534e1f863ef9555b591afd205556b2fc40506c14ec86634a7b7df14b1ce7277b

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 03:04

Target
update/common/shaders/win32_30/deferred_lighting.fxc
Size 108KB
Sample260528-dkrh4ags2y
SHA256 534e1f863ef9555b591afd205556b2fc40506c14ec86634a7b7df14b1ce7277b
MD5 5a7daf91b6e364d665d5e3f6c1af1b9a
SHA1 41c10f2c2bba96402d89aba6cd9da5bbd9d8ffb8
SHA512 004bc3d74687ae6d5494afe3bdeb1e908e6541698585bd9223153fe81be7a8d92ca31848cbdcd24278e97137e506dca6158982eff210953a28d4922333ce9cdd
SSDEEP 768:AznmUHHio4VxG6iBHwloIo5Xo5ro5do56o5ro5go5Jo5Go53o5co5mcZ/MTisMaQ:w9nJqYxda5PoMNTtGWkHCa
TLSH
T175B3A98FBC894937E0662AB198EF1E7823B5E247324517DB78B43B786CE97C0695134C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3100	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\update\common\shaders\win32_30\deferred_lighting.fxc
1⤵
- Modifies registry class
PID:2892

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact