Analysis

  • max time kernel
    150s
  • max time network
    117s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/07/2026, 18:06

General

  • Target
    10c36f05e945d635539094a62c3f360848eb414b1731f867fc6ee2bb0b64095a.exe
  • Size 3.8MB
  • Sample260717-wpy3vads8x
  • SHA256 10c36f05e945d635539094a62c3f360848eb414b1731f867fc6ee2bb0b64095a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10c36f05e945d635539094a62c3f360848eb414b1731f867fc6ee2bb0b64095a.exe
    "C:\Users\Admin\AppData\Local\Temp\10c36f05e945d635539094a62c3f360848eb414b1731f867fc6ee2bb0b64095a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\is-F203U.tmp\10c36f05e945d635539094a62c3f360848eb414b1731f867fc6ee2bb0b64095a.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-F203U.tmp\10c36f05e945d635539094a62c3f360848eb414b1731f867fc6ee2bb0b64095a.tmp" /SL5="$4018C,3111012,781824,C:\Users\Admin\AppData\Local\Temp\10c36f05e945d635539094a62c3f360848eb414b1731f867fc6ee2bb0b64095a.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Program Files\Claw's Gaming Suite Software\GamingMS.exe
        "C:\Program Files\Claw's Gaming Suite Software\GamingMS.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1356

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        GamingMS.exe

        • Path C:\Program Files\Claw's Gaming Suite Software\GamingMS.exe
        • Size 8.6MB
        • SHA256 5eae7e879d3ff6d985a35f7b50c96eabb4bdb12159cbf5612fca349b372fbfd3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KeyboardHook.dll

        • Path C:\Program Files\Claw's Gaming Suite Software\KeyboardHook.dll
        • Size 10KB
        • SHA256 13a780a96cb9f924bdcfa6525f863c7f534b6c959f3f914a09ef2a3847b281b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Logo pic.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\Logo pic.png
        • Size 9KB
        • SHA256 daff0fa6b55a9b1e487e31cc7468c8ff1942312b99c2389ba5625760e153b2e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Status_BLE.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\Status_BLE.png
        • Size 3KB
        • SHA256 9fefbf70a2aea95984496e9ea0a0793b8bf8cce5ce110373d2f7c855921ed59e
        • MD5 SHA1 SHA512 TLSH

        Status_Wired.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\Status_Wired.png
        • Size 3KB
        • SHA256 3fe939fb07903c2bbb18207150e963e65425b2b792b8f511fdd66a17ad2818b4
        • MD5 SHA1 SHA512 TLSH

        Status_Wireless.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\Status_Wireless.png
        • Size 1KB
        • SHA256 b6dc34f2416f7d0ca94d5eb59348f5f54c9a0b28dc78142da8c415b783ef0b10
        • MD5 SHA1 SHA512 TLSH

        add_nr.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\add_nr.png
        • Size 2KB
        • SHA256 b189e0e1468abe5127dec9feda3fda08836691757c54614e34dbc381224c7974
        • MD5 SHA1 SHA512 TLSH

        add_ov.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\add_ov.png
        • Size 2KB
        • SHA256 4b9c363c26319c6e6f70b1ccc41375cbcf29c73f9b3bcacbe1c4ca95482c9d22
        • MD5 SHA1 SHA512 TLSH

        battery_charging.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\battery_charging.png
        • Size 3KB
        • SHA256 8f7555b1c79366d8e76ded8c503773fe713e232d9d22c0062de179e65a4efead
        • MD5 SHA1 SHA512 TLSH

        battery_empty.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\battery_empty.png
        • Size 2KB
        • SHA256 760354c2e2889d612b4396b5416af510aad99768003e29149790e6cda6642df5
        • MD5 SHA1 SHA512 TLSH

        battery_full.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\battery_full.png
        • Size 3KB
        • SHA256 d3865dd9077b866cfa841f66d54431d20da652f4f974f07633d5f82df054ee27
        • MD5 SHA1 SHA512 TLSH

        battery_green.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\battery_green.png
        • Size 2KB
        • SHA256 686bbfdfdcef7cf7e448b6ec6198ab7cfe9fe03da2ff5f37e2750b302a684653
        • MD5 SHA1 SHA512 TLSH

        battery_lighting.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\battery_lighting.png
        • Size 2KB
        • SHA256 dc03a0d575a77a1086bf03378ad5004a24bf296a7497d63a2938c1eaccc8bd80
        • MD5 SHA1 SHA512 TLSH

        battery_orange.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\battery_orange.png
        • Size 2KB
        • SHA256 5a1355e628a38bdafdbf18bd65ea07a7ffee0669648e3ecbf665a65931872215
        • MD5 SHA1 SHA512 TLSH

        battery_red.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\battery_red.png
        • Size 2KB
        • SHA256 e8b2b0a74e5ef38942d1628614fe19bc79ae75b67d4fe3d921b26e95be388e8d
        • MD5 SHA1 SHA512 TLSH

        button1_nr.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\button1_nr.png
        • Size 2KB
        • SHA256 ee0dd51da59ce0a6cae0791452d5cb84cff2ed8bee6e650a8bc8a45262bf14db
        • MD5 SHA1 SHA512 TLSH

        button1_ov.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\button1_ov.png
        • Size 3KB
        • SHA256 ea10403aa4dbc33d4b33b08fca1d82313f3fc3842260279e884f7d9598624db9
        • MD5 SHA1 SHA512 TLSH

        check_dn.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\check_dn.png
        • Size 2KB
        • SHA256 6c4689655b178a576f598bc422b0f2f65a2f29f7c06533c5482d6296c10f6dad
        • MD5 SHA1 SHA512 TLSH

        check_nr.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\check_nr.png
        • Size 2KB
        • SHA256 06568a9337aabb279e0ca839a258fb0b9554f1bf528546b5d069a385e766711e
        • MD5 SHA1 SHA512 TLSH

        check_ov.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\check_ov.png
        • Size 2KB
        • SHA256 12e9dd4c3128bbb0d14995a5f7bd7895074f824cdcf747c8220b61dca6bd923d
        • MD5 SHA1 SHA512 TLSH

        combo2_ov.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\combo2_ov.png
        • Size 3KB
        • SHA256 898baf52c0dcfa2173554b0293e84597859933a36b1a99ef5f578e69b7e8bc7f
        • MD5 SHA1 SHA512 TLSH

        device name.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\device name.png
        • Size 2KB
        • SHA256 5dfdbecc6c937d79c9cdfe15593c3f9cb09f1588108ccf26fe97afcdc4d2f676
        • MD5 SHA1 SHA512 TLSH

        exit_nr.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\exit_nr.png
        • Size 3KB
        • SHA256 24a862e0fb4c0bf8d3cc68be6770e88cb6caab4c7566171388e5892980ddbf5c
        • MD5 SHA1 SHA512 TLSH

        exit_ov.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\exit_ov.png
        • Size 3KB
        • SHA256 be6475e4586b62a635a0eb2ddf7cbe383537ad8d6d1ac75b753e1c837276dd74
        • MD5 SHA1 SHA512 TLSH

        header2_nr.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\header2_nr.png
        • Size 2KB
        • SHA256 fedcb0fae37293d7e16726865f09816ad23085d44e2b5f100f705c3db83a8951
        • MD5 SHA1 SHA512 TLSH

        header2_ov.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\header2_ov.png
        • Size 2KB
        • SHA256 998d0e40b4466e091459fe2fe623324ede2f999fc8a7a95868744e8b8edf4f64
        • MD5 SHA1 SHA512 TLSH

        is-SUCUB.tmp

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\is-SUCUB.tmp
        • Size 176KB
        • SHA256 b59fc9c10f72f6510ab7a4f98af3774ffd0f853d6a82f28ce4a66894704b9903
        • MD5 SHA1 SHA512 SSDEEP TLSH

        min_nr.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\min_nr.png
        • Size 2KB
        • SHA256 f474dd16aea6c024429fed302e00b51faed0c0ac8e82b0fce0b2cacb10c24be3
        • MD5 SHA1 SHA512 TLSH

        min_ov.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\min_ov.png
        • Size 2KB
        • SHA256 6447f8e7d95fee7c1125a81202e56df3694dce571e7cf1c1408179207acc843c
        • MD5 SHA1 SHA512 TLSH

        mouse_nr.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\mouse\mouse_nr.png
        • Size 113KB
        • SHA256 d0efda5194ef3ee0304622ebd3abec93bcd6a0b304be08950de8177f8fb5c647
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serial_number1.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\mouse\serial_number1.png
        • Size 3KB
        • SHA256 43007fce7761666b78b3c0ee37eaa0112a69e7917e25a4a60300bc6daeca94d7
        • MD5 SHA1 SHA512 TLSH

        serial_number2.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\mouse\serial_number2.png
        • Size 3KB
        • SHA256 c8d118e6cd24de9dd79470d485f4ffc57e4158c8dce093892672ea569fb05ae4
        • MD5 SHA1 SHA512 TLSH

        serial_number3.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\mouse\serial_number3.png
        • Size 3KB
        • SHA256 b4702d26017bd4d2ca1e26f928dc88d9fdc71de115154b7aead3d34ffec850ca
        • MD5 SHA1 SHA512 TLSH

        serial_number4.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\mouse\serial_number4.png
        • Size 3KB
        • SHA256 600c436bdc88c91f5862fb995ec73882ee708acc36a0d296d87511629b146f3f
        • MD5 SHA1 SHA512 TLSH

        serial_number5.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\mouse\serial_number5.png
        • Size 3KB
        • SHA256 44ea506fedb65eb7051ae5a46191b797eecb1acb9a307e646dbccd50a6e1eb37
        • MD5 SHA1 SHA512 TLSH

        serial_number6.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\mouse\serial_number6.png
        • Size 3KB
        • SHA256 3d13c576a30a80e981eca1cf5c549303be6930019a9153d16bd105a4e86afaf2
        • MD5 SHA1 SHA512 TLSH

        serial_number7.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\mouse\serial_number7.png
        • Size 3KB
        • SHA256 7b0c1baceb59e523ef81086aac7858ae0c44093a8f91be845ec6ef2228ae034f
        • MD5 SHA1 SHA512 TLSH

        serial_number8.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\mouse\serial_number8.png
        • Size 3KB
        • SHA256 bd484905387b4d6790585b45384eb4723fbdb7c62dc365d1ae0e48f074990c5b
        • MD5 SHA1 SHA512 TLSH

        serial_number9.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\mouse\serial_number9.png
        • Size 3KB
        • SHA256 89d48b4df7e9b9b47b72f827e1d26ef16df14edc132fb0cd549919ea07355475
        • MD5 SHA1 SHA512 TLSH

        power_manage_10min.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\power_manage_10min.png
        • Size 15KB
        • SHA256 a4502f35a357a8d71b432fd03d9f4d65337a2d2a8292eaa8f4bf2a181c8dc751
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_3min.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\power_manage_3min.png
        • Size 16KB
        • SHA256 ff6a68263e7b8c1ada943caeadcbf440cab02c51da1bd3126097a5b72e3ab2a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_4min.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\power_manage_4min.png
        • Size 16KB
        • SHA256 e26858412ac07d48afc8948925c31d9fab2319af4af2cd4606f2047e1170fbde
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_5min.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\power_manage_5min.png
        • Size 16KB
        • SHA256 2a2ca88a97d04be0d228f6a8e92377963f30cc611647463173c15924a6daf304
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_6min.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\power_manage_6min.png
        • Size 16KB
        • SHA256 30df2fca304bec157f7e3d02b97d36e045a55d125f90562c976cadba98a3f83d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_7min.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\power_manage_7min.png
        • Size 16KB
        • SHA256 0f5f3b1ec0703ac382c4258f8dd4f757a5ac80512d37478ec2efcbb2c83b240e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_8min.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\power_manage_8min.png
        • Size 15KB
        • SHA256 ef46cbc31ad77d3ad598a0d6c95e717efda4e048648ac123b61240862ac2e01b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_9min.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\power_manage_9min.png
        • Size 15KB
        • SHA256 13a5a345d0ceed30338d25f2b5fdf3fc795677fac0d141a979ec54895f21e4ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        profile_slot_nr.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\profile_slot_nr.png
        • Size 2KB
        • SHA256 df26d1ed036bb610817c7d41d16fd41fdd4eb7f513736b25e539a13e02f1c1a4
        • MD5 SHA1 SHA512 TLSH

        profile_slot_nr2.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\profile_slot_nr2.png
        • Size 2KB
        • SHA256 16db02e407881ca0dadd1bc1867cf0568d21cf6d5d1a9045b3a58b4e9f0ef497
        • MD5 SHA1 SHA512 TLSH

        profile_slot_ov.png

        • Path C:\Program Files\Claw's Gaming Suite Software\skins\profile_slot_ov.png
        • Size 2KB
        • SHA256 8d04d7de1bac80641b7f644d44806c16d1209c902360162cb6039e490d64a2a7
        • MD5 SHA1 SHA512 TLSH

        unins000.exe

        • Path C:\Program Files\Claw's Gaming Suite Software\unins000.exe
        • Size 3.0MB
        • SHA256 1be0ddaafb71b3d6c16fadb00ea992f3d70ac202c78b132681b179f95bb2d69b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        10c36f05e945d635539094a62c3f360848eb414b1731f867fc6ee2bb0b64095a.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-F203U.tmp\10c36f05e945d635539094a62c3f360848eb414b1731f867fc6ee2bb0b64095a.tmp
        • Size 3.0MB
        • SHA256 feb51b80dfc0ee7705c208e8a12cd640e9b89cf281a3f8ca67b05ef17018a695
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LanSetting.ini

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20240407H\config\LanSetting.ini
        • Size 60B
        • SHA256 740f7d0af65a3988d40038c4a89f93de1e1dcfe2b3d6abc8170cedfd91f805ab
        • MD5 SHA1 SHA512 TLSH

        Lan_EN.txt

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20240407H\config\Lan_EN.txt
        • Size 11KB
        • SHA256 eb907c08fd6034b38745a4dc3faa348a61b2e118aef42aefa27d3deb212e9003
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MacroLibraryFile.mlf

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20240407H\config\MacroLibraryFile.mlf
        • Size 198B
        • SHA256 d0ca925d6a7f34eb2530178e681acf2b82d84bbc8ec0504f667851dbb573c65d
        • MD5 SHA1 SHA512 TLSH

        config.ini

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20240407H\config\config.ini
        • Size 1KB
        • SHA256 41be975f28530c202006ff0a943b5cdd657ab740bc1417b1434ed30dc208ebad
        • MD5 SHA1 SHA512 TLSH

        default0.psf

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20240407H\config\default0.psf
        • Size 33KB
        • SHA256 6dd2e08e4a2c377d615dc41e389e2f32a3ba9ad804e06b6e71856924d773f5cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default1.psf

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20240407H\config\default1.psf
        • Size 33KB
        • SHA256 78ecfc2ae31a6c40e927f52efa7ecb75bf89dbda7f8a22d03f85efcf516d27e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default2.psf

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20240407H\config\default2.psf
        • Size 8KB
        • SHA256 70a11b307eaf38701b02196c524791728eb9d6fd498caec9041656cc35751bd6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default3.psf

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20240407H\config\default3.psf
        • Size 33KB
        • SHA256 8d9d24fb8f9cb5391f692c7d4db2a8c950cf9ace6a1f775c0afb5f3a31b96013
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default4.psf

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20240407H\config\default4.psf
        • Size 33KB
        • SHA256 4f0ea1ab780f6871ea9ffe96ba52e8685dcf1540f7f94bf48debe243f5d84dc8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3396-10-0x00000000024F0000-0x00000000024F1000-memory.dmp

        memory/3396-9-0x0000000000400000-0x000000000070A000-memory.dmp

        memory/3396-12-0x0000000000400000-0x000000000070A000-memory.dmp

        memory/3396-433-0x0000000000400000-0x000000000070A000-memory.dmp

        memory/3396-407-0x0000000000400000-0x000000000070A000-memory.dmp

        memory/3396-14-0x0000000000400000-0x000000000070A000-memory.dmp

        memory/3396-6-0x00000000024F0000-0x00000000024F1000-memory.dmp

        memory/4648-0-0x0000000000400000-0x00000000004CC000-memory.dmp

        memory/4648-8-0x0000000000400000-0x00000000004CC000-memory.dmp

        memory/4648-436-0x0000000000400000-0x00000000004CC000-memory.dmp