e914e33afb3473ce256798bea953ad084b8652c06d67d81bf51c78a24c5b8e18

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 10:42

Target
Awesomekills_Graphics_12.23/Installing/5. Copy all files from this folder to your GTAV folder/Awesomekills_NORT_Gameplay.ini
Size 23KB
Sample260531-mrrbcaey7t
SHA256 e914e33afb3473ce256798bea953ad084b8652c06d67d81bf51c78a24c5b8e18
MD5 f7f1e6ae10c6ca0faf42cf383460c695
SHA1 0c8529bbf0f16857b67fbc8be5ed47f9d9bd40d3
SHA512 49cb9bc1a92bc525eb366c35fa8c7ed3434286ff221631f89eeca965a80c5b789ae60b3a8abb8047f947e3d877b35c6d20872e37ca01e2b31daccf71a9066c34
SSDEEP 384:kfPFgE5undrAXWRJwD2P6prygefbhew7b35t+EBpXBd9q/sdTObPtCVWvVgimtsU:kFghndrAGRJwD2iprytToE3P3BpxLfhz
TLSH
T190B2B5E1152D8EC4E847C941B7B6F7B420FA35CFEAD8EA6871F810709C8AD96054E72D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2904	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Awesomekills_Graphics_12.23\Installing\5. Copy all files from this folder to your GTAV folder\Awesomekills_NORT_Gameplay.ini"
1⤵
- Modifies registry class
PID:3412

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact