7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Resubmissions

31/08/2026, 11:13

260831-nbfeksszfy7

31/08/2026, 10:59

260831-m3k9gazgma3

Analysis

max time kernel
149s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260831-nbfeksszfy
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
5852	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1416	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5332	powershell.exe
3144	powershell.exe
5428	powershell.exe
1144	powershell.exe
4724	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2852	cmd.exe
4032	cmd.exe
5972	cmd.exe
3704	cmd.exe
5856	cmd.exe
5136	cmd.exe
1936	cmd.exe
3960	cmd.exe
4576	cmd.exe
4916	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\LuceneNet.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\LuceneNet.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\YeCjHlKDf.t9g:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\LuceneNet.Compile.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\Shared.props:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5332	powershell.exe
5332	powershell.exe
3144	powershell.exe
3144	powershell.exe
5428	powershell.exe
5428	powershell.exe
1144	powershell.exe
1144	powershell.exe
4724	powershell.exe
4724	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5332	powershell.exe
Token: SeIncreaseQuotaPrivilege	5332	powershell.exe
Token: SeSecurityPrivilege	5332	powershell.exe
Token: SeTakeOwnershipPrivilege	5332	powershell.exe
Token: SeLoadDriverPrivilege	5332	powershell.exe
Token: SeSystemProfilePrivilege	5332	powershell.exe
Token: SeSystemtimePrivilege	5332	powershell.exe
Token: SeProfSingleProcessPrivilege	5332	powershell.exe
Token: SeIncBasePriorityPrivilege	5332	powershell.exe
Token: SeCreatePagefilePrivilege	5332	powershell.exe
Token: SeBackupPrivilege	5332	powershell.exe
Token: SeRestorePrivilege	5332	powershell.exe
Token: SeShutdownPrivilege	5332	powershell.exe
Token: SeDebugPrivilege	5332	powershell.exe
Token: SeSystemEnvironmentPrivilege	5332	powershell.exe
Token: SeRemoteShutdownPrivilege	5332	powershell.exe
Token: SeUndockPrivilege	5332	powershell.exe
Token: SeManageVolumePrivilege	5332	powershell.exe
Token: 33	5332	powershell.exe
Token: 34	5332	powershell.exe
Token: 35	5332	powershell.exe
Token: 36	5332	powershell.exe
Token: SeIncreaseQuotaPrivilege	5332	powershell.exe
Token: SeSecurityPrivilege	5332	powershell.exe
Token: SeTakeOwnershipPrivilege	5332	powershell.exe
Token: SeLoadDriverPrivilege	5332	powershell.exe
Token: SeSystemProfilePrivilege	5332	powershell.exe
Token: SeSystemtimePrivilege	5332	powershell.exe
Token: SeProfSingleProcessPrivilege	5332	powershell.exe
Token: SeIncBasePriorityPrivilege	5332	powershell.exe
Token: SeCreatePagefilePrivilege	5332	powershell.exe
Token: SeBackupPrivilege	5332	powershell.exe
Token: SeRestorePrivilege	5332	powershell.exe
Token: SeShutdownPrivilege	5332	powershell.exe
Token: SeDebugPrivilege	5332	powershell.exe
Token: SeSystemEnvironmentPrivilege	5332	powershell.exe
Token: SeRemoteShutdownPrivilege	5332	powershell.exe
Token: SeUndockPrivilege	5332	powershell.exe
Token: SeManageVolumePrivilege	5332	powershell.exe
Token: 33	5332	powershell.exe
Token: 34	5332	powershell.exe
Token: 35	5332	powershell.exe
Token: 36	5332	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeIncreaseQuotaPrivilege	3144	powershell.exe
Token: SeSecurityPrivilege	3144	powershell.exe
Token: SeTakeOwnershipPrivilege	3144	powershell.exe
Token: SeLoadDriverPrivilege	3144	powershell.exe
Token: SeSystemProfilePrivilege	3144	powershell.exe
Token: SeSystemtimePrivilege	3144	powershell.exe
Token: SeProfSingleProcessPrivilege	3144	powershell.exe
Token: SeIncBasePriorityPrivilege	3144	powershell.exe
Token: SeCreatePagefilePrivilege	3144	powershell.exe
Token: SeBackupPrivilege	3144	powershell.exe
Token: SeRestorePrivilege	3144	powershell.exe
Token: SeShutdownPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeSystemEnvironmentPrivilege	3144	powershell.exe
Token: SeRemoteShutdownPrivilege	3144	powershell.exe
Token: SeUndockPrivilege	3144	powershell.exe
Token: SeManageVolumePrivilege	3144	powershell.exe
Token: 33	3144	powershell.exe
Token: 34	3144	powershell.exe
Token: 35	3144	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5696	Setup.exe
5696	Setup.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5696 wrote to memory of 3960	5696	Setup.exe	88
PID 5696 wrote to memory of 2852	5696	Setup.exe	90
PID 5696 wrote to memory of 4032	5696	Setup.exe	92
PID 5696 wrote to memory of 5972	5696	Setup.exe	94
PID 5972 wrote to memory of 5332	5972	cmd.exe	96
PID 5696 wrote to memory of 3704	5696	Setup.exe	98
PID 3704 wrote to memory of 3144	3704	cmd.exe	100
PID 5696 wrote to memory of 5856	5696	Setup.exe	101
PID 5856 wrote to memory of 5428	5856	cmd.exe	103
PID 5696 wrote to memory of 5136	5696	Setup.exe	104
PID 5136 wrote to memory of 1144	5136	cmd.exe	106
PID 5696 wrote to memory of 4576	5696	Setup.exe	107
PID 4576 wrote to memory of 4724	4576	cmd.exe	109
PID 5696 wrote to memory of 5852	5696	Setup.exe	110
PID 5852 wrote to memory of 3980	5852	forfiles.exe	111
PID 3980 wrote to memory of 3420	3980	cmd.exe	113
PID 3980 wrote to memory of 3904	3980	cmd.exe	114
PID 3980 wrote to memory of 1936	3980	cmd.exe	115
PID 1936 wrote to memory of 3304	1936	cmd.exe	116
PID 1936 wrote to memory of 5032	1936	cmd.exe	117
PID 3980 wrote to memory of 5436	3980	cmd.exe	118
PID 5436 wrote to memory of 4916	5436	conhost.exe	119
PID 4916 wrote to memory of 4612	4916	cmd.exe	120
PID 4916 wrote to memory of 1416	4916	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:2852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4724
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0 /m YeCjHlKDf.t9g /c "cmd /c ren @file YeCjHlKDf.bat && call YeCjHlKDf.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "YeCjHlKDf.t9g" YeCjHlKDf.bat && call YeCjHlKDf.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3420
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:3904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1936
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:3304
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:5032
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\YeCjHlKDf.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5436
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\YeCjHlKDf.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4916
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4612
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\LuceneNet.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1812905877267a9e72f29a9a73e73eae25a7891e90b0b65f94b33315eeb56f38
MD5 0da4cf8507c44279decd998740b945e6
SHA1 5d7f15588e5007679659b51f63f6c70348655195
SHA512 fbba117ce4626da5ecb68ee5cf780182a081a24ba283d2f20fe4a646c5650e036c70b79f80f663e328de9e99cd646a01c88e41965651a4f9c8da44d4eb5e9780
TLSH
T1BA317937B3DC8610CC99003A10CDAC1036BAC7DB90DEDF9B6B80E255A92F699CF50150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2baf2c738582443484244a1f5af85f849275d173ee307424e60722bd894fb7df
MD5 6a7c58f0bb73ec477d2d6cb24296c2c7
SHA1 b0275b7ebbd7ecc89f7059a0f183e277e6f4d94e
SHA512 29c76ac4d1a33db2509d3967b4a04b139532a0c3234d4aa3820f9b9bc0c76422eae14774a7a5f2dcf364d51712632e0ea73972f0bfd077832dd71beecaeb3a12
TLSH
T164217633B3DC8214C899403A10DDAC1036B687DB40DECF9B6B81E159A42F698CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ec614a7c5ac7ec1982022267339782fc997db0fd9d1bac671aebdd9cf31da260
MD5 50303ad6a922c8b90d880184eae365dc
SHA1 508c4c1512283b476f9b261bea8ef1ebe3757dbc
SHA512 ffe213c1041b6591da5e32916145c7a950a8086c5aba31003d05ea12c7190edd3c595a84fb3a9e3b4bdfb445b4e13fc4316c2d61672c640b345c19e82926279b
TLSH
T197219833F3DC8224DC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8371c38815bc3797e03aa83fe7879b36328fac93eee0d24beef26599f01cad35
MD5 04b2fea930bf1ee8150f749824352ab8
SHA1 d9ceb667e0aa1f7be93925da60ca2377d796c20f
SHA512 9511c63ea14e02fb925f2d03e6e4f77a2012bc805e546542ef31ddcf14c6832d4e4cfbe7029b7f72438a64f816b20a254eeab9a5be40828247e8c9fe707e1b7c
TLSH
T14F216837F3DC8214C8AA403A10DDAD5436B6CBDB40DECF5B6B85E159A42F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_i5pbnfv3.lfx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i5pbnfv3.lfx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1788181393.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1788181393.tmp
Size 1KB
SHA256 7e535e3e364ed820bc5abd3de7bf725bb15103ecd410a4c78b8a465d5bd0295f
MD5 5d819747dc97b1a9580cac80fab96a76
SHA1 09b5dafd772d2eb53f9c4337740df2bbf572a7b4
SHA512 772a1a8f969433b50cdc988c647a0687b69d3934c17316ec53177fdc64c1e2bcc27f8c90cbfdee92c93688a12acbf55de1a0c3339d1e43b38baf3c77c3842bec
TLSH
T12A310A7E97650B00014D1C47C0D822EB37E496C5A5EDC43E483BEE1E6A4988CC1146EE
MD5 SHA1 SHA512 TLSH

Submit Download

LuceneNet.Compile.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\LuceneNet.Compile.targets
Size 810KB
SHA256 04babcc3a60fa230b1c967c2a9087bf0698c145b2efd7a52660de09d4a33fe22
MD5 1f49d7e3feb185f5c705e817eb04a217
SHA1 aad803e6c53e0565c7d4f06ef2d29d11555e5071
SHA512 bb43156c253a086614069dd20928227b61aed43520ddbb554f991186fb3b5782eeb8759361229c234ae2319c6129913fa8a2b31f2846bd4488169cbc369fbd55
SSDEEP 6144:OtToy+Z9TjTfuOXO/8AG+pZytGi+6niPx+NFm/jC9TPLGOI1sObibkFYJglB:TTjTfbOJG0ytGi+6nYT
TLSH
T1B6053EB495DF60A0F2AF841136FC7EB5457231C79BDA2A64436CE1009BF9FA63E4948C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuceneNet.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\LuceneNet.csproj
Size 15.7MB
SHA256 505af03480e6953bd6b128ee73edd912b611af0102b4a65f876b03ded14a62db
MD5 66416c83c443d75ef5ec3ce88fe2873a
SHA1 b1d7b1e20f2105608b97c4b8bc8fe16eb99dfa6e
SHA512 6135b468c02b7979485261ca03383fc87e7061243f8e4089a39e441ade20501a997a9fe3f35cc628ea0d41a76e7fc79269006e27e763b0cbe867161f7bc8a012
SSDEEP 1536:B76qD8AYUBaG2EsYffrrU2DmbOznQVtBSP1N/NnjPE2eEZKmnmbLvyY0LwYLHQMA:FW
TLSH
T144F69A75038057A2E2CC67C0446B2D5E66B9FA6639242380FF732BBEDC19BC79879507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuceneNet.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\LuceneNet.csproj.user
Size 502KB
SHA256 51052970a1cf44602942138499f27b73d41d9bdb4aa668f5d14bef79819ee607
MD5 5eeae1b6626b48b2884a9e409fd38d05
SHA1 cb2d17dc252ed8e28726d75f39c5a74d7136065c
SHA512 d270a48bb294deb360e70ed06e571f184ae472895df856e1889c77ee8b3a2535ddde1a186eeaf710e133def47ad4388dd31ec4dec7311254b0620eac260951ed
SSDEEP 6144:of20RhTQ4by0WEmJBlcVi38P8TUAC1Z4+TSkA86FF+ZIX:CI3dL
TLSH
T193B490F0D99E11B2E38BD9413ABCBE6881F27193DBCB355857B9E3158F69B126B0400D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shared.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\Shared.props
Size 127KB
SHA256 bf930e72a15f60672042229790dd36a096002e8dc2363b7ea3504e392671b086
MD5 ef4b3db603215a5dd71ed2eb24c12cea
SHA1 ce51ed59cb0252a369a0811f64cf93493755af90
SHA512 c99b8c35efe613440c3f3d7111cd88465573040112eee60b7538375e77f21957d3a10e64c846b615e8c9dcd11183b02a3a813615aef7e4faf415242e6e3051c4
SSDEEP 1536:UR60WeMBxS/Vru3k+Ev32b1Iq6aCNXytKyMlpxgfboD4:+3ru3kU11apxOEE
TLSH
T1F6D390F1D99E11B0E24B9940266CB96845F271D3AFCA346C33B6F3828FA5F227B0554D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shared.props:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\Shared.props:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

YeCjHlKDf.t9g

Path C:\Users\Admin\AppData\Local\Temp\tmp-49022-02YyvhlcUpR0\YeCjHlKDf.t9g
Size 1KB
SHA256 d32e6f9e75b29495e325de7f9e1e7c5c7fab8d94d5df5053e1e12d8a6e5ea7e4
MD5 c8b1fbc3f0693c486cecf05d5b9d5e78
SHA1 b4274a956eecba9f9277ea9520adc68028204f0e
SHA512 7583ffefccad1f958a41e118db6e86c70650e7ebabd3c6e0bc4607b9940a324e101355876f518f8a30e5cdc6861c27b5a3744649984003575ce33db260d63177
TLSH
T16531BB92B0210459C4B172BB27B54233235DA2C33884F5BC70C8DDAC749F56FAA951E9
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/1416-327-0x0000000008630000-0x00000000086E8000-memory.dmp

Download

memory/1416-319-0x0000000000EF0000-0x0000000000F30000-memory.dmp

Download

memory/1416-320-0x0000000003380000-0x000000000339A000-memory.dmp

Download

memory/1416-321-0x0000000005C10000-0x0000000005D6A000-memory.dmp

Download

memory/1416-322-0x0000000005A30000-0x0000000005A60000-memory.dmp

Download

memory/1416-351-0x0000000010D70000-0x00000000112BC000-memory.dmp

Download

memory/1416-353-0x0000000011760000-0x000000001185A000-memory.dmp

Download

memory/3144-286-0x000001EA51F30000-0x000001EA51FE2000-memory.dmp

Download

memory/5332-260-0x00007FF906E7F000-0x00007FF906E80000-memory.dmp

Download

memory/5332-280-0x00007FF906CF0000-0x00007FF907694000-memory.dmp

Download

memory/5332-279-0x00007FF906CF0000-0x00007FF907694000-memory.dmp

Download

memory/5332-277-0x00007FF906CF0000-0x00007FF907694000-memory.dmp

Download

memory/5332-275-0x000002DF1AB60000-0x000002DF1AB8A000-memory.dmp

Download

memory/5332-276-0x000002DF1AB60000-0x000002DF1AB84000-memory.dmp

Download

memory/5332-274-0x000002DF1A5E0000-0x000002DF1A5EA000-memory.dmp

Download

memory/5332-273-0x000002DF1A950000-0x000002DF1AA02000-memory.dmp

Download

memory/5332-272-0x000002DF1A5F0000-0x000002DF1A60E000-memory.dmp

Download

memory/5332-269-0x00007FF906CF0000-0x00007FF907694000-memory.dmp

Download

memory/5332-268-0x00007FF906CF0000-0x00007FF907694000-memory.dmp

Download

memory/5332-267-0x00007FF906CF0000-0x00007FF907694000-memory.dmp

Download

memory/5332-266-0x00007FF906CF0000-0x00007FF907694000-memory.dmp

Download

memory/5332-265-0x00007FF906CF0000-0x00007FF907694000-memory.dmp

Download

memory/5332-264-0x00007FF906CF0000-0x00007FF907694000-memory.dmp

Download

memory/5332-263-0x000002DF1A5A0000-0x000002DF1A5C2000-memory.dmp

Download