7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
148s
max time network
105s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260824-cb864sck3x
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
2520	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
600	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5960	powershell.exe
2892	powershell.exe
5600	powershell.exe
1392	powershell.exe
1376	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4776	cmd.exe
1224	cmd.exe
5040	cmd.exe
2708	cmd.exe
800	cmd.exe
3348	cmd.exe
3572	cmd.exe
2540	cmd.exe
5744	cmd.exe
1960	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\Common.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\LuceneNet.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\U4FA4N3h2.rt:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\LuceneNet.Common.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\LuceneNet.csproj:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1392	powershell.exe
1392	powershell.exe
1376	powershell.exe
1376	powershell.exe
5960	powershell.exe
5960	powershell.exe
2892	powershell.exe
2892	powershell.exe
5600	powershell.exe
5600	powershell.exe
5600	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeIncreaseQuotaPrivilege	1392	powershell.exe
Token: SeSecurityPrivilege	1392	powershell.exe
Token: SeTakeOwnershipPrivilege	1392	powershell.exe
Token: SeLoadDriverPrivilege	1392	powershell.exe
Token: SeSystemProfilePrivilege	1392	powershell.exe
Token: SeSystemtimePrivilege	1392	powershell.exe
Token: SeProfSingleProcessPrivilege	1392	powershell.exe
Token: SeIncBasePriorityPrivilege	1392	powershell.exe
Token: SeCreatePagefilePrivilege	1392	powershell.exe
Token: SeBackupPrivilege	1392	powershell.exe
Token: SeRestorePrivilege	1392	powershell.exe
Token: SeShutdownPrivilege	1392	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeSystemEnvironmentPrivilege	1392	powershell.exe
Token: SeRemoteShutdownPrivilege	1392	powershell.exe
Token: SeUndockPrivilege	1392	powershell.exe
Token: SeManageVolumePrivilege	1392	powershell.exe
Token: 33	1392	powershell.exe
Token: 34	1392	powershell.exe
Token: 35	1392	powershell.exe
Token: 36	1392	powershell.exe
Token: SeIncreaseQuotaPrivilege	1392	powershell.exe
Token: SeSecurityPrivilege	1392	powershell.exe
Token: SeTakeOwnershipPrivilege	1392	powershell.exe
Token: SeLoadDriverPrivilege	1392	powershell.exe
Token: SeSystemProfilePrivilege	1392	powershell.exe
Token: SeSystemtimePrivilege	1392	powershell.exe
Token: SeProfSingleProcessPrivilege	1392	powershell.exe
Token: SeIncBasePriorityPrivilege	1392	powershell.exe
Token: SeCreatePagefilePrivilege	1392	powershell.exe
Token: SeBackupPrivilege	1392	powershell.exe
Token: SeRestorePrivilege	1392	powershell.exe
Token: SeShutdownPrivilege	1392	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeSystemEnvironmentPrivilege	1392	powershell.exe
Token: SeRemoteShutdownPrivilege	1392	powershell.exe
Token: SeUndockPrivilege	1392	powershell.exe
Token: SeManageVolumePrivilege	1392	powershell.exe
Token: 33	1392	powershell.exe
Token: 34	1392	powershell.exe
Token: 35	1392	powershell.exe
Token: 36	1392	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeIncreaseQuotaPrivilege	1376	powershell.exe
Token: SeSecurityPrivilege	1376	powershell.exe
Token: SeTakeOwnershipPrivilege	1376	powershell.exe
Token: SeLoadDriverPrivilege	1376	powershell.exe
Token: SeSystemProfilePrivilege	1376	powershell.exe
Token: SeSystemtimePrivilege	1376	powershell.exe
Token: SeProfSingleProcessPrivilege	1376	powershell.exe
Token: SeIncBasePriorityPrivilege	1376	powershell.exe
Token: SeCreatePagefilePrivilege	1376	powershell.exe
Token: SeBackupPrivilege	1376	powershell.exe
Token: SeRestorePrivilege	1376	powershell.exe
Token: SeShutdownPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeSystemEnvironmentPrivilege	1376	powershell.exe
Token: SeRemoteShutdownPrivilege	1376	powershell.exe
Token: SeUndockPrivilege	1376	powershell.exe
Token: SeManageVolumePrivilege	1376	powershell.exe
Token: 33	1376	powershell.exe
Token: 34	1376	powershell.exe
Token: 35	1376	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5804	Setup.exe
5804	Setup.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5804 wrote to memory of 4776	5804	Setup.exe	88
PID 5804 wrote to memory of 1224	5804	Setup.exe	90
PID 5804 wrote to memory of 3348	5804	Setup.exe	92
PID 5804 wrote to memory of 3572	5804	Setup.exe	94
PID 3572 wrote to memory of 1392	3572	cmd.exe	96
PID 5804 wrote to memory of 2540	5804	Setup.exe	98
PID 2540 wrote to memory of 1376	2540	cmd.exe	100
PID 5804 wrote to memory of 5040	5804	Setup.exe	101
PID 5040 wrote to memory of 5960	5040	cmd.exe	103
PID 5804 wrote to memory of 2708	5804	Setup.exe	104
PID 2708 wrote to memory of 2892	2708	cmd.exe	106
PID 5804 wrote to memory of 5744	5804	Setup.exe	107
PID 5744 wrote to memory of 5600	5744	cmd.exe	109
PID 5804 wrote to memory of 2520	5804	Setup.exe	110
PID 2520 wrote to memory of 5044	2520	forfiles.exe	111
PID 5044 wrote to memory of 4788	5044	cmd.exe	113
PID 5044 wrote to memory of 5752	5044	cmd.exe	114
PID 5044 wrote to memory of 800	5044	cmd.exe	115
PID 800 wrote to memory of 4448	800	cmd.exe	116
PID 800 wrote to memory of 4764	800	cmd.exe	117
PID 5044 wrote to memory of 3680	5044	cmd.exe	118
PID 3680 wrote to memory of 1960	3680	conhost.exe	119
PID 1960 wrote to memory of 5384	1960	cmd.exe	120
PID 1960 wrote to memory of 600	1960	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:1224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5600
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA /m U4FA4N3h2.rt /c "cmd /c ren @file U4FA4N3h2.bat && call U4FA4N3h2.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "U4FA4N3h2.rt" U4FA4N3h2.bat && call U4FA4N3h2.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4788
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:5752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:800
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:4448
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:4764
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\U4FA4N3h2.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3680
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\U4FA4N3h2.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1960
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5384
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\LuceneNet.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c13b4f2d4cd022a37436dd07c44460047918ffcf0a4e65887c3e16e65fce69db
MD5 298634327e0e9e09deacf9833bad5da8
SHA1 8c074c66d9e2bd2daed501b27ba774bb87bb8422
SHA512 fd83477a1b404a072a5193cc482c3a226f3d0c8ddaef4b867b457674c35d0aa75c5620ae7d5b9fe6f64cb7155520f125eef7a0f8757c0c0b6e841b7932b15083
TLSH
T18E318637F3DC8611CC9A013A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d925c9547ad823fd3a23b0f03a71af15630621a2234c2e44c4600769b9175a51
MD5 b4c4d945883e985052324f9922dd3673
SHA1 dcd30f1048504fb95da8ea97d5a6e7d00b0dff2a
SHA512 69e6c37e81caa52d14d3f348e8f4b4f2b70a2b5bc650e8f6c718b0495abc39d4749c26391bba712bd21d3dbcd3881ca1902a2dad78dbb60a1a1d48a5be9ebbe1
TLSH
T117219833F3DC8214CC99403A10DDAC1036B6C7DB40DECF9B6B81E159A42F299CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 19c90abcf20d5430bc7b5f998f9904d61a0c46f7f8cb26bce631afef97f74145
MD5 7829bf69ffc9b5538fd6a8e44ef52f83
SHA1 7b21d24d3d5eba59f23e23d38094fc10fbbd27f7
SHA512 6ffdae8313e1ae95401b3929a7863f5124cb9d6425780e06a412df9bbd8801e5e8870043e85f8217e359a3df4207345e0549636f4b1790e51683cc0e6365209e
TLSH
T1B0217633B3DC8224C899013A10DDAC1036B687CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 76883026437bc4f8348f723a91a8f639ae6ff25210d0bd4fc8776c6a17aa21eb
MD5 a1d405e7830097227d796d31f2912627
SHA1 d7615cfe2358aedb4305ea3176f498e529bd2e06
SHA512 10eca26ad083f6b75088fa9368c886e5f156d7c349a4347fbfe586d419f3e8ba280998a3c3f8f50a6f3f213bf94c5c0f9333aef42d3d7fa650347adb090ec2d8
TLSH
T152219837F3DC8214CCA9003A10DDAD1036B6C7CB40DECF5B6B81E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lvdzk4mq.udd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lvdzk4mq.udd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1787536699.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1787536699.tmp
Size 1KB
SHA256 2a4bc7ca568597fe3c00bcc925a9377527f6164fb5a80295ab392745cef8e357
MD5 f7bd85308a9fb095c81db24f9eb0b500
SHA1 f9837d4e161d665081281691a1ec9abd8d873309
SHA512 5735ab1bd9909f678b01e0b7a3bb30ba8289e633b273f109899cb2a183e0628c56d5639ac68dd7f1998b60cf2808716d69c5f47e8f86b9ccac335be3e933ecae
TLSH
T1CB31F88DA329D5AC44549552D5812AE610232CA8C98300FD34B3960F81BDCDD13F17E2
MD5 SHA1 SHA512 TLSH

Submit Download

Common.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\Common.targets
Size 682KB
SHA256 57d52bdebbc635e356b6aa4761520928f339a214838ec1acf9a003489e8f7325
MD5 5ba87bddb0912e9befce75c3131e7d60
SHA1 b2228af04b43f5c5892cc21a3766e06416c0fee4
SHA512 eaf303326834820bca0eff7627e70154575e5da41c7b013185b545965778d7ae9d88d1e27859ad76ed265aae431998daa0baaa62f8a2075b43a89746f9078331
SSDEEP 6144:0nXkYfRE7GshotW+mlq+xgB3edbgF+spJ9rfVSr4p1sRbibkFYJtOv:mU7GkQKq+xgB3sf
TLSH
T114E41DB495DF50A0F6AF851076EC7EB4047731D7ABC62E60436CE1009BF9FA63E4A489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuceneNet.Common.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\LuceneNet.Common.props
Size 251KB
SHA256 ce779747a70c1c94ac200c1028a1de8409c0a8c6f9daa6875ea7cdd76a3720db
MD5 d638a35c722b5da376832a4f95bc5d7c
SHA1 451a33ad2c751b1825e81e76b3d01b2d8f3b4e9f
SHA512 c3a082d52961ca2b457d36600e710c7dae86bbeeb25a1d364d5322234c3b4fd2e75dc3f0bae723a68d74639b7183edea4d41ef6f2e3f4b912abecc49398204fd
SSDEEP 1536:FgwGxdt11c8h0166FzlmJmgu2gXuLuRFvvjRIj8LLDSK3ETyGB8ii1xNsdkajZj4:aWUINwu5zV3EORTox7LnLZjwb483/1
TLSH
T14C44C0F0D9AE1171E24BDD45267CBE6846F2B5C3DFCA315C33AAE3518F65B226A0844C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuceneNet.Common.props:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\LuceneNet.Common.props:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

LuceneNet.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\LuceneNet.csproj
Size 8.9MB
SHA256 94453fff7d2debdadcc9dd4f98f887c2605fdb3484329dda6044fe6bb3b19aee
MD5 178d746b75542fac37bd404a637c257f
SHA1 31dcae1eac3b15af103ac3608dc40b1e0d29d29a
SHA512 6d4842e39c4941099cba7b7d96fc9ab8178ad112da9d613d51f839fc9e781f56714ab81f156062ee265f8d1f7fe3b7a8627105c95a7bf5a493242d3fd8da5d1e
SSDEEP 1536:2zvWbc3qZF/EzICPI0isD5p4qpukQ5LY/8N5NPeR4FHEW2ag8P8+fafbKcGYP1YM:O
TLSH
T11396BF7F078087BAF3D447C0881B241E26F9E515BA65315AB77369EF7C2A8DB8078613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuceneNet.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\LuceneNet.csproj.user
Size 498KB
SHA256 8d2b5c3ad24b0dcc40a9ccb7b3fcd7dad23c8a89802ce4e8d26a01493956a192
MD5 a4d4242269c018840d215cc1161f3ae2
SHA1 dde17c47344047a43070fc45d57bb6fc09538d69
SHA512 e43a6c8ffa3c914389f9d022ebbf452efe82b7c773c0cad92637c2298a8644bc037e92931b6fae825c38ddc5b31465cca465687d2efc7d0e05a8c6faf3539117
SSDEEP 6144:xZu8WEIzFwRAVDK1RgvYisCmi0Fkzo0Hdk9:nuoRnijo
TLSH
T128B4AFF0E99E11B2E38BD94137BCBE6841F271839BCB355857BAE3558F69B126B0400D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

U4FA4N3h2.rt

Path C:\Users\Admin\AppData\Local\Temp\tmp-80761-zE59NHD8tspA\U4FA4N3h2.rt
Size 1KB
SHA256 6a00c8be91e63fbb32613b5e228fc67bf39e431e23959c1c1e9e6581f39b3f6a
MD5 08063b9593501ab3b7ecd2f74906cec3
SHA1 f4b78626661468cbdc949d9b373647c949d33d78
SHA512 372aefc8a774d53b5a6f8f3d86377a8a35277dee0c422b0b2266697beef9adb0c5e87439c02d4cc7102a2144b9abffcb01159d57751835b4c6284c99cb185c50
TLSH
T19831CC97B4220409C4F1B2BB67B54233134DA2C33884F8BD70C8DDAC749F56FAA952E8
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/600-336-0x0000000004DF0000-0x0000000004F4A000-memory.dmp

Download

memory/600-335-0x00000000026E0000-0x00000000026FA000-memory.dmp

Download

memory/600-334-0x0000000000150000-0x0000000000190000-memory.dmp

Download

memory/600-352-0x0000000004C90000-0x0000000004CC0000-memory.dmp

Download

memory/600-353-0x0000000004DA0000-0x0000000004DB8000-memory.dmp

Download

memory/600-358-0x00000000088D0000-0x0000000008988000-memory.dmp

Download

memory/600-359-0x00000000052B0000-0x000000000559A000-memory.dmp

Download

memory/600-361-0x0000000012CC0000-0x0000000012DC2000-memory.dmp

Download

memory/600-362-0x0000000012DD0000-0x0000000012E3E000-memory.dmp

Download

memory/1376-293-0x00000262C76E0000-0x00000262C7792000-memory.dmp

Download

memory/1392-273-0x00007FFE8E2C0000-0x00007FFE8EC64000-memory.dmp

Download

memory/1392-286-0x00007FFE8E2C0000-0x00007FFE8EC64000-memory.dmp

Download

memory/1392-287-0x00007FFE8E2C0000-0x00007FFE8EC64000-memory.dmp

Download

memory/1392-282-0x000001387F330000-0x000001387F354000-memory.dmp

Download

memory/1392-284-0x000001387DB00000-0x000001387DB08000-memory.dmp

Download

memory/1392-283-0x000001387F320000-0x000001387F334000-memory.dmp

Download

memory/1392-281-0x000001387F330000-0x000001387F35A000-memory.dmp

Download

memory/1392-280-0x000001387DB00000-0x000001387DB0A000-memory.dmp

Download

memory/1392-279-0x0000013818720000-0x00000138187D2000-memory.dmp

Download

memory/1392-278-0x00000138183F0000-0x000001381840E000-memory.dmp

Download

memory/1392-275-0x000001387DAF0000-0x000001387DAFA000-memory.dmp

Download

memory/1392-274-0x000001387DAE0000-0x000001387DAEA000-memory.dmp

Download

memory/1392-260-0x00007FFE8E44F000-0x00007FFE8E450000-memory.dmp

Download

memory/1392-272-0x00007FFE8E2C0000-0x00007FFE8EC64000-memory.dmp

Download

memory/1392-271-0x00007FFE8E2C0000-0x00007FFE8EC64000-memory.dmp

Download

memory/1392-270-0x00007FFE8E2C0000-0x00007FFE8EC64000-memory.dmp

Download

memory/1392-269-0x000001387F910000-0x000001387FA12000-memory.dmp

Download

memory/1392-268-0x00007FFE8E2C0000-0x00007FFE8EC64000-memory.dmp

Download

memory/1392-267-0x000001387DAD0000-0x000001387DAE0000-memory.dmp

Download

memory/1392-266-0x00007FFE8E2C0000-0x00007FFE8EC64000-memory.dmp

Download

memory/1392-265-0x000001387F2D0000-0x000001387F2F2000-memory.dmp

Download

memory/1392-261-0x000001387F360000-0x000001387F3E2000-memory.dmp

Download

memory/1392-262-0x00007FFE8E2C0000-0x00007FFE8EC64000-memory.dmp

Download