d41188798b3e08ea70ba5fa6d803f7e8f269b05ef084c5b6fcb013af4b67873b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Heroes-University-H-0.8.1-pc/renpy/translation/merge.py
Size 3KB
Sample260508-jqaenaev4x
SHA256 d41188798b3e08ea70ba5fa6d803f7e8f269b05ef084c5b6fcb013af4b67873b
MD5 c4628667a93f5589b2cd2acd7fce7dce
SHA1 6162e9c988d1b8ab4d1ecbaa8c06bc3a470ceabb
SHA512 9d71e56f65f878a4cea71f9892c92e0d3801186673f7b61091b27a93a446bf9f38a827c726208a75913e86b1ccc93215afb4502728fd83519039d5ff08c9c336
TLSH
T17E61B609F80047C127C7027859FBA45CB336B12773752BE0F98CD2416F56A6C62FB968
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5992	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Heroes-University-H-0.8.1-pc\renpy\translation\merge.py
1⤵
- Modifies registry class
PID:3460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3460-0-0x000001EFF8600000-0x000001EFF86CD000-memory.dmp

Download

memory/5992-1-0x000001FD52E40000-0x000001FD52F0D000-memory.dmp