2164
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\MicrosoftDataEdm.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 52c3278fd60a3fa44f4491584a21a403090cfe12204f9e4b7f45f40e7d10f9b3
MD5 ebebd4ee9e273954a351a240d6b7a5d3
SHA1 87dfcd8ea5bc34269e6b2b325ba1e3b4f1ea5f97
SHA512 dd00237be24baaae5556304bd9b26d35a4ab8adbd884f8f4cb25f92697aa4a63aa55d0ede1ecc8b56f1646047402a714a378ea47644e45a9a4ca14d78fdec405
TLSH
T17B318637F3DC8611CC9A003A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3df75c17e5a3827f5113fa799c9608770027869d92fcc1eb797b0a62243c7f05
MD5 1256cc6d2e9365f8ad868d1680b50ffb
SHA1 20ff8eea591b2c2a3292087a88072744a7cfd9b1
SHA512 835853ccc61e4e6b2f1917d29af576df6fe7b8ba682c4f4c2166d10a88e7ee7fc27d4067214ce83b5ce5cad09f0113607aee6252155e7411375f90af1a278b19
TLSH
T185219833F3DC8214CC99403A10DDAC1036B6C7CB40DECF9B6B85E159A42F299CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b1227e9b98f726cd9c0a236b648a27ef5b15391c873d18a28af10eb0a560ae94
MD5 01bbf4cd6f56727e18e9ca41ff3b09df
SHA1 cc3823ac66b59b4305eecbb09833da58a1e51805
SHA512 2f6e42d2620e3651c136ecf8d7d8827b6a201df46167f1f1de197e81c01eebd9aae7a85765c226c114bb08ab7bbca6e5bad61c0ff75ff2bdb03cbe4ca94a56e7
TLSH
T12A219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f916075ccf4073a18383b78278ce7314465bfca8b1a3e536e423e33a8f791c16
MD5 5d498fa4aa3c42d31dbff1bb5838ffad
SHA1 551cff960c3dc385c3ee185c2024fb03d47d8d78
SHA512 75c96b82a7a49feeceb1869e5f972192257f95290dd65dd9c92d6132175ad077b7d9305f35061bf2748cb7069e5ce40fa7e152befbaa5800e0180c416ffb9dc6
TLSH
T15D219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qgs3l4rx.amo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qgs3l4rx.amo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1787095760.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1787095760.tmp
Size 1KB
SHA256 94ece3004784574f202fc0a040dfbc3dbe546989fb04a8baf162f7bbba3ce918
MD5 592aea200cfa8f8635bfe5125075d407
SHA1 3b3b03ba3820b4c6a2975dbcef1f0b69b5e2c290
SHA512 78bc8cf38c747043858a038df255c6cb8764dabcc6fbd5d0a55b6cea2102309562b1e3824bf105264f51fac3038941f0eec945b24f38e0b877ba141393ab1cef
TLSH
T1D2313878AB8AB5BF2AD8FF1532280032912E1AE0C4F22664C9F7BA005942230865D317
MD5 SHA1 SHA512 TLSH

Submit Download

Internal.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\Internal.props
Size 281KB
SHA256 b08a2d67f5d4081842196746dd66094d98c8c2c571b4ed7e59a2698c7ac3fd97
MD5 675f734681f1737a8cdde38968cde32c
SHA1 701bb08b69e5909e53745f03748d8292a6e92ebc
SHA512 e6274689cb7e5473a878e0d2e63d5412c95538b04e921a7f49df2c37c449eb6da298c6a7ee78cb4a70d706846f7187a76ac8312adb5cf6e8505225f9fccc6930
SSDEEP 1536:L2yF4dBXBkRSVYKXS7RzupPjKq2Vvg/sSXIo77wkTtUYfIoyi1q4INdgLC0DaTLz:7sXkK6YRhn5ZdGhAm
TLSH
T13C54CE744ACE0075E3DBC82039ADBE7051B339CBDAE62D5503EDE5211B6CE732B59A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftDataEdm.Compile.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\MicrosoftDataEdm.Compile.targets
Size 520KB
SHA256 3846b3524c2424aca30ecbdce42f267d9fa3f824658595e0837beb80a9d61d71
MD5 bfd53280ae4491ac00f82d649f585d00
SHA1 54f932f739f94421448aac5d45b753aba2a07707
SHA512 847af890124de9a910464bf862262494669c225ddcbbfb1c717b3d2347578afb4c4e0def8d2e032bace82fdf2c9f6a182628af51c75fb4e0bdb6444f17b55291
SSDEEP 1536:D5/a42JGfs9lbOwSawOtGDICIvVorFC0BXYijdnxiC1s6TjNo3BUCWlJaavryUf2:DmEkoZkN2Wmmy+vtr/cTT0eAU/G
TLSH
T116B4B0ACA6CB95B4FA6F412275AC3D051432328B57C62FA0C7BCE114D6E6BC93E494CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftDataEdm.Compile.targets:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\MicrosoftDataEdm.Compile.targets:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

MicrosoftDataEdm.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\MicrosoftDataEdm.csproj
Size 9.6MB
SHA256 94f4e956973043a5833cedabaa2496e6f4c9434ee079f84f2d2284241557c582
MD5 0c42c6eab3a91170b0e76520c74870a5
SHA1 7acf78aaab1780a1bebd02dc1bf2d826ee121656
SHA512 a2193f59c0d94ab640e620e560e4996a51143b772242abf9c1c7dca612c9c4e6465fd2a78ca599e82a9bf72ff54e186b54e0babdeecd41adfdaecd2015424874
SSDEEP 1536:rXrVgGAabjLvNtEJAF4B3Cp4QzDSauGpeMzShhZS3BtGlDxAJRE1wLDUDG34oi0l:D
TLSH
T1ADA6027B078047BBF3D44BC0846B215E26F9E165B9253199AB736DEFBC1A8D74038A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftDataEdm.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\MicrosoftDataEdm.csproj.user
Size 527KB
SHA256 ee4f2c0a32331555f1a840caa159749028ccc37cfc5e43d7249fe586bc2910cb
MD5 597d8e85b4e0e7f7f81a5f81eef0e9fa
SHA1 cbd91f4038551daf103d70d1a7aaf75eba3f321d
SHA512 f8c6a8e825b597a12c61f5866156b693edd9588452a91cc19e9b66f98fe81457f368fcf297c67e1bc38158c41fd46785999a68f70ed0b817bd0f79e90a4ffdc2
SSDEEP 6144:MLRr13aJrZgl7NDgOGCOh//pJdL91N/lgWO2fJSXUKnbo4t4ieOmPjqu76IhgAJV:2Gr4gniSZ
TLSH
T156B4E5F895AF20A4F29BD90029BCBD6441B131C79BCA366423BDE255DFE9B663F4004D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xXdGgI4ZU.jf

Path C:\Users\Admin\AppData\Local\Temp\tmp-12185-kxPher1gfLyN\xXdGgI4ZU.jf
Size 1KB
SHA256 cfd3ece279261f8f1e3bf68c3ea07d05848fd1a14290970c9ffa43c6a7dd8915
MD5 1ed97a89e30ae8bd738154945151f568
SHA1 6ac6f600a7f0a38e95d2150b891b8f66eb85996a
SHA512 624c51c5763c92dd3f29307a24b0e3a63c1a3019b6226d3e967187045aec848554e6289112a3d3ab9453d549ae5a4df4923d4c0f8cdbfd0d9849b30354bf51d7
TLSH
T1F831DD87B0110409C4B172BB67B18333235EA2C33880F9BC70D8DDA8749F1AFA6A51E8
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/4144-273-0x0000026068A00000-0x0000026068A1E000-memory.dmp

Download

memory/4144-267-0x00007FF932870000-0x00007FF933214000-memory.dmp

Download

memory/4144-280-0x00007FF932870000-0x00007FF933214000-memory.dmp

Download

memory/4144-276-0x0000026069020000-0x000002606904A000-memory.dmp

Download

memory/4144-277-0x0000026069020000-0x0000026069044000-memory.dmp

Download

memory/4144-275-0x0000026068AE0000-0x0000026068AEA000-memory.dmp

Download

memory/4144-261-0x00007FF932870000-0x00007FF933214000-memory.dmp

Download

memory/4144-274-0x0000026068A20000-0x0000026068AD2000-memory.dmp

Download

memory/4144-260-0x00007FF9329FF000-0x00007FF932A00000-memory.dmp

Download

memory/4144-270-0x00007FF932870000-0x00007FF933214000-memory.dmp

Download

memory/4144-269-0x00007FF932870000-0x00007FF933214000-memory.dmp

Download

memory/4144-268-0x00007FF932870000-0x00007FF933214000-memory.dmp

Download

memory/4144-265-0x00007FF932870000-0x00007FF933214000-memory.dmp

Download

memory/4144-264-0x0000026068980000-0x00000260689A2000-memory.dmp

Download

memory/4144-266-0x00007FF932870000-0x00007FF933214000-memory.dmp

Download

memory/4144-279-0x00007FF932870000-0x00007FF933214000-memory.dmp

Download

memory/4204-292-0x0000028B70D60000-0x0000028B70E12000-memory.dmp

Download

memory/4328-330-0x0000000003310000-0x0000000003340000-memory.dmp

Download

memory/4328-329-0x0000000005990000-0x0000000005AEA000-memory.dmp

Download

memory/4328-328-0x0000000003120000-0x000000000313A000-memory.dmp

Download

memory/4328-327-0x0000000000D50000-0x0000000000D90000-memory.dmp

Download

memory/4328-350-0x0000000009370000-0x000000000941A000-memory.dmp

Download

memory/4328-351-0x0000000011B50000-0x0000000011E78000-memory.dmp

Download

memory/4328-352-0x000000000B610000-0x000000000B696000-memory.dmp

Download