7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Resubmissions

10/09/2026, 01:47

260910-b7n1datcle7

02/09/2026, 16:23

260902-tv7k3aam3y7

02/09/2026, 16:11

260902-tm9qfssvdx7

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260910-b7n1datcle
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
4748	forfiles.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2012	powershell.exe
1808	powershell.exe
4624	powershell.exe
5648	powershell.exe
5128	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5432	cmd.exe
436	cmd.exe
2504	cmd.exe
5784	cmd.exe
3824	cmd.exe
4296	cmd.exe
4840	cmd.exe
4972	cmd.exe
5572	cmd.exe
1224	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1924	6016	WerFault.exe	121

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\NodaTime.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\NodaTime.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\dp0DBlecg.lal:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\Shared.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\NodaTime.csproj.user:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2012	powershell.exe
2012	powershell.exe
1808	powershell.exe
1808	powershell.exe
1808	powershell.exe
4624	powershell.exe
4624	powershell.exe
4624	powershell.exe
5648	powershell.exe
5648	powershell.exe
5648	powershell.exe
5128	powershell.exe
5128	powershell.exe
5128	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeIncreaseQuotaPrivilege	2012	powershell.exe
Token: SeSecurityPrivilege	2012	powershell.exe
Token: SeTakeOwnershipPrivilege	2012	powershell.exe
Token: SeLoadDriverPrivilege	2012	powershell.exe
Token: SeSystemProfilePrivilege	2012	powershell.exe
Token: SeSystemtimePrivilege	2012	powershell.exe
Token: SeProfSingleProcessPrivilege	2012	powershell.exe
Token: SeIncBasePriorityPrivilege	2012	powershell.exe
Token: SeCreatePagefilePrivilege	2012	powershell.exe
Token: SeBackupPrivilege	2012	powershell.exe
Token: SeRestorePrivilege	2012	powershell.exe
Token: SeShutdownPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeSystemEnvironmentPrivilege	2012	powershell.exe
Token: SeRemoteShutdownPrivilege	2012	powershell.exe
Token: SeUndockPrivilege	2012	powershell.exe
Token: SeManageVolumePrivilege	2012	powershell.exe
Token: 33	2012	powershell.exe
Token: 34	2012	powershell.exe
Token: 35	2012	powershell.exe
Token: 36	2012	powershell.exe
Token: SeIncreaseQuotaPrivilege	2012	powershell.exe
Token: SeSecurityPrivilege	2012	powershell.exe
Token: SeTakeOwnershipPrivilege	2012	powershell.exe
Token: SeLoadDriverPrivilege	2012	powershell.exe
Token: SeSystemProfilePrivilege	2012	powershell.exe
Token: SeSystemtimePrivilege	2012	powershell.exe
Token: SeProfSingleProcessPrivilege	2012	powershell.exe
Token: SeIncBasePriorityPrivilege	2012	powershell.exe
Token: SeCreatePagefilePrivilege	2012	powershell.exe
Token: SeBackupPrivilege	2012	powershell.exe
Token: SeRestorePrivilege	2012	powershell.exe
Token: SeShutdownPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeSystemEnvironmentPrivilege	2012	powershell.exe
Token: SeRemoteShutdownPrivilege	2012	powershell.exe
Token: SeUndockPrivilege	2012	powershell.exe
Token: SeManageVolumePrivilege	2012	powershell.exe
Token: 33	2012	powershell.exe
Token: 34	2012	powershell.exe
Token: 35	2012	powershell.exe
Token: 36	2012	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeIncreaseQuotaPrivilege	1808	powershell.exe
Token: SeSecurityPrivilege	1808	powershell.exe
Token: SeTakeOwnershipPrivilege	1808	powershell.exe
Token: SeLoadDriverPrivilege	1808	powershell.exe
Token: SeSystemProfilePrivilege	1808	powershell.exe
Token: SeSystemtimePrivilege	1808	powershell.exe
Token: SeProfSingleProcessPrivilege	1808	powershell.exe
Token: SeIncBasePriorityPrivilege	1808	powershell.exe
Token: SeCreatePagefilePrivilege	1808	powershell.exe
Token: SeBackupPrivilege	1808	powershell.exe
Token: SeRestorePrivilege	1808	powershell.exe
Token: SeShutdownPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeSystemEnvironmentPrivilege	1808	powershell.exe
Token: SeRemoteShutdownPrivilege	1808	powershell.exe
Token: SeUndockPrivilege	1808	powershell.exe
Token: SeManageVolumePrivilege	1808	powershell.exe
Token: 33	1808	powershell.exe
Token: 34	1808	powershell.exe
Token: 35	1808	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2196	Setup.exe
2196	Setup.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4840	2196	Setup.exe	88
PID 2196 wrote to memory of 4972	2196	Setup.exe	90
PID 2196 wrote to memory of 436	2196	Setup.exe	92
PID 2196 wrote to memory of 5572	2196	Setup.exe	94
PID 5572 wrote to memory of 2012	5572	cmd.exe	96
PID 2196 wrote to memory of 1224	2196	Setup.exe	98
PID 1224 wrote to memory of 1808	1224	cmd.exe	100
PID 2196 wrote to memory of 2504	2196	Setup.exe	101
PID 2504 wrote to memory of 4624	2504	cmd.exe	103
PID 2196 wrote to memory of 5784	2196	Setup.exe	104
PID 5784 wrote to memory of 5648	5784	cmd.exe	106
PID 2196 wrote to memory of 5432	2196	Setup.exe	107
PID 5432 wrote to memory of 5128	5432	cmd.exe	109
PID 2196 wrote to memory of 4748	2196	Setup.exe	110
PID 4748 wrote to memory of 4104	4748	forfiles.exe	111
PID 4104 wrote to memory of 4208	4104	cmd.exe	113
PID 4104 wrote to memory of 6080	4104	cmd.exe	114
PID 4104 wrote to memory of 3824	4104	cmd.exe	115
PID 3824 wrote to memory of 3432	3824	cmd.exe	116
PID 3824 wrote to memory of 3312	3824	cmd.exe	117
PID 4104 wrote to memory of 2652	4104	cmd.exe	118
PID 2652 wrote to memory of 4296	2652	conhost.exe	119
PID 4296 wrote to memory of 4140	4296	cmd.exe	120
PID 4296 wrote to memory of 6016	4296	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5128
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0 /m dp0DBlecg.lal /c "cmd /c ren @file dp0DBlecg.bat && call dp0DBlecg.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "dp0DBlecg.lal" dp0DBlecg.bat && call dp0DBlecg.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4208
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:6080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3824
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:3432
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:3312
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\dp0DBlecg.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2652
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\dp0DBlecg.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4296
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4140
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\NodaTime.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6016 -s 1644
        7⤵
        Program crash
        
        PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6016 -ip 6016
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 52c3278fd60a3fa44f4491584a21a403090cfe12204f9e4b7f45f40e7d10f9b3
MD5 ebebd4ee9e273954a351a240d6b7a5d3
SHA1 87dfcd8ea5bc34269e6b2b325ba1e3b4f1ea5f97
SHA512 dd00237be24baaae5556304bd9b26d35a4ab8adbd884f8f4cb25f92697aa4a63aa55d0ede1ecc8b56f1646047402a714a378ea47644e45a9a4ca14d78fdec405
TLSH
T17B318637F3DC8611CC9A003A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cc23463b072e7a49057e9ee191e6fe202505164e5946b79e141624a5bf7e68c3
MD5 19440c1cf66c0f121947eb818718e5bc
SHA1 a5f24b428f6a0368723da22dc7ed948a010ca695
SHA512 67209480c6dc1d80681b58649d277469badc158d90944f66093fdcc36c1204404dfbc00e01e35ba862b21c55aaf57f454520276acd853fd1c0eea6fcac54e044
TLSH
T1FD219837F3DC8214CCA9403A10DDAC1036BAC7CB40DECF9B6B85E159A82F298CF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f916075ccf4073a18383b78278ce7314465bfca8b1a3e536e423e33a8f791c16
MD5 5d498fa4aa3c42d31dbff1bb5838ffad
SHA1 551cff960c3dc385c3ee185c2024fb03d47d8d78
SHA512 75c96b82a7a49feeceb1869e5f972192257f95290dd65dd9c92d6132175ad077b7d9305f35061bf2748cb7069e5ce40fa7e152befbaa5800e0180c416ffb9dc6
TLSH
T15D219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1104eec9f0b104ed48aee04a6bf5be771ecbca9612905a22a20a14bc6898f9de
MD5 8fa303ff4cbd2d2b5df2dec876ca5e37
SHA1 ceff6a9208202c77782f57787a8261070400cfec
SHA512 5365681e78515bb7606cef3889dd9d7fdf988b4c727607ec0464d563a959728763387604c13f5a717ffd820774dc83640e35524b8aae89d4a3371aee6ce18b83
TLSH
T1F6217633F3DC8224C899013A10DDAC1036B687CB40DECF9B6B81E159A82F298DFA0160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gc0n1ctf.ssq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gc0n1ctf.ssq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1789005336.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1789005336.tmp
Size 1KB
SHA256 8457536026c5a91e6484cad6895361b4d5a46198a43f9a11a09e9dc14cde0b3f
MD5 63488d33b368923877ba4f462a79f9d6
SHA1 eaa1fadb363160101423046b3761d59580fe25aa
SHA512 fea59ff745f9e270a4eb215340d5b2fdd5c90ef2a455142bf176b8815a198662ec85685f0f86928f1e63e536d8216ef97228ad7905c4932eded50e65efce8483
TLSH
T14A310A33C1E587753575B28902424E18EF6A2E8BA49F96E0964142BD7047D3B96002E7
MD5 SHA1 SHA512 TLSH

Submit Download

NodaTime.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\NodaTime.csproj
Size 15.9MB
SHA256 1fdd14b2565d05621dbfd374affb928942a35e640611cdbf15b377c95466964d
MD5 f7af6cf5cf9f35a19fd6ab1d0ae96355
SHA1 84d71fba40b2c7d147d9acb1f190d8478b470e19
SHA512 e99a10b162cdabbf882889b6f4705d8b57ad0d09847d140ce9b7d9b6850e9b7e0fcf0a5e27fcaee37a649ea68a528a0b8ae7c7b5c62424956f3b9d314e3945f8
SSDEEP 1536:T3BswhWpBgBJ7SmfC5kCWrTWZ0KJqGBvOjr/wF06VWQrQma/j+SAP+9Qr/16QW9b:7
TLSH
T15FF6BF36038087E6E2CC67C4446B299E22B9F66639252784FF732BFEDC55AC79834147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NodaTime.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\NodaTime.csproj.user
Size 312KB
SHA256 f819f43e560b64d9d93e824307b5da2a33f5a49756fe38bf33ac1b432e30a87d
MD5 e112c60bdced9bc661f8e3c9b798ad83
SHA1 967de535e97f6ea6009cf2f2b393d5a46e03da24
SHA512 5e87278c32c5418574c87807e7f078c1f75e46d515e293254e15174db8b16bbc05914a25c76f2ff7005464d5edb066715fc1cd5e54d84af599760d266d2cf8ad
SSDEEP 6144:djCzZN4tU4gUNqEBZszgZ+49N4klalaF1JaPaLHHkN6QhUOyIsf:zhbf
TLSH
T1B56400F494FF61A2E34B89052AECFE5442B231D79FCB395863AEA3518F987167B4400D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NodaTime.csproj.user:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\NodaTime.csproj.user:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

NodaTime.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\NodaTime.targets
Size 545KB
SHA256 98b3d08c8475948de22887e1972f69bee5d45e3f2969c229879a4b3dfef25d2d
MD5 1f418a5d47c936a1f230cb6e321667a0
SHA1 66f182f5e82ca001a96d51bb060198000a0fdfb8
SHA512 a73fcf9f1d9e83ed5dabab47786455de9425b3783d4da93d6c2d3ab467b6b88f089cb618612b5b31a732a5ea9d84753d7402b4fec94f0d2bf96ff97e1e702b5e
SSDEEP 3072:cYDDcDcDDDabOsHLhQfDUWG2r+4EjY9wS+YLsf/17Gq1K3y0/aIPHcXze:eisrGfDUFaFEE97Lsf/L0/aIvcXze
TLSH
T123C4437895CF54B5F6AF812979EC7EA601B331CB97C62E60436CE0504BE8F963E4588C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shared.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\Shared.props
Size 144KB
SHA256 c687209c04f837006e4821132bd4a9be6ea8959049a76bf253fe456c2140c2bf
MD5 725025a7fd48f7cbef82db24dc0034db
SHA1 4a05f3db9c50c3012661a72dc3eb7f8c8163dec2
SHA512 03b55bda71055d5ee2adbf89f2d5a30ff1a84a5d2bbb943b519d3251e937a75aa33fe8421e63ff73c609cbc9efc749863cd6bc6787973caacb59b987a917a678
SSDEEP 1536:ofb/OmdRyRGby3awR5fZ2WWW2WWW2WWW2WWWDWZ7ebD0tLiM0hp:oWqRyQbgUOh
TLSH
T192E3B9643C28645E811DE2EDF14546F761D36BCFE0AA0BB9144BA0D13E5AEDEE78342C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dp0DBlecg.lal

Path C:\Users\Admin\AppData\Local\Temp\tmp-00893-CCQzXtaJ1mV0\dp0DBlecg.lal
Size 1KB
SHA256 bd70634d2f4170d10b1bbf623ffeae10aa0de5b46569f95a955adea9de313c7a
MD5 8960df861afaed84822f8566931c5029
SHA1 ee0118591ebe034817b699038192427025fc15e8
SHA512 3f8f79bcd70240fdbcbffcc0fd1d5a4587ac1707a0140e597d6e5c9c526a9d0be0f0d0b0ac8e2a5a9fc233128960562db83a21ec4b332d0174aee4e497f8b656
TLSH
T10031B8837121044DC4B1A2BB27B18233235EA2D33884F5BC70C8DDAC749F57EAA951E8
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/1808-286-0x00000276703A0000-0x0000027670452000-memory.dmp

Download

memory/2012-271-0x00007FFB09630000-0x00007FFB09FD4000-memory.dmp

Download

memory/2012-266-0x00007FFB09630000-0x00007FFB09FD4000-memory.dmp

Download

memory/2012-277-0x000002263A570000-0x000002263A59A000-memory.dmp

Download

memory/2012-278-0x000002263A570000-0x000002263A594000-memory.dmp

Download

memory/2012-276-0x0000022639FE0000-0x0000022639FEA000-memory.dmp

Download

memory/2012-275-0x000002263A230000-0x000002263A2E2000-memory.dmp

Download

memory/2012-274-0x000002263A210000-0x000002263A22E000-memory.dmp

Download

memory/2012-260-0x00007FFB097BF000-0x00007FFB097C0000-memory.dmp

Download

memory/2012-270-0x00007FFB09630000-0x00007FFB09FD4000-memory.dmp

Download

memory/2012-269-0x00007FFB09630000-0x00007FFB09FD4000-memory.dmp

Download

memory/2012-268-0x00007FFB09630000-0x00007FFB09FD4000-memory.dmp

Download

memory/2012-261-0x00007FFB09630000-0x00007FFB09FD4000-memory.dmp

Download

memory/2012-262-0x00007FFB09630000-0x00007FFB09FD4000-memory.dmp

Download

memory/2012-265-0x0000022639F20000-0x0000022639F42000-memory.dmp

Download

memory/2012-267-0x00007FFB09630000-0x00007FFB09FD4000-memory.dmp

Download

memory/2012-280-0x00007FFB09630000-0x00007FFB09FD4000-memory.dmp

Download

memory/6016-345-0x0000000005720000-0x0000000005750000-memory.dmp

Download

memory/6016-329-0x0000000005850000-0x00000000059AA000-memory.dmp

Download

memory/6016-328-0x00000000031F0000-0x000000000320A000-memory.dmp

Download

memory/6016-327-0x0000000000BC0000-0x0000000000C00000-memory.dmp

Download

memory/6016-350-0x0000000008300000-0x0000000008382000-memory.dmp

Download

memory/6016-351-0x000000001B2F0000-0x000000001B822000-memory.dmp

Download