746d2eb871f6717722681f1cc35a612f1f9e8397f9b01797d8f5fc201cf2175d

Analysis

max time kernel
898s
max time network
409s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 12:07

Target
deps/clipper2/include/clipper2/clipper.export.h
Size 26KB
Sample260511-pahzrag15w
SHA256 746d2eb871f6717722681f1cc35a612f1f9e8397f9b01797d8f5fc201cf2175d
MD5 d755865c00511b22ee184c0f86d8c747
SHA1 de04a1dd3a61dc0ef14a6e028c3217783658b2ca
SHA512 138f93f7bbf4367d0bbc6670088656442c5031dc2657203441dc841ab0201c9f9625a6bda72d1a2820f79d20478777c982c471088e7cce9847b18e8719209357
SSDEEP 768:N3kghS/kHxVxCDMUkndmxFIkv3mMFVHm3ndmEFImAndmvFDLM7lk:N3kghLHb0DMNndmdv3mSHendmhBndmxb
TLSH
T18CC294259CA1AD178F33E3F4564724ECF2186066E0EFD081F28C79242F4E79995BDA4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1520	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\deps\clipper2\include\clipper2\clipper.export.h
1⤵
- Modifies registry class
PID:4908

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact