8d0a68daf56501b5d593984fada5abf31be316106ffe0ec223fa78ecffde7cfe

Analysis

max time kernel
149s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 05:14

Target
Game/obj/Debug/net7.0/Game.assets.cache
Size 151B
Sample260418-fxefeahs3t
SHA256 8d0a68daf56501b5d593984fada5abf31be316106ffe0ec223fa78ecffde7cfe
MD5 57c740f8c1f5ab07f635b912740a909f
SHA1 135e4504e1621ba970c15d1bcdd6cf1b14de0451
SHA512 d66fbfa73377e9aa73089c0c49c3d97620f72bcee3d0552442e2c6e543901b413fa50b1a39e6cbc760238fe599749d1ebb04f90eff244a88631b3af2f4e72f0d
TLSH
T147C012D00F008409C01828F31BD3132F4090A410540B554511018C80291A40A806D410
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4980	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Game\obj\Debug\net7.0\Game.assets.cache
1⤵
- Modifies registry class
PID:2340

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact