5a360ec46517577996f180604165b49b851587641c9ff30506e67deb25cfa955

Login
Reports

Overview

overview

Static

static

Path of Ex...tom.7z

windows10-2004-x64

Path of Ex...tom.7z

windows11-ltsc_2024-x64

AutoHotkey...up.exe

windows10-2004-x64

AutoHotkey...up.exe

windows11-ltsc_2024-x64

Exile-UI/Exile UI.ahk

windows10-2004-x64

Exile-UI/Exile UI.ahk

windows11-ltsc_2024-x64

Exile-UI/b...ew.txt

windows10-2004-x64

Exile-UI/b...ew.txt

windows11-ltsc_2024-x64

Exile-UI/c... a.png

windows10-2004-x64

Exile-UI/c... a.png

windows11-ltsc_2024-x64

Exile-UI/c... c.png

windows10-2004-x64

Exile-UI/c... c.png

windows11-ltsc_2024-x64

Exile-UI/c... f.png

windows10-2004-x64

Exile-UI/c... f.png

windows11-ltsc_2024-x64

Exile-UI/c... n.png

windows10-2004-x64

Exile-UI/c... n.png

windows11-ltsc_2024-x64

Exile-UI/c... r.png

windows10-2004-x64

Exile-UI/c... r.png

windows11-ltsc_2024-x64

Exile-UI/c... t.png

windows10-2004-x64

Exile-UI/c... t.png

windows11-ltsc_2024-x64

Exile-UI/c... w.png

windows10-2004-x64

Exile-UI/c... w.png

windows11-ltsc_2024-x64

Exile-UI/c...fo.ini

windows10-2004-x64

Exile-UI/c...fo.ini

windows11-ltsc_2024-x64

Exile-UI/d...ns.ahk

windows10-2004-x64

Exile-UI/d...ns.ahk

windows11-ltsc_2024-x64

Exile-UI/d...ON.ahk

windows10-2004-x64

Exile-UI/d...ON.ahk

windows11-ltsc_2024-x64

Exile-UI/d...s.json

windows10-2004-x64

Exile-UI/d...s.json

windows11-ltsc_2024-x64

Exile-UI/d...l.json

windows10-2004-x64

Exile-UI/d...l.json

windows11-ltsc_2024-x64

Analysis

max time kernel
149s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 13:21

Sharing

Copy URL Twitter E-mail

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Path of Exile Custom.7z

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

Path of Exile Custom.7z

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

AutoHotkey_1.1.37.02_setup.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral4

Sample

AutoHotkey_1.1.37.02_setup.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

5 signatures

150 seconds

defense_evasion discovery trojan

Behavioral task

behavioral5

Sample

Exile-UI/Exile UI.ahk

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

execution

Behavioral task

behavioral6

Sample

Exile-UI/Exile UI.ahk

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

execution

Behavioral task

behavioral7

Sample

Exile-UI/build-detector-preview.txt

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

Exile-UI/build-detector-preview.txt

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[01] a.png

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[01] a.png

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[03] c.png

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[03] c.png

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[06] f.png

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[06] f.png

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral15

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[14] n.png

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[14] n.png

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[18] r.png

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[18] r.png

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral19

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[20] t.png

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[20] t.png

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[23] w.png

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral22

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/[23] w.png

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral23

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/info.ini

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

Exile-UI/cheat-sheets 2/[sample] expedition rumors/info.ini

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

Exile-UI/data/External Functions.ahk

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

execution

Behavioral task

behavioral26

Sample

Exile-UI/data/External Functions.ahk

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

execution

Behavioral task

behavioral27

Sample

Exile-UI/data/JSON.ahk

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

execution

Behavioral task

behavioral28

Sample

Exile-UI/data/JSON.ahk

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

execution

Behavioral task

behavioral29

Sample

Exile-UI/data/announcements.json

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

execution

Behavioral task

behavioral30

Sample

Exile-UI/data/announcements.json

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

execution

Behavioral task

behavioral31

Sample

Exile-UI/data/english/Betrayal.json

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

execution

Behavioral task

behavioral32

Sample

Exile-UI/data/english/Betrayal.json

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

execution

Report Analysis Logs

General

Target
Path of Exile Custom.7z
Size 319.4MB
Sample260912-qlt2tsce22
SHA256 5a360ec46517577996f180604165b49b851587641c9ff30506e67deb25cfa955
MD5 a2c15dd93ce2e59a95c7f59d13dbb5a4
SHA1 a309677803d6367833005f8c391e6ef057b6265f
SHA512 461d51f6c53a6b40e3deb186b60d42cadeae3117ef9bcd809b84724c3a53bb01ed456e55252ff637e700ce68aa1ab10ed3a40d5eb6ea2757c4533b639669cc6a
SSDEEP 6291456:8MfJxR4lnrYYUU7I0O74ZOlHBkWPXFklp7aVk0YKqRz38OtsbjNJ:82JYrbUUEq0h/PXFnKhNMOtsb3
TLSH
T136F8339876D03D7FF4F92BA5DF38D7BA40CF66E263B4139041AAE4EE5091084F19A847
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4308	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4308	7zFM.exe
Token: 35	4308	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4308	7zFM.exe

Processes

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Path of Exile Custom.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4308

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads