85768b4e5c7305817141cdd6118d4f7f81c724214b6f9febe0cba486f96d9ab9

Resubmissions

24/10/2026, 02:47

261024-c91mmawx6l8

24/10/2026, 02:46

261024-c9kw6sht4k

24/10/2026, 02:24

261024-cvvstsfs6t7

Analysis

max time kernel
152s
max time network
187s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 2.1MB
Sample261024-cvvstsfs6t
SHA256 85768b4e5c7305817141cdd6118d4f7f81c724214b6f9febe0cba486f96d9ab9
MD5 7fa301994fa86180f0ee01081fccd20b
SHA1 779f9d64003aab3005b77a9f23700e37169ea849
SHA512 9f0a826321c66a340fd47c88cfb6c32a8fd9b19be3f023780c952f6d59b0f5aa6225313ae1372cfc8cac3c87be94457a26e85fa7ed7b1d734b25445ec9fb6d17
SSDEEP 49152:MqeNV26ezLPYArt9uD9SAbIrAbF0b61a8RHDt8gR6:ZEUPIOjuDUlrWUg8R
TLSH
T15BA5D03FB268653ED9AE0B3245B39350997BBB61A41B8C2E47F0094CCF665701F3BA15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral4/files/0x000c00000001c5dd-19.dat	acprotect
behavioral4/files/0x000d00000001c5c5-85.dat	acprotect
behavioral4/files/0x000c00000001c5f1-230.dat	acprotect

Executes dropped EXE 28 IoCs

pid	Process
4280	Setup.tmp
4656	MTX64.exe
5384	RZ.exe
4632	RZ.exe
4412	RZ.exe
3728	RZ.exe
3740	CLS-SREP_NEW_x64.exe
3088	MTX64.exe
1448	RZ.exe
1076	RZ.exe
3924	RZ.exe
2064	RZ.exe
4516	CLS-SREP_NEW_x64.exe
1340	XTool.exe
4448	MTX64.exe
5928	RZ.exe
1420	RZ.exe
2168	RZ.exe
5672	RZ.exe
5564	CLS-LOLZ_x64.exe
3592	CLS-SREP_NEW_x64.exe
5096	CLS-LOLZ_x64.exe
3156	CLS-SREP_NEW_x64.exe
6048	XTool.exe
1488	lzma_sdk.exe
1900	CLS-LOLZ_x64.exe
2140	CLS-SREP_NEW_x64.exe
3732	XTool.exe

Loads dropped DLL 26 IoCs

pid	Process
4280	Setup.tmp
4280	Setup.tmp
4280	Setup.tmp
4280	Setup.tmp
4280	Setup.tmp
4280	Setup.tmp
4280	Setup.tmp
4280	Setup.tmp
4280	Setup.tmp
4280	Setup.tmp
4280	Setup.tmp
4280	Setup.tmp
4280	Setup.tmp
4280	Setup.tmp
1340	XTool.exe
1340	XTool.exe
1340	XTool.exe
1340	XTool.exe
6048	XTool.exe
6048	XTool.exe
6048	XTool.exe
6048	XTool.exe
3732	XTool.exe
3732	XTool.exe
3732	XTool.exe
3732	XTool.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/0x000c00000001c5dd-19.dat	upx
behavioral4/memory/4280-23-0x0000000008F90000-0x0000000008FC1000-memory.dmp	upx
behavioral4/memory/4280-70-0x0000000008F90000-0x0000000008FC1000-memory.dmp	upx
behavioral4/files/0x000d00000001c5c5-85.dat	upx
behavioral4/memory/4280-87-0x0000000009510000-0x0000000009591000-memory.dmp	upx
behavioral4/memory/4280-86-0x0000000009510000-0x0000000009591000-memory.dmp	upx
behavioral4/files/0x000c00000001c5f1-230.dat	upx
behavioral4/memory/4280-242-0x0000000072B90000-0x0000000072DF9000-memory.dmp	upx
behavioral4/memory/4280-365-0x0000000009510000-0x0000000009591000-memory.dmp	upx
behavioral4/memory/4280-367-0x0000000072B90000-0x0000000072DF9000-memory.dmp	upx
behavioral4/memory/4280-436-0x0000000072B90000-0x0000000072DF9000-memory.dmp	upx
behavioral4/memory/4280-458-0x0000000072B90000-0x0000000072DF9000-memory.dmp	upx
behavioral4/memory/4280-508-0x0000000072B90000-0x0000000072DF9000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral4/memory/720-0-0x0000000000400000-0x00000000004CF000-memory.dmp	innosetup
behavioral4/memory/720-69-0x0000000000400000-0x00000000004CF000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	XTool.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	XTool.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	XTool.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	XTool.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	XTool.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	XTool.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XTool.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XTool.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XTool.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	XTool.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XTool.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XTool.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	XTool.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XTool.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XTool.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	XTool.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XTool.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XTool.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4280	Setup.tmp
4280	Setup.tmp

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4280	Setup.tmp
Token: SeLockMemoryPrivilege	4280	Setup.tmp

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3740	CLS-SREP_NEW_x64.exe
4516	CLS-SREP_NEW_x64.exe
3592	CLS-SREP_NEW_x64.exe
3156	CLS-SREP_NEW_x64.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 4280	720	Setup.exe	88
PID 4280 wrote to memory of 4656	4280	Setup.tmp	89
PID 4656 wrote to memory of 5384	4656	MTX64.exe	91
PID 4656 wrote to memory of 4632	4656	MTX64.exe	92
PID 4656 wrote to memory of 4412	4656	MTX64.exe	93
PID 4656 wrote to memory of 3728	4656	MTX64.exe	94
PID 4280 wrote to memory of 3740	4280	Setup.tmp	95
PID 4280 wrote to memory of 3088	4280	Setup.tmp	97
PID 3088 wrote to memory of 1448	3088	MTX64.exe	99
PID 3088 wrote to memory of 1076	3088	MTX64.exe	100
PID 3088 wrote to memory of 3924	3088	MTX64.exe	101
PID 3088 wrote to memory of 2064	3088	MTX64.exe	102
PID 4280 wrote to memory of 4516	4280	Setup.tmp	103
PID 4280 wrote to memory of 1340	4280	Setup.tmp	105
PID 4280 wrote to memory of 4448	4280	Setup.tmp	107
PID 4448 wrote to memory of 5928	4448	MTX64.exe	110
PID 4448 wrote to memory of 1420	4448	MTX64.exe	111
PID 4448 wrote to memory of 2168	4448	MTX64.exe	112
PID 4448 wrote to memory of 5672	4448	MTX64.exe	109
PID 4280 wrote to memory of 5564	4280	Setup.tmp	113
PID 4280 wrote to memory of 3592	4280	Setup.tmp	115
PID 4280 wrote to memory of 5096	4280	Setup.tmp	117
PID 4280 wrote to memory of 3156	4280	Setup.tmp	120
PID 4280 wrote to memory of 6048	4280	Setup.tmp	122
PID 4280 wrote to memory of 1488	4280	Setup.tmp	124
PID 4280 wrote to memory of 1900	4280	Setup.tmp	126
PID 4280 wrote to memory of 2140	4280	Setup.tmp	128
PID 4280 wrote to memory of 3732	4280	Setup.tmp	130

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:720
- C:\Users\Admin\AppData\Local\Temp\is-TANCT.tmp\Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TANCT.tmp\Setup.tmp" /SL5="$40178,1454423,792064,C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\MTX\MTX64.exe
    "MTX\MTX64.exe" x -mrz -t100p --basePath=".\..\" --cfgFile="$basePath$\Arc.ini" - -
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe
      C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe e -y dataOut.file dataIn.file
      4⤵
      Executes dropped EXE
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe
      C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe e -y dataOut.file dataIn.file
      4⤵
      Executes dropped EXE
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe
      C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe e -y dataOut.file dataIn.file
      4⤵
      Executes dropped EXE
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe
      C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe e -y dataOut.file dataIn.file
      4⤵
      Executes dropped EXE
      PID:3728
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-SREP_NEW_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-SREP_NEW_x64.exe" d - - -idx=00
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:3740
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\MTX\MTX64.exe
    "MTX\MTX64.exe" x -mrz -t100p --basePath=".\..\" --cfgFile="$basePath$\Arc.ini" - -
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe
      C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe e -y dataOut.file dataIn.file
      4⤵
      Executes dropped EXE
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe
      C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe e -y dataOut.file dataIn.file
      4⤵
      Executes dropped EXE
      PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe
      C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe e -y dataOut.file dataIn.file
      4⤵
      Executes dropped EXE
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe
      C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe e -y dataOut.file dataIn.file
      4⤵
      Executes dropped EXE
      PID:2064
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-SREP_NEW_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-SREP_NEW_x64.exe" d - - -idx=00
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:4516
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\XTool_2020\XTool.exe
    "XTool_2020\XTool.exe" decode -mpreflate -t100p - -
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\MTX\MTX64.exe
    "MTX\MTX64.exe" x -mrz -t100p --basePath=".\..\" --cfgFile="$basePath$\Arc.ini" - -
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe
      C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe e -y dataOut.file dataIn.file
      4⤵
      Executes dropped EXE
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe
      C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe e -y dataOut.file dataIn.file
      4⤵
      Executes dropped EXE
      PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe
      C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe e -y dataOut.file dataIn.file
      4⤵
      Executes dropped EXE
      PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe
      C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe e -y dataOut.file dataIn.file
      4⤵
      Executes dropped EXE
      PID:2168
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-LOLZ_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-LOLZ_x64.exe" d - - -idx=00
    3⤵
    - Executes dropped EXE
    PID:5564
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-SREP_NEW_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-SREP_NEW_x64.exe" d - - -idx=00
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-LOLZ_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-LOLZ_x64.exe" d - - -idx=00
    3⤵
    - Executes dropped EXE
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-SREP_NEW_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-SREP_NEW_x64.exe" d - - -idx=00
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:3156
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\XTool_2020\XTool.exe
    "XTool_2020\XTool.exe" decode -mzlib -t100p - -
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:6048
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\7ZIP\lzma_sdk.exe
    "7ZIP\lzma_sdk.exe" d -si -so
    3⤵
    - Executes dropped EXE
    PID:1488
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-LOLZ_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-LOLZ_x64.exe" d - - -idx=00
    3⤵
    - Executes dropped EXE
    PID:1900
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-SREP_NEW_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-SREP_NEW_x64.exe" d - - -idx=00
    3⤵
    - Executes dropped EXE
    PID:2140
- - C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\XTool_2020\XTool.exe
    "XTool_2020\XTool.exe" decode -c32mb -munity,lz4hc,l12 -t100p - -
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crashpad_wer.dll

Path C:\Games\Anime Shop Simulator\Anime Shop Simulator_Data\Plugins\x86_64\crashpad_wer.dll
Size 654KB
SHA256 51ceb4c782715232125c45ad3fed1e045762cd2a1f3c1deec0f75059b5593ac5
MD5 d2d8291481f3e88667a7e7a5399d0c22
SHA1 8ccfbf135d46f7ece115ef2779859c37e989e8b8
SHA512 add74ffa0b051c73d1dfa42b3496f90aad98152b5b839ec021d1ac58ee2554598dd92d6f2e6ad344538955e6cd7b7167edd6c4852dfd1676a7f2e9809ff40bf3
SSDEEP 6144:2uoqM3boTIbcY0DJwAhDdiIa8X+jPI9hcYQutAeZ/vHCtOu+f/f7HSV:CoAfcDd68+TI9hIutAYfH1TQ
TLSH
T1F8E48D6577E412E6D0B7D13E8A9B8F6AE7B1B8140720B7C701D442596F2BBE44A3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api64_o.dll

Path C:\Games\Anime Shop Simulator\Anime Shop Simulator_Data\Plugins\x86_64\steam_api64_o.dll
Size 312KB
SHA256 670d654aa3255c5061cf0236a1cdbb2f5076cbd5ae44f613b6f4921558e83e2d
MD5 b3caec4d455160acf21a318073c40dc7
SHA1 fcb09f9da2172d58fbf4aa57bdd30d607ccbf237
SHA512 bd3417c5c5c022f2b3f729283d77a335200fab8a7c439eee00f9d298608f804a3f6698049d30351d8a5dbfa3e728518691472fc78b91b8785ca5d1a5c52c6142
SSDEEP 6144:JfgdBtTW65Q6tW31ghwXRTRylO2CXuPu+SQ:JodBtW6pte1gsbys2Cza
TLSH
T199645B3962750CF4E077C13A88565E0BFA79344B23219EEF236062769E537C21EBB791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dataIn.file

Path C:\Games\Anime Shop Simulator\freearc2082100015.tmp\MTX_Temp_60614904\0\dataIn.file
Size 30.8MB
SHA256 fc811daafc0e3600d4d1bb48366ee22016b4f585597f5ca685882dd22b9e095b
MD5 05f6209e9f723d33e00ce53b82c3fbdb
SHA1 0d6f9c0a2e018f26ef96e1ac27b7db1a835e9997
SHA512 48170551fb2e2ed1a282beaf6e75c9e01db669d42d222ce65b77e2cc1d2a04987d8ca9107ec5865d0da710c117e3a9fa6f219131553e767b87ababa55e34fe87
SSDEEP 196608:F85C4z0YCKClCJ2nmmeCMiJEvwPEpcY5Nk:C3L2nmm7F29pc
TLSH
T1FD672AA0BA64C66EC52161B68ED4DBF89B31AC404E01C37B7374B72EAD791C96E137D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dataIn.file

Path C:\Games\Anime Shop Simulator\freearc2866196177.tmp\MTX_Temp_6AAD7928\0\dataIn.file
Size 278B
SHA256 ebe80479a5a2f86d0099186b0ed8d4ef601f4c427288ea4e67582c77554f0de6
MD5 fdabf86486b648358e068f2ab9134f4c
SHA1 a8dc2244eb2dd6df0b8876bf9c182d930873727e
SHA512 bb9ee88fddf5928a730ed1403bb8df91dd7cd9e2dbc58481e36c20c02e822105c264b868d246fef5851276b44eb5e140c205c5b1ab2b7aabeec6339dbea257f2
TLSH
T103D0C20DC85614B02436FD5156A1270FD2A72607207A1E34526FCB6D47E13233A8022A
MD5 SHA1 SHA512 TLSH

Submit Download

lzma_sdk.exe

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\7ZIP\lzma_sdk.exe
Size 178KB
SHA256 a78f5bff0161039ffaaa65d486ac11292b1b0eca548c0b67299e891c0340bd92
MD5 cb4925d2d81b545328be04a720918ce5
SHA1 a3f10c106d41d1ca8ff8fefa73ac01231b4ff1fe
SHA512 f5cc29f416a054fdd2be8213159c28472aef1b08a494f17870f3dd71dc443972d0abbb76ac50a94c82c9d4e1671da62a97684850adf72f4340ba9ae102b90cf4
SSDEEP 3072:4SHnNr02UQqUDO9CgUjXD8aAGQnCCsm0JRlOGMRZT5ucvWb3zgEZ1v:vnq2UQqUDyd7iHMPWzzDZ
TLSH
T178044966F2A482B5D073C078C9C2ABA6EA723496173067CB13548B7D2F17BE59D3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARC_Optimal.ini

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\ARC_Optimal.ini
Size 6KB
SHA256 6fbd68d74d199aadc7a7608ae6fd2b5624cdd4eaff28fb32730b566071867534
MD5 187614239468d562ab9e7578923723c2
SHA1 6cc73989d14ed671eb27a455538325198dc4b168
SHA512 5e9189a2183d727009c3932a1b9556ee3da6373d808d072e3dec0070c1344d2609ee8d2e034586e84b285ec9648432602a531151668a5824eb6caf23872ba4a1
SSDEEP 96:3KTKAmIK03KGK8XK9KgKLKHKCWKKTKRKgKOKI+KgKOKGK4KyKCK2yvKzKJKzhKOC:wrzs5WyUh1QNuKqLjHjD2jp
TLSH
T161E15E72309AEB6001554700FF88CEBAD0CD1716FB18A65132CFA2DE97E2309D4E6AC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLS-DISKSPAN.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-DISKSPAN.dll
Size 665KB
SHA256 b96cd290ab81dda22e488f5ff292a00794d7bff2eafa60fcc3ecd9771e484b1d
MD5 59957cdb3b31b916d66cb98032367375
SHA1 0d6d93fc039f4e99200acd070d24c5ef4b2a5240
SHA512 dac3eed702ad93a9ef8cdf9eb2d751fdd4df32110d5dc8a08ff192e2c08db4cf4fa5fb55fb2e212c5f0023fc17a152fe20f78472d679aff547f9d19c8c62135d
SSDEEP 12288:L5uCmLKBfVLxQtkl70LQKu5kSg6ieFOusDulCsF7jW5Jw7NbNRsovHYBs:L5dm2BfMBLQK0m2Duid/hv4i
TLSH
T111E423BCD6EC28A3E53AE2B6AC8674107702006F84D73A6FC3CC974A9D697634D7D116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLS-LOLZ.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-LOLZ.dll
Size 16KB
SHA256 87df573ac240e09ea4941e169fb2d15d5316a1b0e053446b8144e04b1154f061
MD5 9e1e200472d66356a4ae5d597b01dabc
SHA1 8d93246907a422d2333697cfe999cd9aeaea764c
SHA512 dd16e9c0831e72d19b1bf1431a2c8c74bcc183cfa16f494b5f11f56168209948744e0add7f2afe62db7f34adddf940fd570e28d60bebf636e07f57a0bf0346cc
SSDEEP 192:ViqxKy8IfoIqixWXFHsR61Ane6cp0c5ZJBG5LXYd5qrGmbz+q:cOcbXQqA645LXYd5qrGmbz+q
TLSH
T18872B6C61FB54061C09166B4752AAA37BF39641EF3C90B6697028528C63BD4CBE1DFCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLS-SREP_NEW.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-SREP_NEW.dll
Size 17KB
SHA256 e2548ea9b173a3bbe8a259b57f41e0744ab48347a305612e33294a897a13baff
MD5 26bc48b37d52affa0570bc3f7fb2e2c1
SHA1 e294ba97aa5fc3897e7ab203f36fd8a923d75394
SHA512 9991d33577b83f6113b3444570a5bea9226f705e022b452900c9273d2c5670cae800c396c9ead3b1664be8aaf22b069fd0619051a4ff6b930fa1d853537e4973
SSDEEP 192:BiqxKy8IfoIqixWXFHsR61Ane6cp0c5ZJBG5LXYd5qrGmbz+qNfB:oOcbXQqA645LXYd5qrGmbz+qNJ
TLSH
T13172B7C61FB54061D09166B0752AAB37BF39681AF7C9076997028528C63B90CBE1DFCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLS-SREP_NEW_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS-SREP_NEW_x64.exe
Size 311KB
SHA256 37a0225e8657cba5885e8b2b415e681186d3a49ddc92ffe23aa3f0dc2b3c6d21
MD5 581c5e4d47e94e11f768825887199c99
SHA1 3af894dd2279d869ce27e2997d7193150e9e745e
SHA512 44b0916c5b1ef8948218be778731e5c31cd0ad25cfe14bb035509c040581dd095e73773b76f7c8005de1797c71093f9bc8716328384912db9225995073e7b25b
SSDEEP 6144:HgVIVQtum4/B9za2EJ/Q0d/l163NtEYg69tSSH:AVI5m4/B9O2gjgdt+8JH
TLSH
T142647B46F6D579FADC6A817D8C694346F332BC254711EB4B23A84E663E333814E2DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLS.ini

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS.ini
Size 774B
SHA256 a573d4288367bc3e58d4fd191e9b054c0ea42a1c0b38b258c284087eac67a677
MD5 d1f6541c2dc547dada07268ada45d2f5
SHA1 a4ceab11352e081dad9badcde7332b631ea7179f
SHA512 6d9bb6e468511f642b076b2aca1fc98f0d09f2509cd8ad731580a521c0a53534d4acfb6b4775944a16ad2e62662c6db8875a21b51a6080f8997a0ba436cd0d0d
TLSH
T1D001D6A1292D46B95200119318F16E9D2CB9C6ACC1566E0C33A308FE36DC17DA1EF2F6
MD5 SHA1 SHA512 TLSH

Submit Download

CLS_Optimal.ini

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\CLS_Optimal.ini
Size 718B
SHA256 aa71401fdd692fa86b7cfc056f970542b3e6e2e9cb161f023fc5ecfb07cc32f6
MD5 9a24f0ac947aad8bcb01860a01b7e8f0
SHA1 f6eec77839e79533b50bb6c9998009bac5d91924
SHA512 fd40cdf62a1454976e3e35f27a9dcb61d03bb2afb4085743e261bc279e79e31be426d039992780e136316a645b10c299c36efc5369d3ba2ab2846ed2058e5efe
TLSH
T19101B5B5295E46B95100119319F12E9E2C79C658C0229E0C33B309FE26DC17DA1EF2F6
MD5 SHA1 SHA512 TLSH

Submit Download

ISDone.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\ISDone.dll
Size 452KB
SHA256 bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
MD5 4feafa8b5e8cdb349125c8af0ac43974
SHA1 7f17e5e1b088fc73690888b215962fbcd395c9bd
SHA512 d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
SSDEEP 6144:QdFS9nBbvESTi3qakl6j+vn+nLE4FZZHYnf9ketkqOGzgsgmInbAKf3:R9BUqmvLE4FZKf6eDOG8sgmInk4
TLSH
T147A4BE23B6D2C572C00B92308D16D7F5A679BA209F2886C3B7D8DF6D6E351D05A3934B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MTX64.exe

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\MTX\MTX64.exe
Size 1.5MB
SHA256 218fb77511e1c467af9d4a426940ae430da47b9db931140784ad795aa6a3c678
MD5 7d68fd49af46e20c3dbaa56ba2e03918
SHA1 b0289e479ecea5796e8267385724f0d043006fab
SHA512 fd91a876e57173d620de6a8ce668391fb672f40cbbb9e4f4f958facf10e6be683a05c003539f92f05738bfb611cc663bf6fdfbe3fc32fcfc320106197d3c2c26
SSDEEP 12288:X8cTLvN8z963EqBzSFvqfa9f7RwTirL8Htc4axoaWLjamevR:XPG6327wTF64xW
TLSH
T1B67507BB77449239C81DA23BC8E2CE459C3761791B33CAE762E10A7CDA464C51F3EA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RZ.exe

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\RAZOR\STANDARD\RZ.exe
Size 196KB
SHA256 4926035dc15cca78c3522d85555eb5c25a8a0282749b40221679b76ce9949bbd
MD5 ddb176878f10451b339d9355a4d484a0
SHA1 2097f7f9af17c74da5b398e5c5fd931927d5ed5a
SHA512 58871dcefb49a6f565d0a109e97c587b7bd2328ae5c97167906041d722b94ecc8ea25cdf9a05bd265da4ac4800115b984808ed601d80b6c6cfb66f9e8c1c270a
SSDEEP 3072:bTb4HvobWFl0Yuq1RkMHDaXSQWraD28rw7eBfb:bnQFl0hq1RkuaXSJrB8rwC9
TLSH
T1A214190BA5B3B4FCC557C130869AA273B631B8180330BE7B6B54D774EE16ED0662DB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Records.ini

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\Records.ini
Size 910B
SHA256 a51a407e5a62890523daaeb4cd7321c3a2a7beec7d08d54329cba0f82f329e32
MD5 1d5633cd60496a64157ab97154c2b4da
SHA1 3e316c2b2816dc432ca6ad4f443d4ddd8935133e
SHA512 3221170c43ab52843bf82e67b0fd6266287fa1e22d7e5d6283deb1bdc90993a6fcf02032b0a7918784862a2d9e906912bbfa8d94a428239d0cad83d961523970
TLSH
T14E11704ABA9DCCAE9121CA996A410CC0AC19143520D1FE596D1239FFDFB108C02DC6EE
MD5 SHA1 SHA512 TLSH

Submit Download

Settings.ini

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\Settings.ini
Size 1KB
SHA256 60f3f7e240a88134b15658a104d9766d52ed353723f5059aaca1632f02bc6bb6
MD5 c9767e515926c28284d8cd229939fa8f
SHA1 204fc04886afc04415db0b46d42ba491c0a56949
SHA512 5ee72dc0038e1d09f287b0f9df50741a4537de77089d2d5f7ff1c45706ae9bc6eea9ad9f6328e6540049d773abbd54a2dd586e231895d78faf33218862b45af7
TLSH
T1F2312B5726F92164E6F79B58FEB850B1C72A3811A859CC5D82E0120D44EC840DD37FF7
MD5 SHA1 SHA512 TLSH

Submit Download

Splash.png

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\Splash.png
Size 36KB
SHA256 8cecb2e0619db82c569bdc69710b54224f8f9c1326d0d661c6a5df23b1d39578
MD5 8ffd7482658acdc9a8ce1495c11c90d7
SHA1 7e7fe3cb3dcc9b3279e10971f29b44c5bb041a9d
SHA512 5318303b1e6d86250daaad061096a3136e6330c270fb3cb7bdf8c1bdc93fe2c2d2d2086c6ab71c56b1cfff71abf31737bd1c44189badc6c84425d34d69f86083
SSDEEP 768:phwS9EolPdzW+OfSSem9EVWtBJ2+Ujdaxbj2QVREl+0ccJ5OL0FE:phJ9hmfym0aTSdOnvCp5U0a
TLSH
T108F2F1427114A43DA959D0C1225D837A8ECF1A0F9848A0DBB7B7837535B387D9EB1ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitLib.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\SplitLib.dll
Size 160KB
SHA256 9866d9ae41c0aba9a7f1b54ec73de8e02b7052172dc486a81ab82c3ec1a5f59a
MD5 dd499e0605a046a889e1e4282d53561b
SHA1 71c6f78fa8a86bd90cd80fe1b61b20cfeff26c62
SHA512 3e152dcb421e82bcdd7818bbf047db46418b373e089bf3bb1b54f8eb189127630f1af61395124f94006e1c556ef14a5d47e28d347788de9483145ba5612173a0
SSDEEP 3072:Pd5kepIHa6giLBS0BJttg0VfyDTMSxGcbnt7Ci2h3I0ideiQEWa:PdmeyHaRIBNztgwClxGcrFCiQI0iwmW
TLSH
T167F302E2033EB361F1814A3ED59D4EEB232A8C5F511596C613487D0E08FF8167E5E6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnArcLib.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\UnArcLib.dll
Size 333KB
SHA256 5fcfac18758a12e0e717a5189f379922a32b5ac12f26491e638d70b54ae1dcab
MD5 56a2bcecbd3cddd6f4a35361bf4920d6
SHA1 992e63be423f0e61093ba183f49fc0cbec790488
SHA512 473cbdf760242db1f0f1d0c27046c0564998f2bf931ad03feb28af3c7bd253d00e6f0836dadf37f29e0db4171eb64e6a15ed4cb9a9d28b48fb0aab601573f551
SSDEEP 6144:nXy5ZoJ+k8FQw+XuilGIBcKFx4V39sQ61EysySdnYeITRPfbLEPAwbK:nKB+XOKFx4V3mn9bmbK
TLSH
T1FD744A94FACB81F1E4070D7040AAB33FAF35570A8034DE76DF98AE55EAB3B125919349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Welcome.png

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\Welcome.png
Size 5KB
SHA256 98836253c1340d0fafe69651aafd85ade0954d5c703dd22c14ebd9543754cf0e
MD5 7b53e4ce4610047f1bff18909383fd99
SHA1 038dca7c7f806b424e8d53798f72b41152745ba3
SHA512 da4f7670fbb66eafa8adcbf582d30c400c6550f5975a24591fcee8b1b081c878de80963ab7f9ef33f777ab1e8956263bff4e886f178a45637cd61561df0e0836
SSDEEP 96:0b42OY/CQfnhzQ3Pp0Ac9fBOUkLSmnSQm6EGjPZdLeJSZ74NByfChqxLdeNX4kD6:0b4WCQfh83PNcpB3kLFlmytdyQlsBya4
TLSH
T193C13EF6C35085B7B6521418F9AA841B58B86C3B7034CE0A01DBB01FB787F75AD39E95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XTool.exe

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\XTool_2020\XTool.exe
Size 3.4MB
SHA256 988b94b31f7f0f4d6280be470fcc8565ded69a6d5a155c29d5b41e1590b5abc0
MD5 47f0b1f5b136f6b1fe7e6dc23f67addc
SHA1 ca35e6e4b224842a05654aa7bc0d76b399563499
SHA512 c70da08634c81d96c09e30e3ca61780203e2c3234cd8528b3c223123f59c00663829819d9e25958dfbd3399eed5e495eaca2a5b7902468b8e5e3c03fc74ba3b7
SSDEEP 49152:aP2ek91V8dDTMTguRcJz2oEJFX9SUQ5/1E2PQDDTuu/ZgfTf+gNNk:aP0FTHRSMX9s6A
TLSH
T12DF56B2A3D95E1ECE169C13A81B74B11E73AF0861B32D7F791A046A96F176C84D3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblz4.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\XTool_2020\liblz4.dll
Size 438KB
SHA256 22602628f070e9ab791cb555454c058d7798e89944f107e155e5972c441654a3
MD5 4e95ebaf0aa7fb64a23ff10f4b5b4c15
SHA1 fd65631c7ba106002b5ba548a6b9e69821ba436f
SHA512 651755d9520c9334d180deb2f9419e19c2ea8065ec11ab0bd409d185f5714981e163ceb1bbb88539725c5f105d9a23e43c34ac439e37acadc13f1d8d1ee6e52f
SSDEEP 12288:kTcQ6WpQPRNWvAQ/SqF50Rs+FwLdw6M1DXdh:9EpQPuz/SqF50Rs+FwLdwJDXdh
TLSH
T180A46D90F542FDBDE49ACB3955D6231593ABB040DB1DFA372B40FE38055EB284933A4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

preflate_dll.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\XTool_2020\preflate_dll.dll
Size 401KB
SHA256 2e95c667661dff1d2225125c45a9f6733dfb9e2c8dc6e4fecb1f0285f4a18994
MD5 c5b95a4a4d74b257831c439e0ecdcc9c
SHA1 65fe783a18559d7b917eafe11c3520cd5538ed60
SHA512 dc2e9975014fe96233abc61c70dac47233bd414a187b9229c2d43eef5a88d1a2ae90a94d8eafdf5b5af7336fbb9c98552d19044af407c7f421d884405f69c13a
SSDEEP 6144:ApOn6lDHs0aj5+J3vNLMrzIcPrmO4pQIfBp8xwhpJi2fvZFpJ4chFYN+IuCR0V9N:AQrmfBzJJYglT6H5oN
TLSH
T146945B5AFB5408B5E2679138CA73860BE3B2784D0771D79F23A4436A6F37B90593E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unity.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\XTool_2020\unity.dll
Size 211KB
SHA256 48883dff4043ed5a2659d6a86b7bea8b0ac0ba73c2585bc8e8289a7041e58488
MD5 77c3ff42a960d484263823902c75ea0e
SHA1 35b1b3fe30add41a80e94a673aa84e31d40e7ce7
SHA512 7ef8095cca418b8074353f1b15655f71f2e7756588626f9abca4c98a4c7705a16ab0e98b48bd62822d5327b8b5c02dff0680cd43899b8262243b2468bca5cb41
SSDEEP 3072:3JTuci7jRdrXs8FIDdwwnAVrQQzkk8ashczh:ZTucuRdrXNCDdwwnAVts2
TLSH
T1C024C42FA2A588BFE5AAC13AB4D28770EB33B474033285EB15D10339CE497D15E79674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlibwapi.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\XTool_2020\zlibwapi.dll
Size 500KB
SHA256 6bd7abd00cedeab4558a85f7c41b94f327bf2382dcc17bce94f5f75aa0c782ac
MD5 87fc435f2147e8ec06b3c94cdbde4ac7
SHA1 7d88327d6143d1a45e93114b84a015671afbbb13
SHA512 f13cbf94678b93373d28ada996f25680f06bd56b1f1ca9df51b320114042857b696c061f36360d31ea3ae206a287674e4a1d65e5caf6482911ea5c02884d102d
SSDEEP 12288:TFGszq9/Ns82QZD9VPYamTX3MkaLPvJL73cC:7zWs82QZD9VPYamTX3MkarJ3M
TLSH
T1DAB48D56B7A457B5D177E138C9930B16EAB278154721A7CF03E883BA1F233A1263F325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\botva2.dll
Size 41KB
SHA256 da7d0368712ee419952eb2640a65a7f24e39fb7872442ed4d2ee847ec4cfde77
MD5 ef899fa243c07b7b82b3a45f6ec36771
SHA1 4a86313cc8766dcad1c2b00c2b8f9bbe0cf8bbbe
SHA512 3f98b5ad9adfad2111ebd1d8cbab9ae423d624d1668cc64c0bfcdbfedf30c1ce3ea6bc6bcf70f7dd1b01172a4349e7c84fb75d395ee5af73866574c1d734c6e8
SSDEEP 768:DyNq+QImctzKKFyAE/PFqhezqSQrvYt4lYVuW0zMo4QHVoWyQK7OYwPPh:2Nq+QWJ7ds80mlde7s
TLSH
T125134B61E9E2C030C096DAFE6D35E215A36F7E101F260BB91A9D6ECCEE4BD43641C167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cls-lolz_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\cls-lolz_x64.exe
Size 335KB
SHA256 d92f7c60256509f74e36d9b5aab041fe44999b1a3910d70aa83c9d01f062ea29
MD5 7234c4334a7523b1ac6f51c072497071
SHA1 e06a12c60a99bc4ccc2a21774c82c80a6159aa67
SHA512 9e51c0348ed975ba62482486581a03d5d6c17707542dd46eaa09ca15bcc85aab0f489092d974a4a998c3595a7de9873901e6e590ea25c739c6e976997dd86503
SSDEEP 6144:klTwtAltyt4ZzUp7RGUgayD3Ggw/u5FcKODiXklJguBgcyGzFoW5NjQj+S:MT7at4ZZ8yD3GgxIJgqb5oWw
TLSH
T112749E8BF68140F4F163C538926B9623E77FF85D9320166E1B958241AE97AC46F2FF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

isgsg.dll

Path C:\Users\Admin\AppData\Local\Temp\is-3US2L.tmp\isgsg.dll
Size 34KB
SHA256 9eeef28d82fc4db7d1269dfbc0ea282768ce5e2e4e4bdc867d80d6847468dca7
MD5 09974eaff6defadde38b1328754dbe09
SHA1 001cfb5514444188e455b97acc369f037079ca9d
SHA512 da29b01ebebb454c004420c6b29bb8dca9fb50554a7a5db30035a5ec458d766049bf5502f708bf7eb210a4f9cbdb308cc0c8dcdad9f745b01a9e4f1455bbc846
SSDEEP 768:b1GqtIkY88L/6lmBIFYtkWdjOhKDEgzBVrBEqwONRBnbcuyD7U8:b13tI3/6oClWdSfgzB0qZNPnouy88
TLSH
T1B7F2E05707FB0B5DE4AE97B118AA160B0150FB25EB014F2E75D0322FACA1F653E10B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-TANCT.tmp\Setup.tmp
Size 2.5MB
SHA256 f8b9c159dc105f8ee9851ad80d0051e6c539fa06ec6c6d0a5b73234f1bd590be
MD5 3c5bf5a130de0ff462c18e60a2ec2c36
SHA1 37baf392762ca948d420d9e572014fd62b2a5b18
SHA512 212573a9952c4cbf41d91df64b5997b6f2cc81eb520049e114cef9dcb057615c6dca2a64f3c39ac6617c19dfa631d9c4380595f3eee6c17dc38166969fdbdaf2
SSDEEP 49152:qR/KpmZubPf2S8W2ILeWl+C1p9jWy5Snd0eigXNh:s/jtYLP1Sy5E0g
TLSH
T124C55A16B288713ED0FB0B37893386505937BA61BA73CD5B5BF02A0C8F355902E7E656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dataOut.file

Path \??\c:\games\anime shop simulator\freearc2082100015.tmp\mtx_temp_60614904\0\dataOut.file
Size 5.3MB
SHA256 0f0738d963d6bcdf902113229a275c1329b6b27202be8f00291ca8a8a479861b
MD5 a3d7e18ea6b9ddaa3a08e84b3aa45f1c
SHA1 9d991b0d201005fc62c00893b3ad649bd0f64b14
SHA512 c0c2f6890f5e8baf9a72734fd9bd3a4ee0a90e145802604c859e8b8a17ac20db07788aa541f75b0744060dbb599edef3ac6270e8ddd3c1c83b2cf8a995b2c34a
SSDEEP 98304:RkVKO3Hnv4lHEU/WCEvk06W0alQHbiR8bV5JSsVVj2i7QY4mG3vu/g:CVlHnwREU/sf6WyHXLJS22is7zu/g
TLSH
T10E46334A44FA8F74ACC61D2E6F5D71E701B2C69AE2CB4BE16A324D54142D330FCE85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dataOut.file

Path \??\c:\games\anime shop simulator\freearc2082100015.tmp\mtx_temp_60614904\1\dataOut.file
Size 87B
SHA256 7026e3e002096f3c9fd7a6cdf8c6589adaf00eb00c5da99369c518ad466f1b0e
MD5 fd3a599587ad0ae0b6c0832e6e7c7756
SHA1 ad2efb9d5047f460b9d53f106cb82c8ada6277b9
SHA512 e0e94d788ed60c8e623c1a066d02474e07a39a423cc92f0923a91b1697966f4556f0cb0bf357193e7a2e24129dd36cb4c4a7079888b730ba47e50bea1dda5397
TLSH
T129B01203A1674806C11590300D275660428014D91440083481FC0311169330044B2C10
MD5 SHA1 SHA512 TLSH

Submit Download

dataOut.file

Path \??\c:\games\anime shop simulator\freearc2537886435.tmp\mtx_temp_2fe530cb\0\dataOut.file
Size 10.0MB
SHA256 813c3e070693ea1a539c338f06d782b1bf8c1eac6295223ec264fa60899ee10c
MD5 4b8a27a48ec3d4c6cba4e53aefd91bfc
SHA1 f0d338e2678728d8bc72ba52a78ff988ea4be939
SHA512 54ee4b221d820fadbbf99ee0dfa1b75dee9ac3c77284c51eeb22f69d9cba19a4e6201f5d18b3b87fa7854051fc9a21c8b6384c5713838b8a1d1f65b4d6948463
SSDEEP 196608:glNaQ5Aphf6s9aqmQj8RsSXo0PWHbAm93UzQJNugTnt0:gHAX6fkj0vXo0Pq1UEJNucK
TLSH
T177B633EB9C4CE92F6F2E982C3E41C44144766EAA44B57DFF07B242DA75386342AB7701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dataOut.file

Path \??\c:\games\anime shop simulator\freearc2537886435.tmp\mtx_temp_2fe530cb\1\dataOut.file
Size 13.6MB
SHA256 462c9978fcb90da7e00cfeb96679b22ad50d2a1a63834e3e05a7533ffdb199f4
MD5 a1910a88d5c3b500614df45bd5089d75
SHA1 da7f245c221b9ff6aa819fb13d53885e50263b8e
SHA512 f2170fd074089ca2987dbcd6dbff0fa1e2e7e6d228be87ba9033a488a33e1fc5ae21b165b7111a82683035496ea1b4e4244d4dec70b85e6f6158e8dec00b468e
SSDEEP 393216:ITah7NmV60OZc+JAQckh6cZKI0z//NZZZjEHiw2c:ITah7N+v30AYIaG//NFECq
TLSH
T1DAE6332A0413B76854623C2FBE7D3B8E55ACCDB77876E862F6231202389755106F9FE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dataOut.file

Path \??\c:\games\anime shop simulator\freearc2537886435.tmp\mtx_temp_2fe530cb\2\dataOut.file
Size 22.4MB
SHA256 68ba6010943e36932bbe6b879d70fc998f31d91770ca88ea0d5f71691e079927
MD5 a81ac762e8c2f18b9e9ef2804d5d7966
SHA1 82f34689ddc6eeac23a544c9d8037662a218b627
SHA512 ead55e8340c14920401b249fb708f0fb3392bc9d7d497219fe18d18af8ca9b9251d1558e52410a99df9924367b43a8afd68973f0849ac114cb328df62dc78c38
SSDEEP 393216:q2ftrBWWPTC4VwdpeiJos++EzmNoeErF105XqcQXvG+uLBDjiwpvivU0r4:qiFkptJos++EqNob1AacQXv/uwwNivUF
TLSH
T1133733E1E3C9BA86C5B054C1E0B6AED3D86593790890032C3BECBC7D7961BCF955B50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dataOut.file

Path \??\c:\games\anime shop simulator\freearc2537886435.tmp\mtx_temp_2fe530cb\3\dataOut.file
Size 87B
SHA256 9b74d559dbe409e8bddf964311d5dcc21913a88df3b34abce9ab65bb4a7022bf
MD5 5e037ca9aa6eb9f163e1dbd63dda0ee9
SHA1 9cff5fc5ac17f7c0ad07131799927894bea19bd7
SHA512 957fe1558baad2f383260704c7a81e8d2e51b29a06664e829516dd33b4db534790e73bd0bfa1b65bfb974308a61ef88ae273de738b11742520fe41a4ca24798f
TLSH
T158B02203C0E30C0CF0AAE0300C0BEEB082CAA2CE2000CA30C23C02200EF33A288B2C30
MD5 SHA1 SHA512 TLSH

Submit Download

dataOut.file

Path \??\c:\games\anime shop simulator\freearc2866196177.tmp\mtx_temp_6aad7928\0\dataOut.file
Size 299B
SHA256 b81f6b3c8715cd5706ecb574f01652fc6c5e0ab9dfb7ddf0151d3fb19b9ffb26
MD5 537bfde514abda170e7ab50ed40b64ab
SHA1 634c2218e4d27932807cad6df1db969101c7b2a6
SHA512 3b70a894f037380e58e578b547c0250ff8b28de6ac96680b4a7cac5c007787aece73cca4eb3a28a15c0ec36f127b2fa5a25ad9499781f5b945e9e1a847881226
TLSH
T1DEE07D1D633023E77C8494854AA783316A201DFF88468F6384577D14252405D940514C
MD5 SHA1 SHA512 TLSH

Submit Download

dataOut.file

Path \??\c:\games\anime shop simulator\freearc2866196177.tmp\mtx_temp_6aad7928\2\dataOut.file
Size 87B
SHA256 62971cf540f519f9f96d347137a9f9cae1b5b572ed0e67924963974fce278928
MD5 eaa81304c7935bf4e296daf64c95b0f4
SHA1 f303ccbab4ab7fcf924e6449e990e51d5dc63df0
SHA512 0cacf3e025931b1ee1881b35a85202aa421f0e533d869feb4bbadde391609225f4571f0fdd75ce5d12a7312f2caaa584b3afdaaf54b008cf62b0cec0e3338388
TLSH
T196B012825497080CC22A843118036930418494C250040A14805C011015D770004E1C60
MD5 SHA1 SHA512 TLSH

Submit Download

memory/720-0-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/720-69-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/1076-372-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1340-404-0x0000000070500000-0x0000000070546000-memory.dmp

Download

memory/1340-403-0x0000000140000000-0x000000014039F000-memory.dmp

Download

memory/1420-422-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1448-342-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1900-601-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/1900-489-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/2064-338-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2168-419-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3088-380-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3728-277-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3732-513-0x0000000070500000-0x0000000070546000-memory.dmp

Download

memory/3732-512-0x0000000065FC0000-0x0000000066031000-memory.dmp

Download

memory/3732-511-0x0000000140000000-0x000000014039F000-memory.dmp

Download

memory/3924-341-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4280-510-0x000000000A350000-0x000000000A3E9000-memory.dmp

Download

memory/4280-453-0x0000000000400000-0x0000000000685000-memory.dmp

Download

memory/4280-365-0x0000000009510000-0x0000000009591000-memory.dmp

Download

memory/4280-367-0x0000000072B90000-0x0000000072DF9000-memory.dmp

Download

memory/4280-369-0x000000000A350000-0x000000000A3E9000-memory.dmp

Download

memory/4280-366-0x0000000061080000-0x0000000061119000-memory.dmp

Download

memory/4280-364-0x00000000091D0000-0x00000000091DF000-memory.dmp

Download

memory/4280-362-0x0000000000400000-0x0000000000685000-memory.dmp

Download

memory/4280-71-0x0000000000400000-0x0000000000685000-memory.dmp

Download

memory/4280-368-0x0000000009740000-0x00000000097B7000-memory.dmp

Download

memory/4280-73-0x00000000091D0000-0x00000000091DF000-memory.dmp

Download

memory/4280-23-0x0000000008F90000-0x0000000008FC1000-memory.dmp

Download

memory/4280-627-0x0000000000400000-0x0000000000685000-memory.dmp

Download

memory/4280-98-0x00000000040D0000-0x0000000004210000-memory.dmp

Download

memory/4280-47-0x00000000091D0000-0x00000000091DF000-memory.dmp

Download

memory/4280-86-0x0000000009510000-0x0000000009591000-memory.dmp

Download

memory/4280-68-0x0000000002490000-0x0000000002491000-memory.dmp

Download

memory/4280-621-0x0000000009740000-0x00000000097B7000-memory.dmp

Download

memory/4280-6-0x0000000002490000-0x0000000002491000-memory.dmp

Download

memory/4280-234-0x0000000009740000-0x00000000097B7000-memory.dmp

Download

memory/4280-590-0x0000000000400000-0x0000000000685000-memory.dmp

Download

memory/4280-89-0x00000000040D0000-0x0000000004210000-memory.dmp

Download

memory/4280-596-0x0000000009740000-0x00000000097B7000-memory.dmp

Download

memory/4280-249-0x0000000072830000-0x0000000072837000-memory.dmp

Download

memory/4280-578-0x0000000000400000-0x0000000000685000-memory.dmp

Download

memory/4280-431-0x00000000040D0000-0x0000000004210000-memory.dmp

Download

memory/4280-584-0x0000000009740000-0x00000000097B7000-memory.dmp

Download

memory/4280-573-0x0000000072820000-0x0000000072828000-memory.dmp

Download

memory/4280-436-0x0000000072B90000-0x0000000072DF9000-memory.dmp

Download

memory/4280-87-0x0000000009510000-0x0000000009591000-memory.dmp

Download

memory/4280-460-0x000000000A350000-0x000000000A3E9000-memory.dmp

Download

memory/4280-459-0x0000000009740000-0x00000000097B7000-memory.dmp

Download

memory/4280-458-0x0000000072B90000-0x0000000072DF9000-memory.dmp

Download

memory/4280-572-0x0000000072830000-0x0000000072837000-memory.dmp

Download

memory/4280-552-0x0000000000400000-0x0000000000685000-memory.dmp

Download

memory/4280-558-0x0000000009740000-0x00000000097B7000-memory.dmp

Download

memory/4280-528-0x0000000000400000-0x0000000000685000-memory.dmp

Download

memory/4280-245-0x000000000A350000-0x000000000A3E9000-memory.dmp

Download

memory/4280-522-0x0000000009740000-0x00000000097B7000-memory.dmp

Download

memory/4280-509-0x0000000009740000-0x00000000097B7000-memory.dmp

Download

memory/4280-242-0x0000000072B90000-0x0000000072DF9000-memory.dmp

Download

memory/4280-508-0x0000000072B90000-0x0000000072DF9000-memory.dmp

Download

memory/4280-252-0x0000000072820000-0x0000000072828000-memory.dmp

Download

memory/4280-70-0x0000000008F90000-0x0000000008FC1000-memory.dmp

Download

memory/4280-516-0x0000000000400000-0x0000000000685000-memory.dmp

Download

memory/4280-515-0x0000000009260000-0x0000000009261000-memory.dmp

Download

memory/4412-275-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4448-428-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4632-274-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4656-292-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/5096-437-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/5096-467-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/5384-273-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5564-435-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/5564-432-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/5672-421-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5928-420-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/6048-474-0x0000000070500000-0x0000000070546000-memory.dmp

Download

memory/6048-469-0x0000000140000000-0x000000014039F000-memory.dmp

Download

memory/6048-475-0x0000000140000000-0x000000014039F000-memory.dmp

Download