hxxps://send[.]now/pdokg1c2sdfb

Analysis

user interaction
yes
max time kernel
536s
max time network
536s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://send.now/pdokg1c2sdfb
Sample261102-wpghssd14m

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 8 IoCs

pid	Process
1396	MarvelousDesigner_Personal_2026_1_237_Installer.exe
2820	VC_redist.x64.exe
5852	VC_redist.x64.exe
2196	VC_redist.x64.exe
4740	VC_redist.x64.exe
5216	VC_redist.x64.exe
6120	VC_redist.x64.exe
2364	VC_redist.x64.exe

Loads dropped DLL 13 IoCs

pid	Process
1396	MarvelousDesigner_Personal_2026_1_237_Installer.exe
1396	MarvelousDesigner_Personal_2026_1_237_Installer.exe
1396	MarvelousDesigner_Personal_2026_1_237_Installer.exe
1396	MarvelousDesigner_Personal_2026_1_237_Installer.exe
1396	MarvelousDesigner_Personal_2026_1_237_Installer.exe
5852	VC_redist.x64.exe
1164	VC_redist.x64.exe
6120	VC_redist.x64.exe
1396	MarvelousDesigner_Personal_2026_1_237_Installer.exe
5668	regsvr32.exe
5668	regsvr32.exe
5668	regsvr32.exe
5668	regsvr32.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5560	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5af95fd8-a22e-458f-acee-c61bd787178e} = "\"C:\\ProgramData\\Package Cache\\{5af95fd8-a22e-458f-acee-c61bd787178e}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5af95fd8-a22e-458f-acee-c61bd787178e} = "\"C:\\ProgramData\\Package Cache\\{5af95fd8-a22e-458f-acee-c61bd787178e}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in System32 directory 53 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\CloThumbnailProvider.dll	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\CloThumbnailProvider.dll	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Female\V2\9.Naomi\leg_normal.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Modular\Shirts\Shirt.Short.png	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Zipper\Object\Top_Stopper_03.zst	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Resizing\Girl\symmetry_data.sym	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\FabricCreator\diffuse\V2_Woven_Boucle_3.png	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Knitwear\model\honey\pyp_legacy.json	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\plugins\carb.dictionary.plugin.dll	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Boy\KV1\Oliver\face_roughness.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\FabricCreator\spsqr.obj	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Female\V2\10.Luna\eye_normal.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\DefaultImage\Environment_m05_c03.pfm	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Resizing\Female\staticVertices.bry	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Female\V2\10.Luna\leg_normal.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Female\V2\6.Camila\tooth.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Female\V2\7.Yuna\leg_normal.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\DefaultImage\Environment_m07_c04.pfm	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\FabricCreator\diffuse\V2_Cut_Sew_Knit_Sherpa_1.png	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Knitwear\model\rib42\sxsasy\data.npy	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Parametric_Pattern\landmarks_root_arr.eom	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\resvg_LICENSE.txt	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Converting\Female\inside_sampling.mkr	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Resizing\Girl\BaseMesh.be	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\DefaultImage\Environment_m02_c01.pfm	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\FabricCreator\diffuse\V2_Woven_Denim_2.png	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Sewing\Puckering_Image\inner_puckering\polypdding_inner_puckering.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Render\LightPreset\Light_5.vlp	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\ALEMBIC_LICENSE.txt	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Resizing\Boy\IndexSet.txt	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Girl\KV1\Melody\Variation\eye_gray.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Male\V2\8.Leo\arm_roughness.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\DefaultImage\Environment_m06_c00.pfm	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Sewing\Puckering\Leather.PTP	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Sewing\Puckering_Image\cotton_seam_puckering_0078524e_clo.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Tpose\Mixamo_Tpose.pos	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\FabricCreator\diffuse\V2_Woven_Memory_3.png	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Parametric_Pattern\parametric_pattern_info_Set-In.json	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Skinsuit\14047_28090_3442_38371.top	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Resizing\Female\displacementData06.txt	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Female\V2\9.Naomi\eyelash.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\FabricCreator\diffuse\V2_Non-Fabric_PVC_2.png	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\FabricCreator\diffuse\V2_Woven_Velvet_Velveteen_2.png	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Qt6QmlMeta.dll	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Female\V2\eyebrow\FV2_eyebrow_01.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Girl\KV1\Melody\Variation\Body\face_gray.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Knitwear\model\rib\sxsasy\data_legacy.npy	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Modular\Skirts\Skirt.Basic.png	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Render\LightPreset\Whitehouse.vlp	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\imageformats\qgif.dll	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Qt6Qml.dll	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Male\V2\10.Liam\leg.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Preschool\KV1\Sasha\Variation\eye_mask.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\DefaultImage\ENV_09TextureRepeat_On.png	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\FabricCreator\diffuse\V2_Cut_Sew_Knit_FrenchTerry_2.png	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\FabricCreator\diffuse\V2_Cut_Sew_Knit_Lace_3.png	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\FabricCreator\diffuse\V2_Woven_Ripstop_3.png	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Knitwear\model\cartridge_belt_rib\pyp.json	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Qt6Svg.dll	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Resources_Common.rcc	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Preschool\KV1\Avery\Variation\body\body_Covered.jpg	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Camera\3D_camera.obj	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\FabricCreator\prompt.json	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Sewing\Topstitch_Image\MD\Pick_Stitch.png	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\Preset\Skinsuit\31422_62658_3_74727_V1.top	MarvelousDesigner_Personal_2026_1_237_Installer.exe
File created	C:\Program Files\Marvelous Designer Personal\qmltooling\qmldbg_server.dll	MarvelousDesigner_Personal_2026_1_237_Installer.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5fea4c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA5A.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF120.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5fea4d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5fea3a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEDB4.tmp	msiexec.exe
File created	C:\Windows\Installer\e5fea3a.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5fea4d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF70D.tmp	msiexec.exe
File created	C:\Windows\Installer\e5fea62.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4008	msedge.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000095d3837de88660fc0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000095d3837d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090095d3837d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a95d3837d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d95d3837d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.zfab\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{1CA1377F-93FC-4F3D-A1BB-8A129CE31DA2}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\clo.zprj\shell\open\command\ = "C:\\Program Files\\Marvelous Designer Personal\\MarvelousDesigner_Personal.exe \"%1\""	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\ = "{5af95fd8-a22e-458f-acee-c61bd787178e}"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.btn	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.sew\shellex	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.zpu\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.zst\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{1CA1377F-93FC-4F3D-A1BB-8A129CE31DA2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CA1377F-93FC-4F3D-A1BB-8A129CE31DA2}\ = "CLO Thumbnail Provider"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\clo.zpac\shell\open\command\ = "C:\\Program Files\\Marvelous Designer Personal\\MarvelousDesigner_Personal.exe \"%1\""	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\clo.pac\DefaultIcon	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{062A6939-EBC3-4FE9-B3BF-79342662C1CB}\1.0\0\win64\ = "C:\\Windows\\system32\\CloThumbnailProvider.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Dependents	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}v14.40.33810\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.trm\shellex	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.zacs\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.zss\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.zth\shellex	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CA1377F-93FC-4F3D-A1BB-8A129CE31DA2}\InprocServer32	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\clo.zprj\shell\open\command	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.zse\shellex	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\clo.zprj\ = "CLO Virtual Fashion"	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.anm	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.zse	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\clo.zprj\shell\ = "open"	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\clo.pac\ = "CLO Virtual Fashion"	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Dependents\{5af95fd8-a22e-458f-acee-c61bd787178e}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}v14.40.33810\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{062A6939-EBC3-4FE9-B3BF-79342662C1CB}\1.0\FLAGS	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.zsl\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.zsp\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.ptp\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{1CA1377F-93FC-4F3D-A1BB-8A129CE31DA2}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.zacs	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.zfab\shellex	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.ztt\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zpac\ = "clo.zpac"	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pac	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pac\ = "clo.pac"	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.pos	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.pos\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{1CA1377F-93FC-4F3D-A1BB-8A129CE31DA2}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.sew\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{1CA1377F-93FC-4F3D-A1BB-8A129CE31DA2}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.zprj\shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{1CA1377F-93FC-4F3D-A1BB-8A129CE31DA2}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\clo.zprj\shell\open\ = "Open with Application"	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\ = "{5af95fd8-a22e-458f-acee-c61bd787178e}"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{062A6939-EBC3-4FE9-B3BF-79342662C1CB}\1.0\0	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95761103-5260-4C18-A9D9-B2BF705B1102}\ = "ICloThumbnailProvider"	MarvelousDesigner_Personal_2026_1_237_Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.ptp\shellex	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.sap	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
5172	msiexec.exe
5172	msiexec.exe
5172	msiexec.exe
5172	msiexec.exe
5172	msiexec.exe
5172	msiexec.exe
5172	msiexec.exe
5172	msiexec.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2764	7zG.exe
Token: 35	2764	7zG.exe
Token: SeSecurityPrivilege	2764	7zG.exe
Token: SeSecurityPrivilege	2764	7zG.exe
Token: SeBackupPrivilege	1116	vssvc.exe
Token: SeRestorePrivilege	1116	vssvc.exe
Token: SeAuditPrivilege	1116	vssvc.exe
Token: SeShutdownPrivilege	2196	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2196	VC_redist.x64.exe
Token: SeSecurityPrivilege	5172	msiexec.exe
Token: SeCreateTokenPrivilege	2196	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	2196	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	2196	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2196	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	2196	VC_redist.x64.exe
Token: SeTcbPrivilege	2196	VC_redist.x64.exe
Token: SeSecurityPrivilege	2196	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	2196	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	2196	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	2196	VC_redist.x64.exe
Token: SeSystemtimePrivilege	2196	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	2196	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	2196	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	2196	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	2196	VC_redist.x64.exe
Token: SeBackupPrivilege	2196	VC_redist.x64.exe
Token: SeRestorePrivilege	2196	VC_redist.x64.exe
Token: SeShutdownPrivilege	2196	VC_redist.x64.exe
Token: SeDebugPrivilege	2196	VC_redist.x64.exe
Token: SeAuditPrivilege	2196	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	2196	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	2196	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	2196	VC_redist.x64.exe
Token: SeUndockPrivilege	2196	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	2196	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	2196	VC_redist.x64.exe
Token: SeManageVolumePrivilege	2196	VC_redist.x64.exe
Token: SeImpersonatePrivilege	2196	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	2196	VC_redist.x64.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe
Token: SeTakeOwnershipPrivilege	5172	msiexec.exe
Token: SeRestorePrivilege	5172	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1396	MarvelousDesigner_Personal_2026_1_237_Installer.exe
2820	VC_redist.x64.exe
5852	VC_redist.x64.exe
2196	VC_redist.x64.exe
2328	VC_redist.x64.exe
1164	VC_redist.x64.exe
1716	VC_redist.x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4904	4512	msedge.exe	84
PID 4512 wrote to memory of 4008	4512	msedge.exe	85
PID 4512 wrote to memory of 5784	4512	msedge.exe	86
PID 4512 wrote to memory of 5784	4512	msedge.exe	86
PID 4512 wrote to memory of 5784	4512	msedge.exe	86
PID 4512 wrote to memory of 4496	4512	msedge.exe	87
PID 4512 wrote to memory of 4496	4512	msedge.exe	87
PID 4512 wrote to memory of 708	4512	msedge.exe	89
PID 4512 wrote to memory of 708	4512	msedge.exe	89
PID 4512 wrote to memory of 708	4512	msedge.exe	89
PID 4512 wrote to memory of 5000	4512	msedge.exe	90
PID 4512 wrote to memory of 5000	4512	msedge.exe	90
PID 4512 wrote to memory of 5000	4512	msedge.exe	90
PID 4512 wrote to memory of 5316	4512	msedge.exe	93
PID 4512 wrote to memory of 5316	4512	msedge.exe	93
PID 4512 wrote to memory of 5316	4512	msedge.exe	93
PID 4512 wrote to memory of 5216	4512	msedge.exe	94
PID 4512 wrote to memory of 5216	4512	msedge.exe	94
PID 4512 wrote to memory of 5216	4512	msedge.exe	94
PID 4512 wrote to memory of 5100	4512	msedge.exe	97
PID 4512 wrote to memory of 5100	4512	msedge.exe	97
PID 4512 wrote to memory of 5352	4512	msedge.exe	98
PID 4512 wrote to memory of 5352	4512	msedge.exe	98
PID 4512 wrote to memory of 3764	4512	msedge.exe	102
PID 4512 wrote to memory of 5992	4512	msedge.exe	110
PID 4512 wrote to memory of 5992	4512	msedge.exe	110
PID 4512 wrote to memory of 5992	4512	msedge.exe	110
PID 4512 wrote to memory of 1636	4512	msedge.exe	111
PID 4512 wrote to memory of 1636	4512	msedge.exe	111
PID 4512 wrote to memory of 3076	4512	msedge.exe	112
PID 4512 wrote to memory of 4028	4512	msedge.exe	113
PID 4512 wrote to memory of 1868	4512	msedge.exe	114
PID 4512 wrote to memory of 452	4512	msedge.exe	115
PID 4512 wrote to memory of 452	4512	msedge.exe	115
PID 4512 wrote to memory of 2500	4512	msedge.exe	119
PID 4512 wrote to memory of 2500	4512	msedge.exe	119
PID 4512 wrote to memory of 1444	4512	msedge.exe	120
PID 4512 wrote to memory of 5160	4512	msedge.exe	125
PID 4512 wrote to memory of 5160	4512	msedge.exe	125
PID 4512 wrote to memory of 5100	4512	msedge.exe	126
PID 4512 wrote to memory of 2748	4512	msedge.exe	130
PID 4512 wrote to memory of 2748	4512	msedge.exe	130
PID 4512 wrote to memory of 4324	4512	msedge.exe	131
PID 4512 wrote to memory of 4324	4512	msedge.exe	131
PID 1396 wrote to memory of 5560	1396	MarvelousDesigner_Personal_2026_1_237_Installer.exe	132
PID 1396 wrote to memory of 1932	1396	MarvelousDesigner_Personal_2026_1_237_Installer.exe	134
PID 1396 wrote to memory of 2820	1396	MarvelousDesigner_Personal_2026_1_237_Installer.exe	136
PID 2820 wrote to memory of 5852	2820	VC_redist.x64.exe	137
PID 5852 wrote to memory of 2196	5852	VC_redist.x64.exe	138
PID 4740 wrote to memory of 5216	4740	VC_redist.x64.exe	150
PID 5216 wrote to memory of 6120	5216	VC_redist.x64.exe	151
PID 2196 wrote to memory of 2328	2196	VC_redist.x64.exe	152
PID 2328 wrote to memory of 1164	2328	VC_redist.x64.exe	153
PID 1164 wrote to memory of 1716	1164	VC_redist.x64.exe	154
PID 6120 wrote to memory of 2364	6120	VC_redist.x64.exe	155
PID 1396 wrote to memory of 5668	1396	MarvelousDesigner_Personal_2026_1_237_Installer.exe	157
PID 1396 wrote to memory of 5796	1396	MarvelousDesigner_Personal_2026_1_237_Installer.exe	159
PID 5796 wrote to memory of 3376	5796	msedge.exe	160
PID 4512 wrote to memory of 1380	4512	msedge.exe	161
PID 4512 wrote to memory of 1380	4512	msedge.exe	161
PID 4512 wrote to memory of 1380	4512	msedge.exe	161
PID 4512 wrote to memory of 2108	4512	msedge.exe	162
PID 4512 wrote to memory of 2108	4512	msedge.exe	162
PID 4512 wrote to memory of 2108	4512	msedge.exe	162

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://send.now/pdokg1c2sdfb
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdfca6c188,0x7ffdfca6c194,0x7ffdfca6c1a0
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,4477960544916506769,10404021381669619516,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,5378371743211639865,1886161860398880186,262144 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,15836576293448707238,9693664287843526699,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13015759232536419570,5095799570669515660,2097152 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,11084976483329620465,12731588964854128931,2097152 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5284,i,3763393392800374875,16559707187531709441,2097152 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,11155626485100687988,15562990452895033665,2097152 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,4108423972459597539,1016342132232893632,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,3648798144425581548,11251776734182950054,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,14143112853587531392,17185527357203375756,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,14143112853587531392,17185527357203375756,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5888,i,6610004686119555902,2161029206883907504,2097152 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,6263571952263134665,3312337714890365077,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,1996370295961345098,5771783114265297140,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,663588451143018795,15348342084161454949,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,1133729824751517460,10618763347574745854,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,17791312778746710573,7494459206877970666,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,6701599131820113837,1388561920449178937,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6328,i,15446349962909185447,18159692555223990654,262144 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,9278685187551073428,9887004427444170878,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,7890568261615025520,11259131612183843217,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,14280383475987672247,1478848534174228586,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,15178848898818622616,16343218381970952261,524288 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3648,i,7471123893041530330,2261811244932993743,2097152 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5448,i,17142499931824700380,14310404500662906496,2097152 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3652,i,15014385007137266508,4393069111410119053,2097152 --field-trial-handle=2172,i,11291235918247042733,13085997413310221578,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:5504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1544

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2316

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MarvelousDesigner2026.1.237Win\" -ad -an -ai#7zMap30981:122:7zEvent18121
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Users\Admin\Downloads\MarvelousDesigner2026.1.237Win\MarvelousDesigner2026.1.237Win\Marvelous Designer 2026.1.237 Win\MarvelousDesigner_Personal_2026_1_237_Installer.exe
"C:\Users\Admin\Downloads\MarvelousDesigner2026.1.237Win\MarvelousDesigner2026.1.237Win\Marvelous Designer 2026.1.237 Win\MarvelousDesigner_Personal_2026_1_237_Installer.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Public\Documents\MarvelousDesigner" /grant Everyone:(OI)(CI)F /t
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:5560
- C:\Windows\SysWOW64\fsutil.exe
  fsutil.exe 8dot3name set C: 1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1932
- C:\Program Files\Marvelous Designer Personal\VC_redist.x64.exe
  "C:\Program Files\Marvelous Designer Personal\VC_redist.x64.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\Temp\{01B682C8-A268-4533-BD66-68762E6A73BD}\.cr\VC_redist.x64.exe
    "C:\Windows\Temp\{01B682C8-A268-4533-BD66-68762E6A73BD}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Program Files\Marvelous Designer Personal\VC_redist.x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=676 /install /quiet /norestart
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\Windows\Temp\{B2D2AAF2-7892-4343-A475-3716E1205EDD}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{B2D2AAF2-7892-4343-A475-3716E1205EDD}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{93B9CB35-ED1A-4C2E-9AEB-E8F8C4384012} {B30C157E-8126-4A85-9E30-B52D78B8E81B} 5852
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2196
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1148 -burn.embedded BurnPipe.{0571422B-5EA5-49EB-BD40-BA3338A1899C} {F140A42A-F730-47B1-B189-38F0CD21F811} 2196
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2328
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1148 -burn.embedded BurnPipe.{0571422B-5EA5-49EB-BD40-BA3338A1899C} {F140A42A-F730-47B1-B189-38F0CD21F811} 2196
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{21AC441C-6B84-4EC2-A12F-0BC0748737B2} {7441869E-618F-4DD4-89DE-39D56E26048E} 1164
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:1716
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\CloThumbnailProvider.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Marvelous Designer Personal\ChangeLog_Marvelousdesigner.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files\Marvelous Designer Personal\ChangeLog_Marvelousdesigner.html
    3⤵
    PID:3376

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3128

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5172

C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740
- C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102181309.log" /install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5216
- - C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102181309.log" /install
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6120
  - - C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C6B785BF-9996-475A-A0BD-FBB4AE117079} {4ECDB500-4906-4E01-BF2D-C16D3F138E1A} 6120
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5fea3f.rbs

Path C:\Config.Msi\e5fea3f.rbs
Size 19KB
SHA256 79b61f2904dee96385fe355f330573ca4582d3cb156eda4ef8d82946910993c9
MD5 e0bb238e5736486e9750588ef21d97a9
SHA1 edfb32e635479aa0d430500562f9b92f6e157649
SHA512 04d026d8954c75dea9d0948c8b0aa2c7aea563355742cef6398765ddac84543c4f86d3b215375d01e4f0a798e64f737032237d5026c1a893f5c40122cab4f2a8
SSDEEP 192:2qRG1kRa15dXcFUADIc1L+W+y4+agPu0N7:2qRG6RaTeC81L/cwN7
TLSH
T1BE92EA42A680C9D2D8766B30CD631BA53B76DBD5A350438F50DC90348F93BCA2F9DA9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fea4b.rbs

Path C:\Config.Msi\e5fea4b.rbs
Size 19KB
SHA256 4431b5db72de194440916dcff4b5480ac53f9d2c4b5b2ade7fc5a291bc5d18e1
MD5 84fe7e4d29a8c332aad4cdba23a02e9c
SHA1 e0301c0e6e2e4b19d17eaecba711177c17a5018c
SHA512 16fc7c4eaf755fa0c275d1a85ee09009b5f4ee8544b03dc3805a4e0456079e7f2c61271c8e000e3b4cf0d3fb3fdbaeba70a8a00d85c68e7e24b98795a6ad29c1
SSDEEP 192:H1DG+fVvI+qFDw1WNRQ3qugw8efPz/I4z/jh7E99fMuRF5bpm:HRG+fVvIrFDw1WNRXyzbz2MuRs
TLSH
T1F792FC41FA44C5D3D8AA2B70CD8757243B7AD7EEA311434B01CD91308EA77CA6F9A74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fea52.rbs

Path C:\Config.Msi\e5fea52.rbs
Size 21KB
SHA256 d601c4b61c962400716c0833d02c2d12c467d4a380067f7a1ba6dbf521291157
MD5 3d3594f1cc1c64d0f5fe417496f68e1d
SHA1 a2582eab68fda9a664e0a9d9286609570af0c3a8
SHA512 fb3efd6f65e50a81c8f524651f2b6c37bd4197bbfa337631d8236ab4bc741008f701c613a17cc478d31713a8bb91ad5cb560da4c4289f7fdd35871feba6d3fe1
SSDEEP 384:0CRdGRrnAKxNAUhUC7xJjrMNYPVIbS/E2+9kWhCTgJnkP:0SkTAKhCsp
TLSH
T163A20D03768099E3C86227B1DD671BA83B73D7D99350434B10ACD1388F633C72F5AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5fea61.rbs

Path C:\Config.Msi\e5fea61.rbs
Size 21KB
SHA256 838c791f013cc5674ed4ff4b74d67482e3ebbecce72913c34b162fa367fb91e7
MD5 d4f01b9200b1bf52181af6792f33cb05
SHA1 eefc0ac1cc4b48e21ed9ce41f8e1e7a7aa63584f
SHA512 b910ae559c40b111ed18538dfccb8501f6859c6b598137f657af3c158df3844ba8b04d5f4811cd56a95e8c3a86dc6f332e3d97576b6dbe4912079cef685f71f9
SSDEEP 384:0sBiqbjuPTdpTAyjI40JLIsalckU72eC6QTvxhfhckhkLsY:0sBiqbjuPTdpTAy8hJL+TpJCkh2sY
TLSH
T190A2FE43A604D693C8AB2B71CD572B55373AC3DAA3A6434B06CC91704F837C71F9E69A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

img_sample.png

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Converting\Male\img_sample.png
Size 354KB
SHA256 1b9b329cfa4b860b84a98aab35f39669a4a5235f4437c80a013b37c686469116
MD5 51e28b0e5238872d0110cc0225fbc7d8
SHA1 35d7fe320d2fda1127f6c618b7727e39d18e9324
SHA512 458dee16d5f83601d60ce0d045ef8a02554dbb352f17ca291ce0e7e67692f7a11be0d9c5f6cd8479d6157ff4320cda6121cf25531a89faee973c4fea959ab551
SSDEEP 6144:2gKiZ1kOuZgqwFBvV3qtpCOO+b/zGMCBcnBDU1PYgSkJp3bQZQ5lpd9k:pKiwOugN3weMecnBDYF7lxk
TLSH
T14C7423C16638D5180C14DA2D03BA0628F770D46070EB9CB89057D6FAB22BDA35AFFBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

displacementData01.txt

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Resizing\Female\displacementData01.txt
Size 374KB
SHA256 184ac2ecfc09f5ecab22ba2cba42cd119ff864529a4a9b725d2e13fa818dd0c1
MD5 889db31d4ac226c531ccd740eb8eac4a
SHA1 43bfad8c13a90ff0635e50210cd689f64309e33f
SHA512 c1db1124c1c36ebd87c77215161365cd0ff59c81cb268792ce8c19bd3cff3b10532c1583f1bf08a530eb1076cbabc2f74682714e5ed39c994408f1b58fda2718
SSDEEP 96:wPPP2oo22ozPPPPPPPP2oPP2PFy1oPb55xPPNPqHvPP0oTUPP7oP0iuzPFroPoPe:w
TLSH
T1B18407D03FF03C4F7C2B720388838D3D8EEE6ABA96090A620030EA289CB2400010398E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

static_vertex_list_extended.slist

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Resizing\Female\static_vertex_list_extended.slist
Size 93KB
SHA256 40a675b0e27c76777b4617a4946ccc66e6fef6abcd1bbaade926dd0ddc87799f
MD5 ac15e38abdccf0b33a06d20bdc843b76
SHA1 99c45817b1475a3eb60fad31fb36bdb5d670ad39
SHA512 09224df63c3aaa380ec3f13493f20fd25162858c5a2d5a291ac3c8e668ca5a242d59dffb2537c940cf7a74ee9ab8624b4363ef51e76e03becfe413bbf7726828
SSDEEP 96:lWf2e2W/HOP3HuHffmWXG2u3+fPeue23G3P2v/X2PW/XnvWmWHGXfuPvv+2GWe2S:lK
MD5 SHA1 SHA512 SSDEEP

Submit Download

displacementData03.txt

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Resizing\Girl\displacementData03.txt
Size 419KB
SHA256 294e9d727a1ded9746498df23fb582f7d43da8986f0cc4a14b5ea74252d3e83f
MD5 9cf19c3e4b82cdcebf6713f0e31e47cb
SHA1 39639db8461fd15be6105185dbf0a921c5c6e3f3
SHA512 122c0cd3bbf45bf1ec0a067d40927a7fe56f3b54fd63b85a55dbbb3602727c184809d05dbbbdffe8ae4eaa81162dc13d771fba3f0f3bb57afbe3f7ab5c39f1a7
SSDEEP 6144:nMG6eM8oTBlFHhGtnjiNuEWk385fGqZbJTp3vsnI6ZGRB62dpb3ojDRHgleRel7F:ODMH
TLSH
T1BC9446B67FD6C090B41B3023C477E5B52AED30A651819C4E026BBD0B7E3695EBB2716C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

static_vertex_list2.slist

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Resizing\Girl\static_vertex_list2.slist
Size 47KB
SHA256 ad18fa4058b98b09b64b7503e389727a635d53b3f391f1e29857a33271d54f44
MD5 52881f470419ceb00b2585450ec3e7e3
SHA1 557038ff6df91da558b12be883b4699f22997eea
SHA512 762b3689d9595fa4c60a382d8cf6d7a19751a6de2893531a192d6bd4b6e1c6b318add2580dc99ae0b5f263bbc17fe76472b2bd0d4b8d60c7eb8c2c77b251823d
SSDEEP 96:lXnGeeufmenmXuXe2HvmXuXe2HP22WG3XX/X3O2P/nnu3v+/X/G3O2P/nnPemN:0
MD5 SHA1 SHA512 SSDEEP

Submit Download

relative_barycoord.rbary

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Resizing\Male\relative_barycoord.rbary
Size 666KB
SHA256 dc49cd166da02306bbbe79c97247887babf83c5bc0a93f4d5f34f14e51a51ee5
MD5 39c22aa53c31c21ea990cae3a2716500
SHA1 0074edf1a9bd648915d4e95ee7a069494d119b52
SHA512 e43f4931f164225c3ae53609143b551c7c92c60cce51af012423bea3e6a0f1cc5447e65995394c1190de492e7fa06f341d5ba56e1e6ea1d1a9bca10405cfba6d
SSDEEP 3072:NCM7K6noF4VrLw73kKP8U9lxeLUfQF57sI4i1ngZX:uadKBwoIIp
TLSH
T198E48B7D8725C0BEAD2634EBDC5B2FE9754D269E10B1F847A39AD88EC4D3136F502A10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

relative_index.rindex

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Resizing\Male\relative_index.rindex
Size 753KB
SHA256 d53fc971ae2f5ebe4db430a16720872888c0d297aacd52dbb56e20ace5da1649
MD5 ae9d3f04399750d65079fda884a04bbb
SHA1 ce2d6c03793dbf9eae26adc9f6f40f765b1d925b
SHA512 56c8ff497cd2dc0af8074263b510432e82da71ba921574b2748f020592608b6bafd748a085b30d223c2756c5d390d191e18c6847bf7b65865d703984dd4d2606
SSDEEP 12288:WYNvg//RCm+RYKoKJTFBBJI+LpWbxLj9U/:WubdOm/
TLSH
T1FBF439994E41D180D417FD5BC8E22DB91AFE30968C80B43A9E2BEF336D3294DB69541F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eye_normal.jpg

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Female\V2\9.Naomi\eye_normal.jpg
Size 18KB
SHA256 e24a518da118c77f9eacbe0c4e8c690fda4c7936680a7282c2e7591f96665de5
MD5 ef5ae5593ea2de9f7b441010fcbd9442
SHA1 6928b6b8a78dd31295c340ddd5d3ffef4269a68c
SHA512 f226b6dd58c1415f4fded63de70d6617f069ee8fb8ceb8462cfdb771936c87f7c3f8497047e1aa598a85f44ca97bfcea6c191338f0624593eff8c837051b7bd8
SSDEEP 384:AeignrjUiolFNGLawFfyl29buDFDXQFQTlGAr:Aevk2awFfC29buDFDXQFQTlr
TLSH
T16882AE1AE786DAB1EC91413AC8A653832353EF08667347567CDCF852DF342A2CD4D267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eye_roughness.jpg

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Female\V2\9.Naomi\eye_roughness.jpg
Size 28KB
SHA256 7607d78588601bc6bdb21076c63c09cc33e2d576cb99583a2a8b22621b5fb395
MD5 1db882d1fdd54fb114b0c39fbd1e0995
SHA1 d952b4fb17ebc5b1906e8c0695f262e2bb545938
SHA512 10c589a5e13cb63ff04918065aa6b33d2d7f13a88dc5ace5f9c10ebfdcbde346bb3db28f8c007ff382548ce0cc8d00288e28dcdd3af4ddffa93b81aee005032b
SSDEEP 768:ueydIlI9nPH/5RZ7dE4GPaZgYVAedbJ9G:oWAPHxRZRE4GPJQ1G
TLSH
T1DDD2C0197312B951EA04027969FB43A313372F84EB66420BB9BD3C427F31164BDAEE42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tooth.jpg

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Female\V2\9.Naomi\tooth.jpg
Size 14KB
SHA256 4bb9659a708610e0639e3e94b40eff5ec33071468c441a50f9cfea16a3476926
MD5 cf804b2fc9323bc428f535b4956147f4
SHA1 9c9c6fbc78a4d19402b1c6f81dfd470c67a9e72d
SHA512 b10eea70c984abe92a5795aec0bea4fb0f938a5753e31f5dfbcc20e89145474855fc62a485369f0464b24b2eb9e10e7a54913122c35441e86f1332dab8f7eba4
SSDEEP 384:r2woLs2MJm0W+c956oyUFnnVY5KsfJfInZfvEq47ykKr59M:r2bLJMJmFz5zyUnYZfyfvz9M
TLSH
T1B162BFD6184A76EEF774C1727C352D8FB6D5B11B3621A00990DC7888EEED8613F64B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tooth_normal.jpg

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Female\V2\9.Naomi\tooth_normal.jpg
Size 11KB
SHA256 d9563c7fc8da375ecda10316d24fe6bfda0e2791b6dec7927a6c6a4540374f43
MD5 70107b45ea3884783f492895b594f24b
SHA1 3c378e9e57a87f37da29c65aa9ebf5f0e92e86e2
SHA512 63e3b250ef937fa1aedf309b5407ca209413127e3e4e32e795487639fcfb56984a194f439d73e7382f1fe4a8cdbc3181b84267ae60817d76b25724cf42b66fc4
SSDEEP 192:r9jSM3TUg9YfYn9YcHqP2DHc9Q6K5tBbMncgbXHmXiCRmrbZOzPpXeovJIkNZTD1:rRSswuOYnCcH82bqK5TIcgTYihbItuod
TLSH
T11B32C0B9E859DED3B4161E78BA600EB29BFA58C65C1526BBD0CDB5C3830132A042E032
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tooth_roughness.jpg

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Female\V2\9.Naomi\tooth_roughness.jpg
Size 10KB
SHA256 71ae0abf14c225c4e9d50882a225cf045029860fdde5c5b5160d95038638c342
MD5 c5d9700ca1b26faff089938060a570f3
SHA1 524626ea123242bf0a2d6891e18e955c6c3390db
SHA512 a94e73896c852834a46aeebae4a391a13608e14a0dc58f1c3acd324f967954d7aefefca51c12279e867fab545ff6c6da6d073f68a93aaf12a3eb0be5f571b25d
SSDEEP 192:ZzmXNbfCLX49ODtPWyeGif2GN36GhcZEuCboBh+ibdyVlcSt:ZzmVfCjeeVhm6GhcSK+BlRt
TLSH
T18232CF84C6D247DB981B2B814D199FC6326C84DFE921B94119F28E36175FFCA8F90993
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tooth.jpg

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Male\V2\3.Nate\tooth.jpg
Size 69KB
SHA256 54b4360e0e36fcb49cb6e72e279028b96e4d02674006ae54b2d057d64024b09e
MD5 355ea828ac16584b3ae43a22d3ca0118
SHA1 31fd01f2c5ec834ec0338d90bc692aa41b09828d
SHA512 21ca8979209c886a23971ae34636d9676012253a1179af94af03bd52dde6acd3cd6fc5950db5244543d11802290b6b3046e712dbaad9ca287535378fb1120a75
SSDEEP 1536:TKjgKjUrO4wTLFIXrqbRfqmruAoje/ZqWMJOlPmqzg:GjVjeO4wT5IXeFqFmZqPA9Q
TLSH
T11963E00EEB27DF93E4D5A6B861C9C30656335B1467A32368799D6481AFB239C0E0D3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eyelash.jpg

Path C:\Program Files\Marvelous Designer Personal\Preset\Avatar\Textures\Male\V2\5.Martin\eyelash.jpg
Size 15KB
SHA256 ec2a57573849038c624dcf0825d2e6fa334501c879b5144c8c0a42ebcc015fe2
MD5 704698628c2f4bc8a301d51de18e4c70
SHA1 bb52b5531daa29090b0b908ffeabdd4723b1f7de
SHA512 0ad7e2bb044b2a211d4668fa7dcbc7d992c53d3c02a5cfcc87ca3876e853bccbdbcf7f5c4a8951f14bc85ffd0d85940ebc86b4ad88c2a2e4b6e428a2fc5558ea
SSDEEP 192:6ybWkCjry4l0q2CbWk97F8knUK/RK228bHcHEDjbvvDe+ioEuQsgWz18l:ZWBei7WwNnUKJK22w8yvvDY+ge8l
TLSH
T1EC726D99B356DC52FDE61930A985C30243318FC0A7A31277BCAC2496BF7ABD1CD19792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Environment_m07_c03.pfm

Path C:\Program Files\Marvelous Designer Personal\Preset\DefaultImage\Environment_m07_c03.pfm
Size 29B
SHA256 a7cab5d5ecd824941fdb44106a61216322a626999058de950c74619fc259be6c
MD5 c8bc1b3905475b048b50212084c057ea
SHA1 6e560a44f3b2de12a11aa64bafc0dbe3ed4b0a57
SHA512 8b9a67eea3728342475a1d97b9face307fffdaccdf5f3988bcebf9a44334f22f8ba5afd8a7ec1727831a678516e9d21d73086f1450f7369101ae5172e3f6f9e2
MD5 SHA1 SHA512

Submit Download

axes.txt

Path C:\Program Files\Marvelous Designer Personal\Preset\Knitwear\model\seed\sxsasy\axes.txt
Size 64B
SHA256 baede759ccdbfc82344785a16e83b4b02c35bdcffd10868b77ee6697be4975dd
MD5 025f9aeab69d2ee5347515548d3d88b1
SHA1 0ffa4b9f3483de826a39931b9126e5a41d4cc4ef
SHA512 c437a65dc8ec2effd9ae59de636fdc117fd5523e5447014c4e587b7ae3a72fb6c3e0c20b1449a9f1c3533265eb99a52828d305b08dd5227e8a973ef100aae422
TLSH
T163A0023B8E0DCACF3AC30CABC0AD0330208A212038001CC2204F208CCC83E008421B62
MD5 SHA1 SHA512 TLSH

Submit Download

vc_runtimeMinimum_x64.msi

Path C:\ProgramData\Package Cache\{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}v14.40.33810\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi
Size 188KB
SHA256 e55a6c147daab01c66aed5e6be0c990bbed0cb78f1c0898373713343ef8556cd
MD5 0d00edf7e9ad7cfa74f32a524a54f117
SHA1 eea03c0439475a8e4e8e9a9b271faaa554539e18
SHA512 0b6730fa8d484466a1ee2a9594572fa40fb8eea4ec70b5d67f5910436ee1d07c80a029cf1f8e488a251439ac1121fd0a76a726836e4cb72dd0fe531ce9692f6a
SSDEEP 3072:ZviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd7A:ZvipBaTDo1j//SZh7
TLSH
T1E014AF12B5808032D5EE1E344578E6A16F3D7EA09E60DE5B3364B26C1EB17C09F36E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e2db0b2-dbc6-47ba-b013-20466d4e4f5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1e2db0b2-dbc6-47ba-b013-20466d4e4f5e.tmp
Size 26KB
SHA256 e09f0c76105c4feab3a1c38b3405cea4982064ade525c3e8411d29d534249788
MD5 8e30c1878f154bb02ecbfa892f64e5dc
SHA1 dfdd8aa86bf5463e4d457fc5a585a41c6171b6f1
SHA512 f40c2948c80fb25068312fa67677aca90cef3ccbe54da000b98547acb7ad56d2e67d1bb0e74b91519e11566a04d72602140e927d30bfb329c2fbcd4b00ee4267
SSDEEP 384:n3iFiZcI63sNd8TUNTUlIm2aKMhZDw2fiBCauGlAbuai7vsa+VYYrgL/7IzdoC:yFQ638wgcpcBCaXWji7vhgPJ
TLSH
T1C4C24B36EC98D9ABEDE68BD5A74A7607DDF04253958C9AD4D9DC1C1C00D71ED030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2118b300-9433-4e7a-96e2-5c263e53cac6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2118b300-9433-4e7a-96e2-5c263e53cac6.tmp
Size 32KB
SHA256 954e30d00dc4ee2f831ff58887082dfb882b9c3652b7c659d5d8d14bb8a8f02d
MD5 5364d0667fd1fc0d08c4895724dd00b3
SHA1 55cca95e294b26b434ddd5ad25746679e3a89e97
SHA512 e708d181ea72e31f6ee1bf3cbc6c91501e5b5c18d646f93b03977954607e57d5cd7ca239b4a9e58a19d9991d66e05cc7563741b52b5ae6905619a87d0b7de1db
SSDEEP 384:ntiF+QkUSvOqsNir8TUNTUlI4gaKM+mRduw2fiBCauGlAbuam7vH7vBE/XgL/7ID:kFuHTrwgKPRnBCaXWfm7vH75EMLE
TLSH
T10CE2A3F598D79977E9AE4B87A33D2D42A9BCC113B4884584BBC91C1CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4046370a-3cdc-42ff-8ba5-3cdaa0f7c427.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4046370a-3cdc-42ff-8ba5-3cdaa0f7c427.tmp
Size 32KB
SHA256 857ad1b0f8ea0fdfd5e532da07b16bf2e13098bc9e4768d1fb6b62cc8619a90b
MD5 e93f9ce4477d00fafc5e370a75938eaa
SHA1 8d66b12a3d6dc181083017a64cb7f9bd65916689
SHA512 f4373289834ed196e3b6b23dc4019277782e67109e9c01641548819dd522783c3b2ac8ac4991f5cfe32b20d584754f6ddea8bc80720600873aaf0c9cab6f13cc
SSDEEP 384:ntiFGQkUSvODsNir8TUNTUlI4gaKMxmRduw2fiBCauGlAbuhm7vH7vBE/XgL/7ID:kFmqTrwgKiRnBCaXWMm7vH75EMLE
TLSH
T1D7E2A3F598D79977E9AE4B87A33D2D42A9FCC113B4884584BBC91C1CCC861BFD34A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

799ad6ed-5ab0-4537-9f6f-3a5de06471b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\799ad6ed-5ab0-4537-9f6f-3a5de06471b0.tmp
Size 392B
SHA256 3636d371c13ec0c972fa04df76c78c9a7a446b24de9a8d5e72a0501741827eec
MD5 9a76ca2a0e292947fb4d7a3bfe2419f7
SHA1 ffc949f8654cf6087e717f232e78e6cc4d2d8488
SHA512 31c5e8e21e5b28da1f2b4f5ca6acb54668a046e90bb137da458a1439dc28880c09c09ffc1e9ec5d9f1c21ab55c17fad6864716c042b2c3b249559498bc3c1333
MD5 SHA1 SHA512

Submit Download

7ea9a628-4bbe-4960-8de1-c6d931656f1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ea9a628-4bbe-4960-8de1-c6d931656f1f.tmp
Size 26KB
SHA256 62cbeb010b67b192520f07c9e072886b5e57cccea008cae9a106a63749a4fa2e
MD5 e6bf7853430ad8767f185b8cebf53f20
SHA1 4efd6c560aaab28a1fb41e8f437d993784835fa7
SHA512 668abb5e242213f110121571f1ea88960dee3cf2322e5aaa202d1b5a255663eb44ed9a2ca21738d35ee1e7afe707d2f58616612d674c7436b5d07191e3a6cfde
SSDEEP 384:nYiFzQkUSvPsNJ8TUNTUlI4UaKMxWRduw2fiBCauGlAbuci7vH7vBE/XgL/7Izc4:jFdPswg+qRnBCaXWLi7vH75EMLE
TLSH
T1F5C24A36E898DEABEDE78B95A30A3647EEE0421399DC4AD4D9D91C1C00CB1ED134BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9bda6313-c39e-4c9e-926e-ab5d02d057ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9bda6313-c39e-4c9e-926e-ab5d02d057ee.tmp
Size 25KB
SHA256 f0cf54c86e453160f8a8bdaf41b5abc5dc1442c1c3cbf9a7bf6046b790d7f85a
MD5 c61c25654168abc318b8a12971fa1788
SHA1 1e37c4e6cd4ac8aa30790402c9fb8fc19119a822
SHA512 752d137fbea6bd072beb04c64bc413bb490b54339bbbecb6bcf441c6af3f87d8fceab277aba65f105ad0b671668fe77f770ae6b4c6bc61793ec98b9a2d65ed09
SSDEEP 384:n7iFiZcI63sNq8TUNTUlIm2aKMic4w2fiBCauGlAiF/sa+VYYrgL/7IzdoC:WFQ63DwgcLnBCaXHF/hgPJ
TLSH
T133C24B36EC98D9ABE9FB8FD6AB4A7607EEF00153959C56D4D9D81C1D00871DD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9df5b66d-bbd5-4a93-83c7-07f76cae6af7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9df5b66d-bbd5-4a93-83c7-07f76cae6af7.tmp
Size 32KB
SHA256 5f03b1aeabe9ba316db3e186a08fdbc53b5c5516e40d88afd4d494ac8b9fc186
MD5 a299eb98702fd70107ec34f0f4c0e9fd
SHA1 d01cf9beaae6870bf7b8df79a5899a8295043026
SHA512 6fe24ac0dfa0adf1752be5ad9ba68aaf3527713080954b0926d7b60abf5779ed7e3ae8174d2357c6bb415972e7b2668988e7481a508412a6459820640a3ea9ba
SSDEEP 384:ntiFgQkUSvOzsNir8TUNTUlI4gaKM8YRdP2w2fiBCauGlAbuTm7vH7vBE/XgL/7Y:kFIOTrwgKnRJxBCaXWam7vH75EMLE
TLSH
T1B0E292F598D79977E9AE4B87A33D2D42A9BCC113B4884594BBC91C1CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

08f33aaf-b83a-4712-ae61-617362b8a6bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\08f33aaf-b83a-4712-ae61-617362b8a6bb.tmp
Size 12KB
SHA256 a0ad839181333849f6f522dec0de4dbbb76e382af83255cba7bb665cda7fb3ff
MD5 427008efe265ac26b6e2177d8fe730b7
SHA1 70f0131a2060fcebb5729d4bb7a7292415c33983
SHA512 01296a4bb68ad598fffd9034ea5408f8e7d491b4bbed7be96de4d0ea6e375090bb6c490e975d3a1720ad3a3e7ebc83ee82b104c47d7e9661e5d36e0b2326936e
SSDEEP 192:sxZPRd9B/fmsG7gaQZLB8TzodpdTHW6+WNYMDXYoRAwSIqIg5OtoJ:sxZP5B/fmscOqIBHbDXNStstM
TLSH
T13142E615AE28A93B9CC7D219FA55BF53E3F9103291C11E48AAFD8A2C15E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0910c0e2-e808-490b-b4e6-2817ae32e8e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0910c0e2-e808-490b-b4e6-2817ae32e8e3.tmp
Size 26KB
SHA256 282d46bc335af0742aa250b7ceda0002933e44087db7e855e435d9588d0e2e4b
MD5 dd833b8304c5bdf0bc6245f790daba5f
SHA1 800ceae076ed4ac3cbe976f40cb6588259a68880
SHA512 df2f2579b56a583865b6d0f9f3f53c9420118022b5beb079406664903be0a9929c197cb09489a8fc3ddb90788083b9c0022f836991b11c6e833368fe263f7665
SSDEEP 384:sxZPiB/fms566s8qMpRiYnazAW8pZS15posJWeT+DOqIBHb0ZaSEstM:sXiB/f34Mnc7WeT+D5SHbMaSzM
TLSH
T1CDC21905A924C83B9EC35D18653D7E33EAEC506222C5CEDA5AECCE1C029E1FDAB47457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

106d5147-134a-45bc-b8be-e63a00e1da4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\106d5147-134a-45bc-b8be-e63a00e1da4c.tmp
Size 12KB
SHA256 1403318ff52700f0f610a43b680e7434a721271f1bd6c6f2aff9f2c22cc52868
MD5 72bd2fdc782e85026ebfe2fce48c206d
SHA1 aa68e85ef28ba004f06c7f316c3f46e831c0da5e
SHA512 270478091966caffc2258586b5121eeab939f87080bd76b24f92d7b74017ba5933981251fc11c7aaebcb0282ea575e686701f5da5f5a91acf7abe2683e7a6dba
SSDEEP 192:sxZPRd9B/fmsG7oQZLB8TzodpdTHW6+WNYMDXYoeAwSIqIg5OtoJ:sxZP5B/fmsJOqIBHbDXUStstM
TLSH
T1BE42D615AE28A93B9CC7D219FA55BF53E3F9103290C11F48AAFD8A2C15E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f819401-4fff-43c5-b464-6c68cd93138e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f819401-4fff-43c5-b464-6c68cd93138e.tmp
Size 414B
SHA256 cc2949d66bbb487a4bb556f7bd09fa6f5e4b6fae9844f478f18aebd7d3f436e1
MD5 40d6946d4a818b4f3b0c9ee20aa3dc8c
SHA1 13b1b78961e3908ebe2c1715afd748b82140a389
SHA512 23e4f5a70ca19b55278688c03413e9a180013912c3f9171cb744dd0c01432a17575f0492160b17ce3895307925b77b71612dec3be0bae14ee8c7d32f60d08ff9
TLSH
T198E02BAAC911EC3B1CFD0B7D54540246F71513272B41984B3B3D80088FF063B558587C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d544e2d90d369e8313ce9ba8fd39c8989b4a52fe19bbdc8456b13bbe19eb44f5
MD5 dfb59bbcb76c65be3b07e3aafdfeb307
SHA1 62964b8975b9f70d0a4b0bd4178c20942c7823fb
SHA512 f69a0ebabfdeb75e7fb3601ff3f8ef3738912a0d871d3de9581b4e6a0f6a7bcd7e91c99408830af54e8108b6e34cdc06af559b77b1b401564619eb50fb9f99e7
TLSH
T10DE026870ECCC32EF788744B11A86B0CC3883A1B93C1690EB7A8C9857402C40A2CEAA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 277f2efd39a34f60def8060fd02f87ec6206bb99cc5a814cfa993a30c3e325da
MD5 e9769970b78048b5972f544057869365
SHA1 9c1227edb30867c94919f81f2f9a19cc7e6a5f1d
SHA512 1eff81b990f3a0d45cf6acf3f17b5623981173778aa4ea729a7cf720c7f104e63282a0a40accc975768e72c9e157b359221f13219f2a7e2f62406d707573dde6
TLSH
T172E07DC649C8C23EB608644B51EA5B0DC2843B1BF3C47D1E5B40C9857442840F7D77B4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5581a53614a1e37c5ec4ac2d17a1980a37a8795dbfe98ca0b3a3677bc0d75173
MD5 bc1883b2ac0f1ffbdf09d8aac6d590e0
SHA1 52bf99c3f30406c978f40918d13d90fe730218d1
SHA512 8a5cfcb0bda85211490e6d3ed26dabefb4a456d98c2eaa9ff12f40cd5ca37c4429566c82f7a9d4174b2adb9f43ec5e45615869448834b06a65f502f71f8ccf10
TLSH
T1F4E0268605CAC32EB608A44742E8538CC284361F93C1FE0FAB44C8857482A45A2D66A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 159f0a8a75a4f5b8f567f81739a66b3a9abba74e8a53daf75c242af45155f87a
MD5 f6e078d0f8d739bfd4da80987e2d31c9
SHA1 5de1f6b9ef04e35c741220c79d4edf7d7388c52a
SHA512 61acb5d958e50369e35f0337d8f5d8aa27a05e22f5a981dda492e58525d7040cb47c6bab325bbec0567e18da8264456e3a18ae86918b86543f5acba3a8a90f22
TLSH
T11961A462809ECB13DBE9DFB4C9D550C739B4E8B195B75E0B2358D8384FAB3593312118
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 2cc9b88dc874d26bb19fbb09d333ae48f073ea5e8df6f62b7fad22a50edc12b8
MD5 424a2045245020b4008bdc4252139ac2
SHA1 5a496d5b15a3e8bafd69effbec320b44c7584d6b
SHA512 8fbc6f9fb636b9c047dda4b0218555fce40c83bdad1ab654c57325bcbe437ac83d2d58ed3e358c11a741e5b650c4cc75f8f8b32af5dd31a194407daa4124061c
TLSH
T12E819792849EC713DBE4DFB4C9E518CB39B4E9B095A78E0B2358D4784FA73983B1210C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c406a3ca836975da4075a71f35961231ac96815d97aefe24d75ffd6fb8549035
MD5 5fa4e0eab7537b702db28cbc92928255
SHA1 1eaa169ddbf526240799c8f0abaae4243a68dbd4
SHA512 d62b6992eb4941c6ae752a389ba9a3364395070aa285f873facb57f694cbb5dfc723b8f2785b248eda8b8945d372d4376ff12376880e3e5529e17562fd21820e
TLSH
T140514DA2919ECB53DBE9DEB0CAD950C735B4F5B4A5A74D0323A8D8384FAB3193312014
MD5 SHA1 SHA512 TLSH

Submit Download

733bd233-61b6-439b-a91a-44395e201f34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\733bd233-61b6-439b-a91a-44395e201f34.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

193245e1-49f4-4a93-8b0c-139e8e475367.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\193245e1-49f4-4a93-8b0c-139e8e475367.tmp
Size 2KB
SHA256 e77537fd32cd103761d7659bfa637fba22cf250d8e381beeaee87a40a91931fb
MD5 f45efbd384dea23fffd0ce6d860a21d2
SHA1 c2362ce1072180d3b063e250648ba1234deb2462
SHA512 c592ab0fde6b7f0875339d788ece4a6b09de07938c96762460e11441d94d8bba3ff4c23b628b62300ce6f1d5dbdc9fe52c925ba794a5fab7b6bcfc4b295c6af3
TLSH
T1FA51EDF783F4866EDA519AF0EA146E2BDE6C0505831C3CAA85E0BF1793E2071E141B5F
MD5 SHA1 SHA512 TLSH

Submit Download

448841ad-8aa3-4c73-a0c0-59eb1604461d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\448841ad-8aa3-4c73-a0c0-59eb1604461d.tmp
Size 3KB
SHA256 7ac4102caa89810282de1c5b84c14be516b79d4d157e31be2dfefe3f5515943e
MD5 7a6aec36e48934886802e524a9bf592e
SHA1 0aa82265b1df082e0661b8a78452d3887009b8fe
SHA512 931deac2753f1274622f7009f63ad26da47ec4955515c69e4e610f6479d2f272a13783701b2668a613d3a3e67b3c8507d1286c08be5eea3412ad060c75e34351
TLSH
T1A461DFF3C3E4866ED9519AF0AB146D2BDE6D0519831C3C6AC5E4AF1B93E2071E240B5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e3ba4a51-483b-4d7c-b818-90e68b460cf7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e3ba4a51-483b-4d7c-b818-90e68b460cf7.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86b21e90-7dbc-446c-ada1-b285ae31011d\index-dir\temp-index
Size 2KB
SHA256 c84c12a02800404477eba521572839f10c51bcc7c57d4460998d8ca76f9fe030
MD5 2215c2ccf5c225e53ec88a20197e490d
SHA1 7244ee062714cb9ecc935cbab043f4f7ec36e36d
SHA512 6e457e07839ca20e24bcd4c2d4b8274c244c89e68b18d38ddb209bb186d6135aad3ae75ad36ff73a2ea8b35522bea11e77a25daa9d430700e5a88c790155ae42
TLSH
T17551B88E8D42577BFCA8177210B51489337861CC13982917A9FD9135ECC73146D5DA7C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86b21e90-7dbc-446c-ada1-b285ae31011d\index-dir\the-real-index
Size 2KB
SHA256 9ea19633476ec729d3dad86c73cb7f2427ec7f981c844d84ba12ea782819d03f
MD5 f101d7ade5ebf3881070954430155643
SHA1 2d96049c9dfe3f9829a70b1e822316742a8f154b
SHA512 79b3bc6883d9e7c93d9a576d90e33b52cc85ec56be72e353633284f3b1975be9296f0ffbc6b8f24fd0f41158a19d7f1ad8ea570825f1b198d2e94c8d6ad55cd1
TLSH
T13651825A4D024739DC8402B309E96496373AA14887883F0F61EDD236E8C279CBD5ABE4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 fcc5872b46e712590f68f7b0fb047e72d7505e5fd6f25a31fd137f679349630e
MD5 f208b1b470217e1a96fd1cc087eb83df
SHA1 a84dcb51a4c2ec1afff7e1d91f5f761e563ed92b
SHA512 14baf73abc50d5a575204f08937e8aa8cc50bc67bdf1fd4b4b234fbd7234a1d3e799cd983b926452864c8effa1f1b37a8b08c902fb8767b8df48a6031b04a67c
TLSH
T10BE0D8F729A72810E8BF9BE65031846045427885D550AC8EE12A6697257130664A6C52
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 eca21390b35415b5fbf1c042c1a8c8be9166cac1d90849d771a19f21ab5dc13c
MD5 6888a5873e9e5fd0908c5b056f41ef47
SHA1 43ccb3000607e30263bdf575877ca05dfc21a06c
SHA512 97dbf985f7a5b798c3b4ebdd6f5128344acba085e6c4864184a6f4510d5bef1d99f96f3845a49468902f7614444b0ede7661ad349a5f646e32081689a1fd6441
SSDEEP 192:ST/2dXOJhJlpfnpp3tNXVrN3w+Z6eME0DE/eeuT04vG+no+nFx:SL29ObJffppdNlrtqfx
TLSH
T1F5B2321571BB421039FE391892B5976E068271B33119E66B7FBD00B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ba1b741f-d31d-47f2-85fb-f16ed6e29cf5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ba1b741f-d31d-47f2-85fb-f16ed6e29cf5.tmp
Size 12KB
SHA256 553bbb15df3ade8dacd607f36c067aad2c66115d7a3982634e7c699a930d52d1
MD5 82c87c3bd9a510777d384d569b4ab268
SHA1 37e6fc8f3430c191689d7bb2425d4349f1a16765
SHA512 5300e51b2d62b63cf76b63b4bf03382f1d184e1074473552faa22d313864768554484bcabe38bd81766db5122988fff265ac6142f67855bcda863d20865bcb4d
SSDEEP 192:sxZPRdmB/fmsG7oQZLB8TzodpdTHW6+WNYUUZYoCE0SIqIg5OtoJ:sxZPiB/fmsJOqIBHb0ZaStstM
TLSH
T13F42D755AE28A93F9CC7D219BA55BF53E3F9103290D11F48AAFD8A2C15E76DD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdf32863-84f1-4002-b0e6-c52d8316f314.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cdf32863-84f1-4002-b0e6-c52d8316f314.tmp
Size 11KB
SHA256 cba3fdb0e192cad55065ada77fec2390449f92dbb5729cafbc213d16bbcaba36
MD5 a64c12191a6d05809ee5a2de88f9d7f4
SHA1 ea3466d7368edca50d047f9b250309d57c1f13fb
SHA512 7284615b70a1e2b04a6c3d97b03d5b6430e6eb70bf0bedc4ec05fb86df342a5660efec8893e9c55c9d355b1d31a39e4b9c5eff2c7bd5c5dded5673920042699c
SSDEEP 192:sxZPRdkB/fms27gaQZLN8Tzodpd4HW6+WNYbp/YoKAwSIqIgjtoJ:sxZPgB/fmssOWI2Hba/wStjtM
TLSH
T15B42C655AE28A97B8CC7D219FA15BF53E3F9103390C11E48AAFD8A2C15E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6d12dea-950e-498d-97f3-f5676d56ce60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d6d12dea-950e-498d-97f3-f5676d56ce60.tmp
Size 27KB
SHA256 1ded177db8190967b4530d2813844b4a77ae5a7f4672d10a44aac4a84451070c
MD5 06126dd016231a749beddf3a2af79a70
SHA1 9a31b5100b07868a1c050eb5963166237c1f8a1e
SHA512 b71b2f550179d397c51f43eeeb86a4e2a5e3b664c167c6313df03096135a0b98344a160681f261642bc95ef1bdd63fdcf8a259ecfde3ed6fdfc8741441fde172
SSDEEP 768:Px6r8j+Wviy8K8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYrooWYbgno2:Px6r8j+Wviy8Ku1jaqpLd4jjoWgg/
TLSH
T1ADC2E93B740CCB7E5FC41A9DDC5A6F972DA802C796588D408BFA944C02C77EA912B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0738686-c9ad-4b30-90bc-55c87a9e365f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0738686-c9ad-4b30-90bc-55c87a9e365f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7c49835e9b6b8fa146277d87a48dc81e101daaf19ad65fbb5ba8dbf196a91b3d
MD5 73add48444cb135e269247c7c6ba4684
SHA1 eb2dfa034e4fa6ef415fe2283a65173d9cf6aec8
SHA512 930fe5b804ab2d25e29490dcaed16774281595adf7580d6a4f3422bca99d8fc98e68db57c020682d8fbbc9f82e66e2c47eeeb7be46873a81a33046ebc283d7a0
SSDEEP 384:nliFzQkUSvPsNJ8TUNTUlI4UaKMnWRduw2fiBCauGlAbuci7vH7vBE/XgL/7Izc4:sFdPswg+4RnBCaXWLi7vH75EMLE
TLSH
T1FFC25A36E898DEABEDE78B95A30A3647EEE04213D9DC4AD4D9D91C1C00CB1ED134BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c9ea59bd5f9ea495f454caba072cd81c46fce2df99347f353f46306e469eca07
MD5 5864a19ed026fe5db2834f7b27664549
SHA1 948ae84fc8148044fee9e9d32e56b4013a75a506
SHA512 158abb05c465a5a783b33c82b915f3a789208315bbd8a9de49b6de44a1cacc2f28f4a7f277c04394bb7b1027b3a69129f75e4980835f8a31341ab8aced04610f
MD5 SHA1 SHA512

Submit Download

a0605afc-99aa-4d9e-b2aa-7d8b57779fa0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a0605afc-99aa-4d9e-b2aa-7d8b57779fa0.tmp
Size 32KB
SHA256 2d180930de4903c28db419ef8d1c08dd312abd6849e60f2c0d1f256008492200
MD5 a11647c98eb637ba7eae1841bf04d487
SHA1 89b0a2546e084246d165d0628f4dcf5830d90148
SHA512 82e36740051ca904ab01f9bd57fddcc77dd1a87aa07952c4ea80c10b27674da7b139a3d7b2f2bfa52488b91ac899b2027500f2eab3bc8fd3dd5e92cf943cf382
SSDEEP 384:ntiF7QkUSvOzsNir8TUNTUlI4gaKM8YRdP2w2fiBCauGlAbuTm7vH7vBE/XgL/7Y:kF1OTrwgKnRJxBCaXWam7vH75EMLE
TLSH
T165E292F598D79977E9AE4B87A33D2D42A9BCC113B4884594FBC91C1CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a256126d-9ea1-4a2d-a004-c36a11b2f0e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a256126d-9ea1-4a2d-a004-c36a11b2f0e1.tmp
Size 31KB
SHA256 2989a87a1a04453f5bd11511a561838128abaf4c0ebd007b337fda2b0fa2a7d1
MD5 d2e1321a6f9f293a3160d505f7010882
SHA1 59c0aa9fa9d2b1080142d0f1e865ab1d1fdd986a
SHA512 70d22c7fef15c040820bf9105c1f80ade3580cd73c49c3c1625666e40e3d486b7661da9eb825154021e27c085d4e6f4e80d12fcede1ac80652a7aafdd1cc7456
SSDEEP 384:ntiFzQkUSvO4sNJ8TUNTUlI4UaKMxmRduw2fiBCauGlAbuhm7vH7vBE/XgL/7Iz/:kFdxswg+iRnBCaXWMm7vH75EMLE
TLSH
T16EE2A2F598D79977E9AE4B87A33D2D42A9FCC113B4884594BBC91C1CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 232931e225ad407f5286e3e9e86652c8f032062c3b8473360f4548d871ea0e22
MD5 d55d46ad8f4f4473ecfb3da6d8b59e15
SHA1 f913b79ef7ad38f91c9874bc74e62e1b356aff5f
SHA512 4198fccde342b84406c7e199851d38d742f14e6a79d5943f38e9786dc6655a5142a5c3dc5bea3dc68a50da0372dc368a54dd78421dc9f76c16d7f74d6fd445c4
TLSH
T1AC412C58A6F91148F3B76E5AABF7A86E497E7D722F46D45D00110E4E0A72B00CCA2737
MD5 SHA1 SHA512 TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj113A.tmp\StartMenu.dll
Size 7KB
SHA256 0da408a71b352f6aab2c0077f8abdf86330aae9d21e8df220c40d1a55b128362
MD5 a939d1fc32a9f55076d3e98671356a3f
SHA1 2c4c66fb9b6a4b2be187577d8f8712d47a2136af
SHA512 86fa28d0dbde3c3252e682e25890d5cdd3db070d23654eb955e88867a3c9f7cc86f43d4b7f91a487fbb637bc1102a39a6eb40ec63871ce33cb1f1b067f431706
SSDEEP 96:68fXEXYNVK2YLvF8RxjknLNdXDWp/jbzHhKIakCT9KkNqvxt+F/ciB5gSB8l:6kXEcYLvFfLPGzHhxan9d2b+R7BX
TLSH
T182F1D871E7E442F2F5AB12F424662F4B4A26B9201B94D0724742168D39D11E2FE39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj113A.tmp\System.dll
Size 12KB
SHA256 1be52c4b0f82a9e50db06ccf9a4df2e59baf7448bad4372a10a435b60c7ea1db
MD5 5be41037d3dbc850580f8b7d023bd50c
SHA1 43817dbf0f5946c2c237b86153d50d760e1f94b3
SHA512 e2f6febe21ce647d0d82ca6d2842085283a9fe39c0788c2cabe6097baec447bb54ccb503156d958fc8520ef0d7ef47e6303e1466cc305383ad8a17d708a6bcef
SSDEEP 192:MOSbXQL3c1GO+kgkiGwIYbh2hreiKextZXs48po:aXQLM1GuiGgdkeBextV386
TLSH
T18A425B165B70CAF2F2110A3908A67E176B7CAE7857F448B39FE7088179943D72575383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TypeLib.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj113A.tmp\TypeLib.dll
Size 3KB
SHA256 b209ac2f66d3d5df230776d24a22fc00e519b78cdc8dba4cf576c52c8eda1393
MD5 b2871c4f928909eab221879e410252af
SHA1 ae2a20014e2eebe065b0c4d33682fdb1d166b623
SHA512 823467c3b728b6e5d8789a71fb07fc1e95e0cc66fecbab4a441077563f1c448125d0556534df80e341afabec4f4538cfcb74ca94570b220fe6f50fba87dd4cb7
TLSH
T1B051FDFF8BF69AFED403077103C34DC5676D742053A9112D9A43862939A066FFCB1A20
MD5 SHA1 SHA512 TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj113A.tmp\UserInfo.dll
Size 3KB
SHA256 94607e13d66018dcef45e1dc9d751e8197386507af9db541d82817e2be965905
MD5 f5f3ccb282231cc1d19cd7005a70927a
SHA1 50f105c3cb9a3672862c6bf32ff79a97dec13125
SHA512 62a7db9635490d8654eb6f986bf8d864d01931524e98aee22f1f9929f9be0580c27ebd6433ad5c9966f827b2dac5deda06328f9804aa8f2c80c6b166105f0b72
TLSH
T11671627AB3F418F2E5D45B7704A61CE342A6CA206751011E85870EE534D1E6FFE2EB19
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsj113A.tmp\modern-wizard.bmp
Size 150KB
SHA256 02bae6500de5e837184d049d9e797c16e3c2398fa2f7c01e058683c1617f3bf2
MD5 5153f1f0c3bd00f8893535623c2cab3a
SHA1 a1e0d3b711e45070e394ad0625c71fd8ecf2f72f
SHA512 45e4e848f3ad62548912df69de606ee192dfd07ddc9b0b150d39a7bb3f8c7aa3e5639272810789c68757fc2a957b1e34edaec32342c5ba53a8bedf019258e6c6
SSDEEP 1536:r9cCZscko16Nrji2aPVeCxFStjm0i96OuB0ABmTVFNkMVT8iuYgI+UQyy6m37gOY:uSsgD4t63cNBmTVjkMVwiuvUFyB37gnp
TLSH
T1FDE307B9913C90A35D6D770E6314D23ADA617E5B376C90376EAA786FFE7CC008361842
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj113A.tmp\nsDialogs.dll
Size 9KB
SHA256 357e519087cfc27a16a2c083389225d21af48cae138c9b0448c5d87175a3a13e
MD5 f63b78d055e5d9490dea4af5f8ea842c
SHA1 06e41953ecb4d8eee9d58716c90417c6836fe3e8
SHA512 3ec0fc799a6837be494d81f6bd9328b9d03f8c422bfdcd50859d5379232132143c46c501df046902dd03bba58588a24b0354ff91684cb4a1fd7c23c24aa4221a
SSDEEP 192:qsZFPwo/6/cwZ0W8XBAU3mR73FWNyX27:qsHo3/c8W2F/X2
TLSH
T17412E897B69984F3D2AF123633951727C7B85324F0A52C07C6738E4E78742CAAE34706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj113A.tmp\nsExec.dll
Size 6KB
SHA256 e5f5583fc1e5229f4f44bb72d8de22f270f91577b48cd6d025ad78ee4edea357
MD5 85bd58a837b4168c133548de303e8a2c
SHA1 2693a9725bb2070e14d720e4a8f7ebf6f768b1f8
SHA512 61c85efaabedbc561f33db6384e3e4cced1fd355e5cca097591af72894262fa29ba2ef6db0652ac35e29ad53707b23d97eec28a0d8ea5e44b352b974f93ec61a
SSDEEP 96:u2j2WbqkBP50RUuZ6qTHXi+f8UujJC5n2hH9ZaPYcFEiVINak2moBnCXI4:D2mHLcUuc8HXTujvvZnUqNakWBCXI
TLSH
T1B3D1067846C139B2C04E5E743C393B0F87F8D0212B318534AE4364C5E8D2AEAF828B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2658d05c-51f5-4151-82f7-b91350dce456.tmp

Path C:\Users\Admin\Downloads\2658d05c-51f5-4151-82f7-b91350dce456.tmp
Size 15KB
SHA256 9dae903943e55144645310781b53cb3230b6ded888e3a003bef89f0e0aeba52c
MD5 1d51529add165e1a26bc5dad0266295e
SHA1 15d78525763200deb28d71ba3a76c56e26fa65fc
SHA512 e367b28eb27a10138a890f85e19cf0e5f8f28bce3d9b32c5b3e4f44c4f22b14dc9d7c7e2bdf25584dd26fd69926c2fd21c12c6fd69edcdd0bcd3c598086ace41
SSDEEP 384:4Mmb+VlPrSzorz17wBbN9zkdwXdp8kCL7Jar/EUgM3:ZlmS78jYSXdp67O5/3
TLSH
T13172D09267BF4D6F6ABA1EA12D3219DE25004385A44EFC87D0507D38D965C3E2D13CA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lpsolve55.dll

Path C:\Users\Admin\Downloads\MarvelousDesigner2026.1.237Win\MarvelousDesigner2026.1.237Win\Marvelous Designer 2026.1.237 Win\lpsolve55.dll
Size 637KB
SHA256 31eee1356d392326de32018a9c2ecd75ddcd7af9f32b84a9998bc46f34cd08e5
MD5 c2e3c325b423476c72a512362d478872
SHA1 ec80a5e3bd875b40adf85373b30b19e5d801def6
SHA512 09478172ba53374529a6301e452ef7da08d2210360b2e8541a119e78750be2d29bfa88c69aec8d900f831e04924df818c10ec67876ee3cc8eea87c838667b58c
SSDEEP 12288:nNZ1Hy3vnLHtrgxXKVJJAMz4rqaHIRpoup/7Sh:eHtrgx6NAMz4r0RO8/7S
TLSH
T13DD47D86F2B113ECC1A380399259651BFBB1701913585EEF1B90CA692F17FD53A3B326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Conf_Garment_Information.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\Configuration\Conf_Garment_Information.json
Size 905B
SHA256 8a85778c238c84b92a786828935dd48f886f8ee06114b8b9acb3af6ac86ae442
MD5 4531d7188b0852847975327068cb6f06
SHA1 7e61c3b2a0163c9a53d83f03fc89291300358818
SHA512 decae086291fd1ba13cf63684262dfe384d1499482cfe67b9d0e2caa585f818a350f6ce015bae06e24d4ff09ece9fbdb9704914ce9165c6c4d461e83768f4a19
TLSH
T16611CC753614CF5308B6B5813C950783BEEE9F093F56CC9C65EA0E82669FAF1181B227
MD5 SHA1 SHA512 TLSH

Submit Download

Default_Garment_Information.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\Default_Garment_Information.json
Size 199B
SHA256 0f7417de53e78731669857a5de0b6bf18fb6fcc2aed1c9d056d5b9c1b42805bf
MD5 8a345a9a8f5af6c8f742caba574d5f54
SHA1 7bf69a3e98087f2beea94167ad99bd7e3f1e6ad9
SHA512 a6a3220d2157a0230924e2e03f5e17ae4437b4fe3284914e7604dd6708f04cb83e94d22c3b853ebb61ec7ff83c98a049524edc71d9433cbed8af6da5e5bbcac3
TLSH
T18AD0C953A8085A12043602662D100214E2AE6F0F33105C6EFEE6EA96122F571A8D170B
MD5 SHA1 SHA512 TLSH

Submit Download

Man_EU_Shirt.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Man\Man_EU_Shirt.json
Size 454B
SHA256 b7d5888eb1ad3c87b168483c65f70cd4b451b6307a61e7c9b7bff8a2767e52c0
MD5 c782e96defefe2f9e1a296bc328e5d7d
SHA1 64984741e25d271f7b13c6d0675817656c815a0f
SHA512 9eb27396b492ed1f84f7797c0c15e14b3ffca7d9919b17d2d5dc75786abd4c62067e92e2c5ea2317c296c5d3d6d28f64e0065e5cbe88233d4b67c03d02d9b177
TLSH
T180F06D1717CF07EBA391CC048A12240547BF8F44204E9A60B3D72FA07D0E4DCDD66C85
MD5 SHA1 SHA512 TLSH

Submit Download

Man_EU_Top.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Man\Man_EU_Top.json
Size 428B
SHA256 b9f95778004785285f65cb6fdc7ff543f29858f242f53e55e8cb40499aa74afe
MD5 ee0c5165ca07a16be2ef11b8e137119c
SHA1 6e0c0fb7bd68f83ebf80bef6de946a13615f747f
SHA512 3b58782662840176f804c280fa6e910a6fb126b1d8ad399b8a5b5179f9d099c521d89c25150efdc00c54ca211d992614bc5902c48a3b5182f1e1603bce90afbe
TLSH
T198E06D172B8F46EE9251CD008A16240483AB8F44754ED66062936DE07E0F5D8DDAA98A
MD5 SHA1 SHA512 TLSH

Submit Download

Man_Korea.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Man\Man_Korea.json
Size 351B
SHA256 7ec3e2964cca1cf54cb7f12aea2b1cb2bb85e8fd0e85a164fca7918d4451fb8f
MD5 a4c7e08164f9d8fe58bf9e3dc7ba12d2
SHA1 3fda1e7a1c766bad563f35ca06c0abc5644a826d
SHA512 519090478d85d682cfe3b0a19fe67b7b722eb1af540f0d5aa94053cdd9ad814e9b59abb0e1f0848f14ffc1c498a0be11c023f55762f20ef748d3cb85a40a4402
TLSH
T1A5E08627568B47E96292CD044F163400177B4F44945EDEA0B18729E03E5EAD4DE66089
MD5 SHA1 SHA512 TLSH

Submit Download

Man_Pants.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Man\Man_Pants.json
Size 370B
SHA256 fb0ad66e92522913a8e1da0c4e333b93f4712d9147418b2246c9f99c5be3784b
MD5 e5d0847cff869b9a87df8d7b6a634c73
SHA1 f7436e89cb8a28bf2777e77c84a6e19e58dfbac3
SHA512 917521e48fa5d72b797f7644cfe9a9e14ff473c31ac57efa051ab9b6addefc9565bce22102c33790237c5fd425ede571607965a56676c6aabc5ff5047e8e0e3e
TLSH
T1D9E0262B67EB0BB7B2C1CE001B05144117578F00219F0D50E3877DD0BD0E152CC6B086
MD5 SHA1 SHA512 TLSH

Submit Download

Man_Pants_EU.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Man\Man_Pants_EU.json
Size 373B
SHA256 86624dae8a7dfa81dd480a74f6dd38d8ca46b73d70710e7a60abaa24c11d8c0e
MD5 dbc2d1ba42436375c537e19e2a16aa84
SHA1 260aa605ba881f16bc3adf04de205115a29ef354
SHA512 5e2a450706993f94034f861be68c5af3e994c30a804a09419f2b22e60727a9ff8f19b4dc34c98231ce86236ae6b7a40c495a237e076c3dabba8d5f025ffd8838
TLSH
T139E08627678B0BFF73D1CD004B12684453D78F40755F59606297AEE0BE0F2D4CD59A8A
MD5 SHA1 SHA512 TLSH

Submit Download

Man_Pants_Korea.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Man\Man_Pants_Korea.json
Size 305B
SHA256 92d869fdcaeec711f1d162c890c718e7665d499b740911763e40b324e6eacadc
MD5 1143d89236d1530d1e605e14a79e01e4
SHA1 d9c462c9da20c4202844c2eac4f060f49187069a
SHA512 38e4f1528199e78e2d9474e3dce3b20d6d68becd4a57699c6c618663f988cec0d8d85a0534d10b8d9cd52bdef8ccf0b54a5bf1b35858ce136fe254fe3c633ab5
TLSH
T145E0C233A38747AA72D2CD000F01380417B38F00A05FAC90B08769D02E6F6A0DD26089
MD5 SHA1 SHA512 TLSH

Submit Download

Man_Pants_Std.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Man\Man_Pants_Std.json
Size 260B
SHA256 b610d56c27172af2135f0c8b786fe1c07061214e87692fb9250c5f53421c0706
MD5 1fc392e16ba3f6b92c65c4157cc473b1
SHA1 7f08255dd5058bd1c9fb3fdff14fdd59566d0ddd
SHA512 7441a6d03fbc2674b6b1408a2d0a0212d4a02fad47166ad9911a93f102e7de4196db073276c767d046ac837f9119642bc6384f7560e7126c878afa72c8983b06
TLSH
T18DD0A733E3D31BA6A3E4CD000B026D480767CF50B0AF6C80B15774D02F4F2A0DCAA188
MD5 SHA1 SHA512 TLSH

Submit Download

Man_Standard.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Man\Man_Standard.json
Size 300B
SHA256 11494e8ecc6808e86fe8379a986d67b690600d8bc46f9d0413f4f6284da9b0a7
MD5 30897f5a152a88cd0abbe8f14d83cdc6
SHA1 e340c08f67b4899d9c33e306692441e98d20b667
SHA512 c5ac1ca40960e224cf727577f192c833d22c5a5b828584a392f4e819b02025ede000b9a6dfb9f2241f3abdd22e8852394d526fc958a5251c3642eb2581fafe1d
TLSH
T1D9E0C22796C70BD5E264CC0447162404432B8F94606F8850B15335E07F0F1E0DDA6088
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_Australia.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_Australia.json
Size 467B
SHA256 0d7e5b0e4ad9f1673edef00319d5b4e5ad92e83d31488eb9b9cd47ae31693615
MD5 2455435180a3c106bdc412df1afaae54
SHA1 fc1991b2f58496e104d8515e0b092bb33589f040
SHA512 30719a7f28b15b7a54a0c608d6b543cc9fef505a6eadb5c2fcc9908b58cd7662acdc9ec66b453377bc61c24441cb10d1fb160e6aa0f40793431d355fbdfc385b
TLSH
T1DCF0ED138B8E0BF7A395CC084A1625048737CF18294F8A6022A738916E0EAC5DD6B48F
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_France.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_France.json
Size 499B
SHA256 425533f67c0a84fc37accfde7a4f493ce3cf7de53e9c87feca60ed14e98fa71c
MD5 26fbf0309147a0d27569a95c72cb216d
SHA1 6c47bb574afb4dcf83377ced62a0645f92758dfe
SHA512 887c297d4f4e4b352a1324fdd1272da88b80378752bcd1eb8fd9404ed70ac567b9934a7d4e2d85540f1a9ad3784e0a840e67105749b2f6972aecd0b9c0968b27
TLSH
T1C0F0E5130A8F4AEBA295DD084613240087BBCF54754E9B60A2977D91AD0F4CCDDAEDCA
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_Germany.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_Germany.json
Size 339B
SHA256 ff064c5fb147b26116d923a44b42d7ae9a7eef8b0a7bc3956c87f519f302591c
MD5 083ee77394284323b83527381258df63
SHA1 1bcec23b3c7efb84fa8045112a30eb0d2cd9a533
SHA512 e709ed66cc1dd6f9efdc5c4f10bc01ff657ed8b3f1789cc2abad8b33cc8de081fcfe138775d0f7f7e31c92bfdb3c404a866377cff8efb0e5094c669b6b05e5f4
TLSH
T18DE07D278ECB03D2A3E0CD048702040003678F40118F4A50A1C729D15D0D4D5CC6B84A
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_Italy.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_Italy.json
Size 479B
SHA256 0d58a80529b0d7b67191b7f4cc9fafa9cacd8c83591b727068d904ff469c9de1
MD5 f318375aa661c09b62fb592a0b1e9be8
SHA1 a7f195e708984360d5fcf75ff8d574df948d5fb5
SHA512 59350418f21726270750ff1a9cd1ccb6dad3f56a715e846d4a9dea8d9e0e271a7494dc698698827a1f2966ea211359a56d85e98bf4dc12fd58a14b7a723c1d2b
TLSH
T1E9F0E5131A8A4AFBA351CD088612240087A7CF04314E9F6062D77D91AD0F5C8DD9EA8A
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_Japenese.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_Japenese.json
Size 479B
SHA256 b2e1608d902db6867aceb4d3232124190d70a00b3b1ab2a68393c49639388296
MD5 b93909b4c5984976204bff70dfb586ee
SHA1 3cb2b996745a681336c6853829784e9977fe5e4c
SHA512 dd970779c02c5828dd31f2387fe487357b4c6b4d5c05dc1431f6fe28c011d3ad88cd4bf445f043ba4dc1b439f55f757a5a54af9b4bf261f4800140c5eea95aaf
TLSH
T122F0E512C9874FF6A241C908461614054B3BCF54308F9E2023D73D92AD1EAC5DC6B08A
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_Korea.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_Korea.json
Size 330B
SHA256 9ec3c1bf7ce28be8199a85379ba0eac0f5624c145bbeeece842c2f13fc0abbf1
MD5 d2e301a90e35c74e7815c617a8a7c1ee
SHA1 40cfc3149b793647a11006a293436bdeb2e683a7
SHA512 342026dda51bc20967c43b6e087cb044718dfa11c622540976d18c30afa5a29105fdfc1436ca9ac1a658cef30125492c000b2b147e6e8708821bc2d323de5860
TLSH
T17DE0C217628B0BE562E1DD080B8208004B238F4871AF4F5071933CE1AF1E5D4DD6628E
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_Pants.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_Pants.json
Size 391B
SHA256 bc5814092251d9b19806504d866d82ac3ae7191d6b2ea4b00e4e9c236a892301
MD5 a6708305fc14b6eba0f0ad0b6cab3ad5
SHA1 f5d7a59b2391f589c15f3ac2940fac2527d44019
SHA512 bc4336e13c9e38b0e8e4315c86ac6ec7fade992c67b80590289b30295ecb74357db98d571263b8b93d8a399a2115fd4091b4ccdfcf51451920c1ecd51e264e16
TLSH
T17BE0DF2757EF0B2BA2D6DD185B1D290207635F4821DF2C60A1C72D947E8E99ACD2B458
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_Pants_Korea.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_Pants_Korea.json
Size 358B
SHA256 841c01aa64d5bef795b95866a5f1518e1df0a4089454f17e317b407481f3d4a4
MD5 c65ce5dec30fc8b02e46d85bdb14bf13
SHA1 3e3f5d994ff181dd6d46b3ac3be9d32bd234d5ad
SHA512 866d0e717a6ccbdf52cd1e254847cf94f6a5088a4ecc0d3ea2786c35ffb31cffc23bcd230feba7c60f3654b64063146224d55b123e8d660b80cad129891a0663
TLSH
T179E02623A28B4B37A2D1CD184B01650013238F04199F8C6032876CA47E8E696CE5A45C
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_Pants_Std.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_Pants_Std.json
Size 250B
SHA256 941cb5ce25bdd3cbdb949585b61923fb55c414d9bf1dfae68517d39faf091300
MD5 500c6a861071255bc75b7a68458f02af
SHA1 4873c57602deacdc4ca8d1f7973f3e5db115cd3b
SHA512 1ae39585df1dcc85fa1e76f4d409c1120ed7aed1087b0508d29aff1e743efcc7805ca20f7235ba7be15fb6d7848221f9bf3ac2ca5361293786baee914dfc9b0c
TLSH
T171D0A737F2CB1F16BAF9DD18031689C905574F56A0EF0C40B44736D06F4E2608E6A0DC
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_Russia.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_Russia.json
Size 456B
SHA256 8a1a64df0fade5107a7de583c584e896687488d02c778e76da2ff3cd8037403d
MD5 bde43ebedb457b7dc773d3f9157fd62d
SHA1 f31a1a2aaac36e3755e850147338a404622b7a8c
SHA512 cbd5e0cd3a390b5bc4ba6a2e873a7e832b2764a77b1f2733bf1f44be0685cd4187fac4917956f07e987ab063994bddc9f2c76d0bd3ea90dfd640b9f20cc66181
TLSH
T171F02B17578E4BEBA251CD044702140087A7CF14354F8B6022576D91AE0F4C8CC5BACA
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_Standard.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_Standard.json
Size 329B
SHA256 297457f14677bd00b0d78bea64294c69fbf81e1a50c03b82b7d521eafaa907ca
MD5 24511ff42f05a86dc556319961171d50
SHA1 e6c898e5b598d3684058d9b3bdde2ba63dcb2e3c
SHA512 ee00c7d9edc68f437febda31b648f90bfd061b9b48729ab8aeac62adebf05ad247c1664c03e82610be53646a96e283759f4faf95202bcf589082c9687d8626c3
TLSH
T180E0C227A58B0FE1A6A4CD08074214044B278FA460AF0E10B09339D19F0F1D4DDA528E
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_Standard2.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_Standard2.json
Size 336B
SHA256 e5d7fcae8e74b0af27e67ea9b2a93954063b48ddbf632cf367b979f9c536f5c6
MD5 21b899b1d1ec880d7e9b0258325cbb22
SHA1 c396ce4ba8ab51397258cf9ce11ce46c74619226
SHA512 ff5bee25ef7461e751416a841def460527fb6730db3d386f14103d878195bb3544c9a3649dc95f2f29b743278e6f697a70cb26dd70b45b6d8dfaf2c2592a8ed4
TLSH
T142E0C227618B0BE1B2E2CD080B0214004B338F44A09F8FA0B0D37A90AE5EBD4EE6518B
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_UK.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_UK.json
Size 475B
SHA256 f8b1746210bb4ce7314f2520ac07a4828fdf431133e7f2d11a2c4e00ba2962b4
MD5 313fc2163136e86ca98c4bafaa30012e
SHA1 8ccfc085836f4f0d8b2f99fdca5c4c0c43761f44
SHA512 ba83558ceb625dbe4f8a44e86772135f376b2390eb1dd0bf781c28049f14721432f3d9c8b6427a8fb576fb08cc77535213bad5bb1dfabb8ab4104ad65e28b7c4
TLSH
T1DDF0E513D68F4BE7A241CC08460624048737CF18314F8E6022973C81AD0E6D5DC5B48F
MD5 SHA1 SHA512 TLSH

Submit Download

Woman_US.json

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\Garment_Information\SizeChart\Woman\Woman_US.json
Size 472B
SHA256 59e033ae60be03b82c4a3341c9b96d12b9be440f9ad2c42331dc4a79bfd1a505
MD5 53515c17f8e07f0ec40a43ac21698176
SHA1 0f10d2be69db36bb2ff5feec20f0a49252bc3f9d
SHA512 90a579dc1a18865b77f88abf46176db09b680df7a0307127140fea580d0c6d6b8acf5871ecd5731fa44bfae7a30fa0a0e89d33753f88146a01b13b50201f880c
TLSH
T1C3F09B23D68B4FE7A351DD0845122408477BCF69714F9E6022973C91AD0F6D4DD5B48F
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\python311\DLLs\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\python311\DLLs\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\python311\DLLs\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
TLSH
T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

py.ico

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\python311\DLLs\py.ico
Size 74KB
SHA256 150c470f9943b806b44312efdec85755f22f8d7d52b31f93a9af3c43e8627381
MD5 b35f68a3086562c4d5453faad5a3474e
SHA1 673904ff9b305a6600e47ad715289122ec0b046a
SHA512 6ec80921942b3bd3c85ef24a2de5454a34a3ad11a1bc69b601aea7b873e318073c0b2d78c26685999f78ec64a86282c08c53ab8d77e41c661ae968ea52c08176
SSDEEP 1536:+sNNRmOha6UEm3BL61Z4tXSZ6HTk1FaA87Gl6L:+2No6UtB+1eJ9Z
TLSH
T1CA73C3A33B9EBEDEE8A089B16B76C1D72D54FC554646200FB0B1BB1670752A3381DD32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyc.ico

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\python311\DLLs\pyc.ico
Size 76KB
SHA256 fda28a734788a3f175cb6aed4daeb5f05f0e49f6a272ccd2051ba337f7b3b42f
MD5 b1c9980131a3f20e344aa3aa2c8dea49
SHA1 0fe02f0ed5e56bbe7e4e98b1dca061ed17fbf5c7
SHA512 84ca107ace44fa1964c6c1ea93fc767bde88363339fc426a3d660da53c84bade14f1fae99c494483bf2b5312938d84b0c1733c85e82592b8ffe8a28f76186a3a
SSDEEP 768:WNXYu6xYBxqjlETx2UjHe20dH397tiKZoZa1ABtc8Yg2zR51ZV2vL2inK/fR1:sayx2lETxN+HTo8+bil1ZqdKX
TLSH
T11A73C4473AAE92A9E9F05130577783F31B2C2DAA51A0E10AB5917B45B63C1E3790DF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyd.ico

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\python311\DLLs\pyd.ico
Size 81KB
SHA256 c4ec1845a5724b2a83500f3bd940355e2fe26efc6b4fe6c208365359a6130da1
MD5 1a8230030d821cf8ea57ce03aaead737
SHA1 12656788b1fbe4d2375ecc2989a4d9da69caa0d6
SHA512 af6356dc67249e724ae30f65ddefb4e53c6f2703da32fd5f135598bbd6189bee70950242f52985478de99979d1271eec9f4e2981a29a9bc02c673e9b668fd0c1
SSDEEP 1536:fVLhV30CuzZO5Wf/DGsea4SNum23KXVDTEhr:f1hV3Uz447lea4muXG1TEhr
TLSH
T1B58326433B4EBEE4E89423B1647AC5971E64ED6910C2259FF0C5BB0736B95A3380CE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\python311\DLLs\pyexpat.pyd
Size 193KB
SHA256 58b95f03a2d7ec49f5260e3e874d2b9fb76e95ecc80537e27abef0c74d03cb00
MD5 d7ecc2746314fec5ca46b64c964ea93e
SHA1 39fc49d4058a65f0aa4fbdc3d3bcc8c7beecaa01
SHA512 d5a595aaf3c7603804deae4d4cc34130876a4c38ccd9f9f29d8b8b11906fa1a03dd9a1f8f5dbde9dc2c62b89fe52dfe5b4ee409a8d336edf7b5b8141d12e82d2
SSDEEP 3072:kbc8RnClmm52ApTkIS1uDH2dbjuBYI0XmQtVkPzlOzcURIbLhIz:wc85Qmm53TkDuD2devODtqP3U5
TLSH
T1EC146B57B1A6C0EBE8838038D6934B07DBB2B865039097CF12D4E77D9F277923A68315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat_d.pyd

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\python311\DLLs\pyexpat_d.pyd
Size 397KB
SHA256 c6e5ff4cc57b42db734f08e5e2b52e4411c5e986474e83de3f965c6faeddd0a0
MD5 937f5a7e36fcf7915f250c2956193b97
SHA1 fc26c59220a624f11c6b93d7c1a3f4a2419e83be
SHA512 98ec3d19478ad3c65e92a3bf6173cf04f6cf762d28c8980a0710476a2ffa567abdf5765d43d1f7ec2e0e955ecb1ad4c20431cc85d5e44cd73b8301401313f31a
SSDEEP 3072:sLr+tBuhHVtgTlYd/qL4ioZzKOeRKWWWWWWWW2Whfr6NQcDPQisE8eEOw5A3fEdk:sLUS8QZzK1EzgYkke8rLhdF
TLSH
T1F884D613E9F642D1D8F6D03C86176223FDF4789A472463D39794AA2A5F72BE0A53D380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\python311\DLLs\python3.dll
Size 65KB
SHA256 920350a7c24c46339754e38d0db34ab558e891da0b3a389d5230a0d379bee802
MD5 35da4143951c5354262a28dee569b7b2
SHA1 b07cb6b28c08c012eecb9fd7d74040163cdf4e0e
SHA512 2976667732f9ee797b7049d86fd9beeb05409adb7b89e3f5b1c875c72a4076cf65c762632b7230d7f581c052fce65bb91c1614c9e3a52a738051c3bc3d167a23
SSDEEP 768:iw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJSv:F/5k8cnzeJfRIbL0D7SyZxEL
TLSH
T16B637F529B54F8A6DAF665FC38D19DCE143B12CC87ED88DCA57893D30E1A310A62734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\python311\DLLs\python311.dll
Size 5.5MB
SHA256 2835e0f24fb13ef019608b13817f3acf8735fbc5f786d00501c4a151226bdff1
MD5 d06da79bfd21bb355dc3e20e17d3776c
SHA1 610712e77f80d2507ffe85129bfeb1ff72fa38bf
SHA512 e4dd839c18c95b847b813ffd0ca81823048d9b427e5dcf05f4fbe0d77b8f7c8a4bd1c67c106402cd1975bc20a8ec1406a38ad4764ab466ef03cb7eb1f431c38a
SSDEEP 49152:7KUvq5S8qfFIbGoSieBCZjze3eWVWhQNkGDiUWmtAoaOvi26g2je7wkUB3AO1Fp6:7KUvq1quUqjTPGzuvihAs2oH9M8I9URf
TLSH
T164467C2672609461C87B8472EA2F924BD7B67C501F20CB0B51A4B7AA2F73B531EDF345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311_d.dll

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\python311\DLLs\python311_d.dll
Size 10.7MB
SHA256 651e6156fa3269b9d740480bbf129bd2667d9fe80307e7583c9480dcadd0c37e
MD5 2d9117ea7b24f4abe108875df00427d5
SHA1 a5c50cb214c5fa43f0390bd84e9ea9b3ce07b332
SHA512 5e0853b84cdd6199768f22dbcf5581b25e85e0483535f124251fd43d9bbd911496be18637dbbd29fc9453be4112ddc85450c87ad849dbdc71cd6dfa5b06f0c81
SSDEEP 49152:ebAksmf8foMbsNrWHYtNTg94FM9CTvNTbyBoFWvHPP+OhiSqfJyI66z9PRtCN7Ki:q6gMo9yH5E8fCHnGMOvtBpnR
TLSH
T113B6C457E6B281E5D8BAC03996272263BCA1BC54873897C79704770B4F31BE1E6BE740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\python311\Lib\test\test_importlib\builtin\__init__.py
Size 147B
SHA256 6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225
MD5 c3239b95575b0ad63408b8e633f9334d
SHA1 7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc
SHA512 5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25
TLSH
T114C09B52CCB3E5101014DB0C7A016DA6ED2CBC373D776192F50CC160E7754A585535DD
MD5 SHA1 SHA512 TLSH

Submit Download

__main__.py

Path C:\Users\Public\Documents\MarvelousDesigner\Configuration\python311\Lib\test\test_importlib\builtin\__main__.py
Size 62B
SHA256 b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216
MD5 47878c074f37661118db4f3525b2b6cb
SHA1 9671e2ef6e3d9fa96e7450bcee03300f8d395533
SHA512 13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5
TLSH
T1DAA002A6E057D306652581483D40B26053B1C4272F52044199555233D3518D44924D4D
MD5 SHA1 SHA512 TLSH

Submit Download

Polo.json

Path C:\Users\Public\Documents\MarvelousDesigner\New Assets\Modular Library\Block Presets\Polo.json
Size 234B
SHA256 3bc0f4e29dd660a670b5c3119591bf9d75fa115ff32aca21c7a6b5e421edefe2
MD5 6ecb15576d620f3708134d45de341d7f
SHA1 fb92e388dfa5569b3967d610d48af2cc08e0e181
SHA512 d01187d29364c2c9ef3874772f86b99aba0296902ce9f32a35f52a2e454e7ecd7330bd838bcb0b5388f260e9b1cb3a36701b9767a62aad62afd982a194db48fa
TLSH
T119D09241746501E20AE5A9941DEF245DE02F5FB8880B241A441AF3C1824C00BCB4232A
MD5 SHA1 SHA512 TLSH

Submit Download

block_preset.json

Path C:\Users\Public\Documents\MarvelousDesigner\New Assets\Modular Library\Style Presets\Men\Bottoms\Style\block_preset.json
Size 206B
SHA256 b4d74602842335007ac2e298dea584f9dbb6c4c3766a16e1905c6e5fa1e5ae33
MD5 2ff6ffca1d5970c91fb1b4c5472e066c
SHA1 615b7b3b55320a21e0e3ccb8d5a60018137ba40b
SHA512 cb7463d77582f57303f374933b6275f9cbe1880b78c5bccb12bea08d9ed9665aa861a7a8bd832fcd235a9d552a3818e57474ba53dc75a205218bba6c3d562fdc
TLSH
T1FBD0C952797400AF09D2EA910D4F150CE01B4F78C84B3D28002FF3C1420C303CA0A326
MD5 SHA1 SHA512 TLSH

Submit Download

block_preset.json

Path C:\Users\Public\Documents\MarvelousDesigner\New Assets\Modular Library\Style Presets\Women\Basic Shirts\Style\block_preset.json
Size 770B
SHA256 dd664040e1fa7932b4a888c7e61a59e3036d5f526cb03606e49690a14dc73fba
MD5 2a750fd1ea30cf1a29a061d8cafcd53f
SHA1 6fdf4616be3e0205779a98b067265a32fe59b51d
SHA512 0f10eb32907715d7a69b3bc68337b6531f6b34b03b315eada2ec958298e63b8ee6373134e70558922053aadd368a0e8ba4fc33f4c39b315d4875b9792e936080
TLSH
T1B401964574A511E30AF5B6AC2DFF645DE82F5FB8880B241A841AF3C2824C12BCF4637A
MD5 SHA1 SHA512 TLSH

Submit Download

Drop Shoulder_Back Body_2.png

Path C:\Users\Public\Documents\MarvelousDesigner\New Assets\Modular Library\Style Presets\Women\Polos\Drop Shoulder_Back Body_2.png
Size 30KB
SHA256 a4e8c634556b891315736b0dee750a4ddb1502e5d82326dbfebbc64b0b680d0b
MD5 7a0b90a559d1b6aeaab19c3cd99db7cc
SHA1 183ff8abacd96766c3171c0f5f665ae510b6d0e8
SHA512 4ee9744d306208884d34dda3114e4d7b2bb8d0574b18ac484d470b1ee2814a89b052517f8e3ce9eaf990b0e16851bdcada78d6cd7ac4408a4aea809e9fba3e4c
SSDEEP 768:h2F+X5lqy+FPBkEb2ZzAOChiH9/yqKWHycj8R:htJsy+pd2chiH96qKiy1R
TLSH
T168D2F12DE262CA8D86FC12B1880BE81A03E05CB8C605A70376F587E187AE96F5723755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{4E88FE23-DF9E-47FC-8D19-28C28C85500E}\.ba\BootstrapperApplicationData.xml
Size 14KB
SHA256 425abb40bf4d19bd3dde338dd84d92291627add00c6a362fbb2332ad82c5e411
MD5 99a9993a1d79509b0878c8df89de6bba
SHA1 91e3e876dc0740c455ab3a3d1f275dff32642d91
SHA512 df2adba98e6eb4310c8d36790247fcb64f6d06070017418454b6ada15390dc2ea15df10f5aed7a9d01e4777b665b8f3b281f8966c0ed0dace2093c481b0ef1a7
SSDEEP 192:X0svCDnH5zHqQHG0Hd8Hz7HE06HA0rH3pLplfHtHxLUrCzLG0L4+tHJJ5J0JI0Bc:X0s2dLbmnoNJtR0uJk+tAI2VEpxEQ
TLSH
T18662B3142AFD0059F1F34F88EAB555566A76FC963E38C81D01612E0F48B3E819972FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{B2D2AAF2-7892-4343-A475-3716E1205EDD}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{B2D2AAF2-7892-4343-A475-3716E1205EDD}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\Windows\Temp\{B2D2AAF2-7892-4343-A475-3716E1205EDD}\.be\VC_redist.x64.exe
Size 635KB
SHA256 8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c
MD5 ae0540106cfd901b091d3d241e5cb4b0
SHA1 97f93b6e00a5069155a52aa5551e381b6b4221eb
SHA512 29bb486bfdd541ba6aed7a2543ff0eb66865af737a8fb79484fb77cb412c3b357c71c16addf232c759d3c20c5e18128df43c68d1cba23f1c363fd9e0b7188177
SSDEEP 12288:1nMwHskY7gjcjhVIEhqgM7bWvcsi6aV/LIysU40vy3W/ceKSHMsiFyY6XN:ZMysZgjS1hqgSC/izDfHjymk4HM5yJ
TLSH
T13CD49E3295614036E6F106B3B928E2347D7CE21827148DAEE3E8ED5D3EA849177F7247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{E29591AD-FF76-40C8-A341-2E96FB842717}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E29591AD-FF76-40C8-A341-2E96FB842717}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{E29591AD-FF76-40C8-A341-2E96FB842717}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-6808-0x0000000000280000-0x00000000002F7000-memory.dmp

Download

memory/1716-6805-0x0000000000280000-0x00000000002F7000-memory.dmp

Download

memory/2328-6809-0x0000000000280000-0x00000000002F7000-memory.dmp

Download

memory/3764-264-0x00000259C4CE0000-0x00000259C5CE0000-memory.dmp

Download