1ce526231a51005551330a15044ab8c321f8e6f064ef4886226640f282f198ac

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 10:42

Target
Awesomekills_Graphics_12.23/Installing/5. Copy all files from this folder to your GTAV folder/enbbloom.fx
Size 10KB
Sample260531-mrrbcaey7t
SHA256 1ce526231a51005551330a15044ab8c321f8e6f064ef4886226640f282f198ac
MD5 b2e5b0ec9a2ca55088767fd9fdf7ad97
SHA1 77042b32b4bc887bf279e5366acf5a0bf49b9206
SHA512 c55eec0cc81a2544e263d3f410c4dd0bf027f7bdcef9553cf078725ae4b62783ec5782f1a7dcebfdbe99aaeb7c407b5e2eca3027c0870bd9a0d249aadd4c5fe7
SSDEEP 192:omyAY+MfZHITB7s7C2L68RQfSxmizgHjt5AYDqD0EzYsXIaLIeBT+7BEEiBAEoki:omxY+MfZI2tgA1LIa+KU/CVpo
TLSH
T13432C65BE65BA2B61F439222E6710E07D3A4C0C05BDFC7B6B86C815C2BD3426867834B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3264	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Awesomekills_Graphics_12.23\Installing\5. Copy all files from this folder to your GTAV folder\enbbloom.fx"
1⤵
- Modifies registry class
PID:2632

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact