d4d3f993f3db4c22229f60fc031a81f5632add9a332552540e34ec85ea589c8a

Analysis

user interaction
yes
max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:27

Target
rage/dependenices/imgui/thirdparty/include/freetype/config/ftconfig.h
Size 1KB
Sample260629-e23hcscz91
SHA256 d4d3f993f3db4c22229f60fc031a81f5632add9a332552540e34ec85ea589c8a
MD5 760caf116c958ad49a8cd0443aa53209
SHA1 6d716d41392378c27c9d1833ba0b0519ff4a4c69
SHA512 4adf726feee80a0608ee10534dcdefcec31ca6cd42b5ee035f3fea129a86eb25e4f064f824c2aea025151722c11e647dd338d00b51606fb862d02aaef8c4fae2
TLSH
T163313F2516DC1EE382830DF2A31916DAC317A5AF62220870708DB1543E0FEF5837BB92
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6004	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\rage\dependenices\imgui\thirdparty\include\freetype\config\ftconfig.h
1⤵
- Modifies registry class
PID:6148

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact