7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260831-h154msfb53
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
2732	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4144	MSBuild.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1228	powershell.exe
5992	powershell.exe
5256	powershell.exe
3716	powershell.exe
4112	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
200	cmd.exe
2756	cmd.exe
688	cmd.exe
5024	cmd.exe
2156	cmd.exe
4840	cmd.exe
1792	cmd.exe
1732	cmd.exe
568	cmd.exe
4812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\tlIbTiy6M.7p:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\Shared.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\Common.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\CastleCore.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\CastleCore.csproj:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4112	powershell.exe
4112	powershell.exe
1228	powershell.exe
1228	powershell.exe
1228	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5256	powershell.exe
5256	powershell.exe
5256	powershell.exe
3716	powershell.exe
3716	powershell.exe
3716	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeIncreaseQuotaPrivilege	4112	powershell.exe
Token: SeSecurityPrivilege	4112	powershell.exe
Token: SeTakeOwnershipPrivilege	4112	powershell.exe
Token: SeLoadDriverPrivilege	4112	powershell.exe
Token: SeSystemProfilePrivilege	4112	powershell.exe
Token: SeSystemtimePrivilege	4112	powershell.exe
Token: SeProfSingleProcessPrivilege	4112	powershell.exe
Token: SeIncBasePriorityPrivilege	4112	powershell.exe
Token: SeCreatePagefilePrivilege	4112	powershell.exe
Token: SeBackupPrivilege	4112	powershell.exe
Token: SeRestorePrivilege	4112	powershell.exe
Token: SeShutdownPrivilege	4112	powershell.exe
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeSystemEnvironmentPrivilege	4112	powershell.exe
Token: SeRemoteShutdownPrivilege	4112	powershell.exe
Token: SeUndockPrivilege	4112	powershell.exe
Token: SeManageVolumePrivilege	4112	powershell.exe
Token: 33	4112	powershell.exe
Token: 34	4112	powershell.exe
Token: 35	4112	powershell.exe
Token: 36	4112	powershell.exe
Token: SeIncreaseQuotaPrivilege	4112	powershell.exe
Token: SeSecurityPrivilege	4112	powershell.exe
Token: SeTakeOwnershipPrivilege	4112	powershell.exe
Token: SeLoadDriverPrivilege	4112	powershell.exe
Token: SeSystemProfilePrivilege	4112	powershell.exe
Token: SeSystemtimePrivilege	4112	powershell.exe
Token: SeProfSingleProcessPrivilege	4112	powershell.exe
Token: SeIncBasePriorityPrivilege	4112	powershell.exe
Token: SeCreatePagefilePrivilege	4112	powershell.exe
Token: SeBackupPrivilege	4112	powershell.exe
Token: SeRestorePrivilege	4112	powershell.exe
Token: SeShutdownPrivilege	4112	powershell.exe
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeSystemEnvironmentPrivilege	4112	powershell.exe
Token: SeRemoteShutdownPrivilege	4112	powershell.exe
Token: SeUndockPrivilege	4112	powershell.exe
Token: SeManageVolumePrivilege	4112	powershell.exe
Token: 33	4112	powershell.exe
Token: 34	4112	powershell.exe
Token: 35	4112	powershell.exe
Token: 36	4112	powershell.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeIncreaseQuotaPrivilege	1228	powershell.exe
Token: SeSecurityPrivilege	1228	powershell.exe
Token: SeTakeOwnershipPrivilege	1228	powershell.exe
Token: SeLoadDriverPrivilege	1228	powershell.exe
Token: SeSystemProfilePrivilege	1228	powershell.exe
Token: SeSystemtimePrivilege	1228	powershell.exe
Token: SeProfSingleProcessPrivilege	1228	powershell.exe
Token: SeIncBasePriorityPrivilege	1228	powershell.exe
Token: SeCreatePagefilePrivilege	1228	powershell.exe
Token: SeBackupPrivilege	1228	powershell.exe
Token: SeRestorePrivilege	1228	powershell.exe
Token: SeShutdownPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeSystemEnvironmentPrivilege	1228	powershell.exe
Token: SeRemoteShutdownPrivilege	1228	powershell.exe
Token: SeUndockPrivilege	1228	powershell.exe
Token: SeManageVolumePrivilege	1228	powershell.exe
Token: 33	1228	powershell.exe
Token: 34	1228	powershell.exe
Token: 35	1228	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2184	Setup.exe
2184	Setup.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1732	2184	Setup.exe	88
PID 2184 wrote to memory of 5024	2184	Setup.exe	90
PID 2184 wrote to memory of 568	2184	Setup.exe	92
PID 2184 wrote to memory of 4812	2184	Setup.exe	94
PID 4812 wrote to memory of 4112	4812	cmd.exe	96
PID 2184 wrote to memory of 200	2184	Setup.exe	98
PID 200 wrote to memory of 1228	200	cmd.exe	100
PID 2184 wrote to memory of 2156	2184	Setup.exe	101
PID 2156 wrote to memory of 5992	2156	cmd.exe	103
PID 2184 wrote to memory of 4840	2184	Setup.exe	104
PID 4840 wrote to memory of 5256	4840	cmd.exe	106
PID 2184 wrote to memory of 1792	2184	Setup.exe	107
PID 1792 wrote to memory of 3716	1792	cmd.exe	109
PID 2184 wrote to memory of 2732	2184	Setup.exe	110
PID 2732 wrote to memory of 3388	2732	forfiles.exe	111
PID 3388 wrote to memory of 5692	3388	cmd.exe	113
PID 3388 wrote to memory of 2432	3388	cmd.exe	114
PID 3388 wrote to memory of 2756	3388	cmd.exe	115
PID 2756 wrote to memory of 4652	2756	cmd.exe	116
PID 2756 wrote to memory of 2720	2756	cmd.exe	117
PID 3388 wrote to memory of 4500	3388	cmd.exe	118
PID 4500 wrote to memory of 688	4500	conhost.exe	119
PID 688 wrote to memory of 5068	688	cmd.exe	120
PID 688 wrote to memory of 4144	688	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:1732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3716
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N /m tlIbTiy6M.7p /c "cmd /c ren @file tlIbTiy6M.bat && call tlIbTiy6M.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "tlIbTiy6M.7p" tlIbTiy6M.bat && call tlIbTiy6M.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5692
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:2432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2756
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:4652
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:2720
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\tlIbTiy6M.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\tlIbTiy6M.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:688
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5068
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\CastleCore.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c13b4f2d4cd022a37436dd07c44460047918ffcf0a4e65887c3e16e65fce69db
MD5 298634327e0e9e09deacf9833bad5da8
SHA1 8c074c66d9e2bd2daed501b27ba774bb87bb8422
SHA512 fd83477a1b404a072a5193cc482c3a226f3d0c8ddaef4b867b457674c35d0aa75c5620ae7d5b9fe6f64cb7155520f125eef7a0f8757c0c0b6e841b7932b15083
TLSH
T18E318637F3DC8611CC9A013A10CDAC1036BAC7DB90DEDFAB6B80E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 759df3d406a3c2eef3a94a8e0fcfb0391e1cf6d6bcd0244f1d42e8aebe05c396
MD5 a31d5af5210d84d829658714f76dc3ef
SHA1 31a3a1749e943ce65fd285b22275c6714632ff79
SHA512 44e75d2cd3d536904500e54e356a139c60973cba1d66a52fbf98bcf3d146a1fa303a0bb99808f79991614ffc40ed9437fbdd4bde5df2299f2c78db4394b2381d
TLSH
T128217633B3DC8614C899403A10DDAC1036B6C7CB40DECF9B6B81E159A42F299CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c11ba17dffd1ec3a5a6a5007ff7d65ce3e4b45a168312f3ee8fd0ba259e721c1
MD5 a260df5887ad9dd47cacaff566fe9f3e
SHA1 465bc8987b1dfa7bde36052af2e143a5b7558c8d
SHA512 4a375038e82e9beff9898f7c02d384ea50df84708c39f26d955cc2e1bb8e0fe09106e22919423d20c70e79fb4ee9ac7fb51754537a40d691c8d48adea77fcd30
TLSH
T13C217633B3DC8624C899013A10DDAC1036B687CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d8e1a482e5a11278150c95a32121a116b80db7cf54e07c18678dea9d8add77f5
MD5 1af987638409de572b86a0fa6957a924
SHA1 bdf60c572c3e70bd7dbb1d28695f07b727528382
SHA512 d69c0d9b6792aeb116c178e41c6f7abc2ad823138b97ffbbb6c668a0c85cb8563e669d72d303bb7067c9860097fbcbdd70d25dbe27d08313b6ae4208c58040a4
TLSH
T190219833F3DC8224CC9A013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rz5hn322.zcs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rz5hn322.zcs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1788161675.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1788161675.tmp
Size 1KB
SHA256 52c90ff8fcb6bafd298b1adfb3c472ce73bda6e54e62cc7793bedc22ad3e8bf0
MD5 0e53e0bc4cfc02540a3550905d00f0ed
SHA1 d86c21ec1a09395ace3ed51288a59c9dda1620f0
SHA512 b7a779e0dd57abbcc6a1dd6a69d065f4832f773ae81ae442b150993af28be45e5bb88e1f615d3960d660549e3900ef851c4173bd1e9bf74e25c6e9b15b928a15
TLSH
T1F031EA261294D745A85E494E1A6C87021D01EE5AEDD35BFD3230E3D7A7C2739F332D91
MD5 SHA1 SHA512 TLSH

Submit Download

CastleCore.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\CastleCore.csproj
Size 15.3MB
SHA256 8a8bc036f302f8c5b23fa63cef3b1901a100a56f7866c1a6f8fc42bcc89061c9
MD5 a8dda0943fce2085f4d7a16deda2680c
SHA1 2a719d3e0d75509521f70867e9099926e107929a
SHA512 fdbb18bc77a0a9125695fa6f2b28e3a17c425345d87847e31621d3b84761f8bd9485b27b053615529910a065ff23b5d4051261178be36f72b8c6e4c703861789
SSDEEP 1536:K712LWQ8VtB/iGMYh/U6uRQzofRe6pKLa2CMItyekbmhoTFVlgtJvthhT7KP0P6o:v
TLSH
T1DBF67876038047A6E3CC6BC4446B295E22B9F66635152790FF732BFEDC1AAC79879103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CastleCore.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\CastleCore.csproj.user
Size 373KB
SHA256 65450ad7a05eaa4532f038a1f1f7adac5f01c4a9a0c2058bc4c0d8f7310c595a
MD5 06aa0db6814cfd73412fa1bcda63c5f3
SHA1 f394c5fb785855e2fe054ff252f3a3f0268129bb
SHA512 b831a5a91ad38b7f202e8a3ce7961091ec2106497e23b3bb6f26843e12af0f7f9b817999d08c4eed500391378d4f8b739dc005036d3313b4c949180c1e86b212
SSDEEP 6144:Z2AGpoptro8+5dVDnuk4xH1xfE7WuDiTOA2YPxfbalBJz0mgv:yU9ox+E7Wu8nPxDalBHi
TLSH
T1DD847EF499FE10B5E34B99402AACFE7441B270C7DBCB355873AEE2158F68B662B4500D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Common.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\Common.targets
Size 334KB
SHA256 340c8a7b0f6b008edc987c18313daa380bba5f5db80074ed89d28ac38ebcfe4c
MD5 50e6d2f61720d4561b89b46948876bbf
SHA1 40fe8b9a15646b60471a8c59925904a893ec4893
SHA512 e9d0847f38cb145360524264e786078cebcf4510762c765285f4775359b8906bcdd6728631319dfcfda09190896d8ef63b821d7e11c758ac9b7d7ff5575f56b2
SSDEEP 1536:NPAuDRQgtGCGomi+76FhJRZCyFEI7oWGfnc2pWxcVcaTzJkeqZ6aHXWHI+yepX8L:lotseG6zPskBjnU
TLSH
T1497434F8A687D5F4FA6F8125A2EC7D490431328757C22E74D7ACE04097FAB863E4588D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shared.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\Shared.props
Size 226KB
SHA256 52391d309dc5fed2afe82fbd6adf959b99406072b1a90f37f4d2ee33e27d888c
MD5 2ae98f1b5a2a5ecc0297b2a64f89e1e3
SHA1 564977bf4b290152aae2a82a92d05d2aefdd3f3b
SHA512 bb17b7e7872f4152d0f88509ab962caad406e6c854ee1a25c34a0641c1d0550303f83c6b59cf08f5b42cfec4796aabda6972cbd01a68787c150897c841eb2a95
SSDEEP 1536:DcJicXaoNCl/zIgRrKBBhgfiS7a9h6WIX0nWh7ytS2JgvYRLqYDbVJtRnL6Gg47M:4dSmSlYDJdB7l0z
TLSH
T1B234043482DF0065E7C7986839FCBE7151A334D7AAEA3D5503ADE4210B7DE732E16A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shared.props:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\Shared.props:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

tlIbTiy6M.7p

Path C:\Users\Admin\AppData\Local\Temp\tmp-13444-2oE7PmXm3b6N\tlIbTiy6M.7p
Size 1KB
SHA256 9740af478b06b569aa5f82bcc27cb181dca764f70f40dea633bdd82b20b65399
MD5 683a400c6464726aa6f243becf46513c
SHA1 2c65f4a04c01c21bbcc8d6f3d4090bb85072b09d
SHA512 72b94510acb0fe8ca4cd3e7ed483e493ec375da86a8dc77db1efcbbb663809ada2737996e51dc267931b1308e16498ede0b64d12f2c172de9e82eaeea069af88
TLSH
T1A631BD93B4110549C5E1767B67B14733135DA2C33484F9BC70C8DDAC749F16FAA942E8
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/1228-289-0x0000021C5CA60000-0x0000021C5CB12000-memory.dmp

Download

memory/4112-272-0x00007FFC12260000-0x00007FFC12C04000-memory.dmp

Download

memory/4112-268-0x00007FFC12260000-0x00007FFC12C04000-memory.dmp

Download

memory/4112-281-0x000002716AF70000-0x000002716AF94000-memory.dmp

Download

memory/4112-280-0x000002716AF70000-0x000002716AF9A000-memory.dmp

Download

memory/4112-283-0x00007FFC12260000-0x00007FFC12C04000-memory.dmp

Download

memory/4112-278-0x000002716B1C0000-0x000002716B272000-memory.dmp

Download

memory/4112-277-0x000002716AF10000-0x000002716AF2E000-memory.dmp

Download

memory/4112-274-0x00007FFC12260000-0x00007FFC12C04000-memory.dmp

Download

memory/4112-273-0x00007FFC12260000-0x00007FFC12C04000-memory.dmp

Download

memory/4112-260-0x00007FFC123EF000-0x00007FFC123F0000-memory.dmp

Download

memory/4112-271-0x00007FFC12260000-0x00007FFC12C04000-memory.dmp

Download

memory/4112-270-0x00007FFC12260000-0x00007FFC12C04000-memory.dmp

Download

memory/4112-269-0x00007FFC12260000-0x00007FFC12C04000-memory.dmp

Download

memory/4112-279-0x000002716AF30000-0x000002716AF3A000-memory.dmp

Download

memory/4112-261-0x00007FFC12260000-0x00007FFC12C04000-memory.dmp

Download

memory/4112-262-0x00007FFC12260000-0x00007FFC12C04000-memory.dmp

Download

memory/4112-265-0x000002716AE60000-0x000002716AE82000-memory.dmp

Download

memory/4112-266-0x00007FFC12260000-0x00007FFC12C04000-memory.dmp

Download

memory/4112-267-0x00007FFC12260000-0x00007FFC12C04000-memory.dmp

Download

memory/4144-333-0x0000000004F20000-0x0000000004F50000-memory.dmp

Download

memory/4144-332-0x0000000005070000-0x00000000051CA000-memory.dmp

Download

memory/4144-331-0x0000000004E60000-0x0000000004E7A000-memory.dmp

Download

memory/4144-330-0x00000000003E0000-0x0000000000420000-memory.dmp

Download

memory/4144-353-0x0000000007B20000-0x0000000007B9A000-memory.dmp

Download

memory/4144-354-0x000000001AB20000-0x000000001B044000-memory.dmp

Download

memory/4144-355-0x000000001B690000-0x000000001B790000-memory.dmp

Download