7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260905-e9x8lswhqb
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
3068	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
964	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3588	powershell.exe
4164	powershell.exe
4832	powershell.exe
5280	powershell.exe
2084	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4176	cmd.exe
6120	cmd.exe
2480	cmd.exe
4276	cmd.exe
5952	cmd.exe
3392	cmd.exe
2620	cmd.exe
4404	cmd.exe
4868	cmd.exe
1588	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\Iced.Build.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\Iced.Build.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\Iced.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\Iced.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\SmZxsZUHA.4ae:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5280	powershell.exe
5280	powershell.exe
2084	powershell.exe
2084	powershell.exe
3588	powershell.exe
3588	powershell.exe
4164	powershell.exe
4164	powershell.exe
4832	powershell.exe
4832	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5280	powershell.exe
Token: SeIncreaseQuotaPrivilege	5280	powershell.exe
Token: SeSecurityPrivilege	5280	powershell.exe
Token: SeTakeOwnershipPrivilege	5280	powershell.exe
Token: SeLoadDriverPrivilege	5280	powershell.exe
Token: SeSystemProfilePrivilege	5280	powershell.exe
Token: SeSystemtimePrivilege	5280	powershell.exe
Token: SeProfSingleProcessPrivilege	5280	powershell.exe
Token: SeIncBasePriorityPrivilege	5280	powershell.exe
Token: SeCreatePagefilePrivilege	5280	powershell.exe
Token: SeBackupPrivilege	5280	powershell.exe
Token: SeRestorePrivilege	5280	powershell.exe
Token: SeShutdownPrivilege	5280	powershell.exe
Token: SeDebugPrivilege	5280	powershell.exe
Token: SeSystemEnvironmentPrivilege	5280	powershell.exe
Token: SeRemoteShutdownPrivilege	5280	powershell.exe
Token: SeUndockPrivilege	5280	powershell.exe
Token: SeManageVolumePrivilege	5280	powershell.exe
Token: 33	5280	powershell.exe
Token: 34	5280	powershell.exe
Token: 35	5280	powershell.exe
Token: 36	5280	powershell.exe
Token: SeIncreaseQuotaPrivilege	5280	powershell.exe
Token: SeSecurityPrivilege	5280	powershell.exe
Token: SeTakeOwnershipPrivilege	5280	powershell.exe
Token: SeLoadDriverPrivilege	5280	powershell.exe
Token: SeSystemProfilePrivilege	5280	powershell.exe
Token: SeSystemtimePrivilege	5280	powershell.exe
Token: SeProfSingleProcessPrivilege	5280	powershell.exe
Token: SeIncBasePriorityPrivilege	5280	powershell.exe
Token: SeCreatePagefilePrivilege	5280	powershell.exe
Token: SeBackupPrivilege	5280	powershell.exe
Token: SeRestorePrivilege	5280	powershell.exe
Token: SeShutdownPrivilege	5280	powershell.exe
Token: SeDebugPrivilege	5280	powershell.exe
Token: SeSystemEnvironmentPrivilege	5280	powershell.exe
Token: SeRemoteShutdownPrivilege	5280	powershell.exe
Token: SeUndockPrivilege	5280	powershell.exe
Token: SeManageVolumePrivilege	5280	powershell.exe
Token: 33	5280	powershell.exe
Token: 34	5280	powershell.exe
Token: 35	5280	powershell.exe
Token: 36	5280	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeIncreaseQuotaPrivilege	2084	powershell.exe
Token: SeSecurityPrivilege	2084	powershell.exe
Token: SeTakeOwnershipPrivilege	2084	powershell.exe
Token: SeLoadDriverPrivilege	2084	powershell.exe
Token: SeSystemProfilePrivilege	2084	powershell.exe
Token: SeSystemtimePrivilege	2084	powershell.exe
Token: SeProfSingleProcessPrivilege	2084	powershell.exe
Token: SeIncBasePriorityPrivilege	2084	powershell.exe
Token: SeCreatePagefilePrivilege	2084	powershell.exe
Token: SeBackupPrivilege	2084	powershell.exe
Token: SeRestorePrivilege	2084	powershell.exe
Token: SeShutdownPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeSystemEnvironmentPrivilege	2084	powershell.exe
Token: SeRemoteShutdownPrivilege	2084	powershell.exe
Token: SeUndockPrivilege	2084	powershell.exe
Token: SeManageVolumePrivilege	2084	powershell.exe
Token: 33	2084	powershell.exe
Token: 34	2084	powershell.exe
Token: 35	2084	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6104	Setup.exe
6104	Setup.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 6104 wrote to memory of 4404	6104	Setup.exe	89
PID 6104 wrote to memory of 2480	6104	Setup.exe	91
PID 6104 wrote to memory of 4868	6104	Setup.exe	93
PID 6104 wrote to memory of 1588	6104	Setup.exe	95
PID 1588 wrote to memory of 5280	1588	cmd.exe	97
PID 6104 wrote to memory of 4276	6104	Setup.exe	99
PID 4276 wrote to memory of 2084	4276	cmd.exe	101
PID 6104 wrote to memory of 5952	6104	Setup.exe	102
PID 5952 wrote to memory of 3588	5952	cmd.exe	104
PID 6104 wrote to memory of 4176	6104	Setup.exe	105
PID 4176 wrote to memory of 4164	4176	cmd.exe	107
PID 6104 wrote to memory of 3392	6104	Setup.exe	108
PID 6104 wrote to memory of 3068	6104	Setup.exe	111
PID 3068 wrote to memory of 676	3068	forfiles.exe	112
PID 676 wrote to memory of 4344	676	cmd.exe	114
PID 676 wrote to memory of 4112	676	cmd.exe	115
PID 676 wrote to memory of 6120	676	cmd.exe	116
PID 6120 wrote to memory of 3316	6120	cmd.exe	117
PID 6120 wrote to memory of 3960	6120	cmd.exe	118
PID 676 wrote to memory of 4820	676	cmd.exe	119
PID 4820 wrote to memory of 2620	4820	conhost.exe	120
PID 2620 wrote to memory of 5360	2620	cmd.exe	121
PID 2620 wrote to memory of 964	2620	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  PID:3392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4832
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV /m SmZxsZUHA.4ae /c "cmd /c ren @file SmZxsZUHA.bat && call SmZxsZUHA.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "SmZxsZUHA.4ae" SmZxsZUHA.bat && call SmZxsZUHA.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:676
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4344
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:4112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6120
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:3316
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:3960
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\SmZxsZUHA.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\SmZxsZUHA.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2620
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5360
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\Iced.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dc2792f062d276c3a6c95202b5d40b7db678fc5e67e7be45890b62eccbdd2b33
MD5 2b5b9a7e9f9855dc264a676d2dce0c4e
SHA1 2dcd1444e248fee74a0c176cfbdbb80d20efaaa2
SHA512 ffbcf4624dd138466dffc151f9f4d1b5c21e5a5d23efd6c25fa11b9f6ad72a68a9cf5371469443747898cae7929e915dfce891e52321708f11fa57c8b5bb0535
TLSH
T19A317437F3DC8611CC9A013A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8568a1191e4edfee5388a7ae28aa31e134b3eba004a310b9accc86eb04e69bac
MD5 80c331afb63d87c98ed103d34580d3ca
SHA1 c1de060c260e9dfc0dc195d6d6f5f00427bd665d
SHA512 b5f96e1d498e9de02bde709d6df931d21c4e3f2deaa28e90a6ef77fd1a64350801058bf0828b9d78aabf4a6aff8f2568ee97bd66f2f960f5faf28efd9d9e1fd1
TLSH
T1F9217637F3DC8214C899403A10DDAC1036B687DB40DECF9B6B81E159A42F299CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4f5a192ee7a093453ab6cd376ea03e565419e6274a42fbd78026e4eefe46b178
MD5 55d9497de18df5e0ec0727271a6763ed
SHA1 43daf19107c9b3457d2f74cc317aa0780dd90da7
SHA512 d50a50ade3cf02b670a348f118e984df097796f1db2773ef2e8754ca1e6030fba838062f3764832c0290381d7cd7552cd450698eb233bdcced6bffd4fdbcd9bf
TLSH
T150217633B3DC8224C899013A10DDAC1036B687CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 be52e912bc94652847fc1474658a173db5618a083241907fa2672935cbb8600b
MD5 6335f2f754718404275c24d13f36decb
SHA1 b432c9e363009727524dd19ddcecb3ee47c762f2
SHA512 624c972271f17f14eedf04e4ddae313f750d846a8a5799773f3ef4b3e76cb0fbaf192d61b34c283c192e97a125e87bec18520b1e94b58e2395d4fad701717c81
TLSH
T10E217633F3DC8224CC99013A10DDAC1036B687CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_o5zaamo2.yoa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o5zaamo2.yoa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1788583347.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1788583347.tmp
Size 1KB
SHA256 2f6057866604a67f4fb820eec0295e4f5477ae3d5e2f96992007a616bb076c00
MD5 5c275929d89cfadbf7b4b4e70f54ac5f
SHA1 7ad45e5527ea8f0e369bf23a237dc85dcb0b0cd2
SHA512 ebd64809c53d0655ef4703f55bbf92c9c700db14141ca1aef727315e2c029448f8b8a266dc9812e5c0d4c824ceb2ee0d3f1745dadd57eb327b3960b3c2d9538e
TLSH
T17331EACF54C69F1C1556F5ECC4B08878041761D4D8599E175690F52DB2C314B1A8AD60
MD5 SHA1 SHA512 TLSH

Submit Download

Iced.Build.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\Iced.Build.props
Size 916KB
SHA256 6e6e21c914594183b9fae67c8bed16df41bb382e655b0f6306cf4bff85249dc8
MD5 473f9d2983a6a03047efe1111997c4e5
SHA1 88ac99139da55883a0db7a14f78c45341ad3e7b5
SHA512 fe43e326cc78c661f4532fcc4a4f56bd2f08b3724d446fd77afa61e9052cedb31b31f64243e6ace950a42e4f8b0dc3a2a5993b06101110e87acd2da85777f2d6
SSDEEP 6144:eI3nsImB9FUVWWQ0AEMhimMSK5f+rA9ISnp/H4MhUDeuga0sTzpqxUzxco6F7taP:WIOdVn6t1rNYP
TLSH
T1F315FBF4BCEF14A5E29BC980A6BCFE7505F271D3EBCA5D140B69B6450B98B513E8090C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iced.Build.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\Iced.Build.targets
Size 1.9MB
SHA256 006f48ca30cec99459392dcd9710d51f473a8a772f5d632dca00e8052acd9d49
MD5 d922b55984364484076433c17b5d2b41
SHA1 4287a1c55693554dadb7d8242fa6b8a1d08bed73
SHA512 dc37030655f572887c696a5f9855f902dd547afd589086c819767083f8c4c6b824ca70d429ebd50e4c54e7054cfcce1d13a5dc9c2e5d67e14b07f795587be2d7
SSDEEP 6144:k/Mt0hgBSiu873YDQ+j96D+1ZfhIsb0M+6wgTNDI+/dT/OpePEMcJafgttHF8HWF:k/Mt0hgBSI73YDFj9Ugv+v+/dT/Ro
TLSH
T17195BFB805EF4861F2DB842457FCBE65507332D7A7D53D94032EA9800BA9B663E25E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iced.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\Iced.csproj
Size 14.2MB
SHA256 5c742489e8a5a9e9294af3af8e2f5a952b5bba5224b181928e86a009fe26c1b6
MD5 343bcc79764339ed83dab48b8ecfb0e2
SHA1 d4ad7c0c4657b9db6905968eab12e4f56d3d0d7c
SHA512 5efa2b0577c8058e8a5505d3b09448488d438b7fd352cbc3e882bbb55bbf948515969fbbc4ec4e35263657d5f1e260404d1c2caf14433d0a43d773e2772c2048
SSDEEP 1536:gKRrfPPjyDcSo0ai/IHnfQDxjfwq4pn/CJcRppsybCWz0TQc4WoOHJZvPADudwnO:4
TLSH
T11BE6CE75038057A6E2CC6BC4446B299E26B9F66239242394FF733BBEDC19BC79874107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iced.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\Iced.csproj.user
Size 955KB
SHA256 cd589ca7704598a769c461715a2f8cc877514b36aeb36e77a258cdae53df7bcf
MD5 6843983c5fd0766cd9f6298e1c1196cd
SHA1 76f59be138b98945703b17ea698d09d93973f98e
SHA512 64fefa1b916bbf2bbb9a07572374f39ddbe62e7a90300cc29fceede0aac7d5bfb5eca6c22bc6acc3567695ad2a8c8cd7a1d0cd288a7af07f33d662796149c31d
SSDEEP 1536:CiVRYdtrikG6BR7Y9qSmexlWRNHX2ql20vzY1hpTbhEdWpLXAhsmcza+9W6piXe5:6VWpLXDsKWJYVLVfdTZ
TLSH
T1062504F49DFDA468D62B49A03D9CFBB910B5B0D757CC572843B163A046A8A27BF41C0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmZxsZUHA.4ae

Path C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\SmZxsZUHA.4ae
Size 1KB
SHA256 a82cff83f1c13a349995f13c46ea468088db1c15456848c602791787e8b744be
MD5 8501ebfd8379c3ddadd76d3fa81a1fd3
SHA1 a09d28048a37d3793dc7bff36a70548e3f4a662c
SHA512 58fa3b91be65aca8cdfba01ad777ad144e1884f8b5f4ec1278510b2a718fa1bfde5852b102542d73a1701bf387e0dec0eeaf69e3993cd6d77d25a65f5ee4e8ed
TLSH
T14131979671211409C4E1A27B67B18333235EA2833884F9BC71C8D9A8749F17EAA951E9
MD5 SHA1 SHA512 TLSH

Submit Download

SmZxsZUHA.4ae:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-11543-zdE7SSvcbtIV\SmZxsZUHA.4ae:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/964-350-0x0000000004FC0000-0x0000000004FF0000-memory.dmp

Download

memory/964-334-0x00000000050B0000-0x000000000520A000-memory.dmp

Download

memory/964-333-0x0000000004EE0000-0x0000000004EFA000-memory.dmp

Download

memory/964-332-0x0000000000470000-0x00000000004B0000-memory.dmp

Download

memory/964-355-0x0000000008BB0000-0x0000000008D8E000-memory.dmp

Download

memory/964-356-0x000000000BE00000-0x000000000C2A0000-memory.dmp

Download

memory/2084-291-0x0000018455080000-0x0000018455132000-memory.dmp

Download

memory/5280-275-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download

memory/5280-260-0x00007FF9C1CBF000-0x00007FF9C1CC0000-memory.dmp

Download

memory/5280-280-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download

memory/5280-283-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download

memory/5280-282-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download

memory/5280-281-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download

memory/5280-277-0x0000022CD7CB0000-0x0000022CD7CDA000-memory.dmp

Download

memory/5280-279-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download

memory/5280-278-0x0000022CD7CB0000-0x0000022CD7CD4000-memory.dmp

Download

memory/5280-273-0x0000022CD7F20000-0x0000022CD7FD2000-memory.dmp

Download

memory/5280-276-0x0000022CBF870000-0x0000022CBF87A000-memory.dmp

Download

memory/5280-285-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download

memory/5280-274-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download

memory/5280-272-0x0000022CD7C60000-0x0000022CD7C7E000-memory.dmp

Download

memory/5280-269-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download

memory/5280-268-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download

memory/5280-267-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download

memory/5280-266-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download

memory/5280-265-0x0000022CBF650000-0x0000022CBF672000-memory.dmp

Download

memory/5280-264-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download

memory/5280-261-0x00007FF9C1B30000-0x00007FF9C24D4000-memory.dmp

Download