84fcf945075890570f3ff28f0b7c444663178ca996164a40d4b05f5b24b5114e

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chronicler-of-Kings-0.1.0-setup.exe
Size 23.2MB
Sample260916-k66cpswtft
SHA256 84fcf945075890570f3ff28f0b7c444663178ca996164a40d4b05f5b24b5114e
MD5 43f85ad4c37334f26d11a5cd23c82b88
SHA1 f008483344ceb06a864f797638f943b493e30aa7
SHA512 8acc09bf717d33891e382a90426f22a86a03e8f92651846e72c4c36fc5618f24d2ce699bb387d5fccff444553e9c61e4d6c81bd30648c8c1436cbc4e235ffca4
SSDEEP 393216:lPpPKpD3dqihZr4lBhK36FFBcZLHXoX7CCh1E5QRvj7HmxbIDES2UIEdsUabA9hI:lPhA7YXlBhJC3orS5Qdj7HmxbxS2BEd+
TLSH
T10937333A9208CA6FCFAE0570F26B76D3A870739906B99D477F687302BC354158DB61D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Loads dropped DLL 6 IoCs

pid	Process
1448	Chronicler-of-Kings-0.1.0-setup.exe
1448	Chronicler-of-Kings-0.1.0-setup.exe
1448	Chronicler-of-Kings-0.1.0-setup.exe
1448	Chronicler-of-Kings-0.1.0-setup.exe
1448	Chronicler-of-Kings-0.1.0-setup.exe
1448	Chronicler-of-Kings-0.1.0-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chronicler-of-Kings-0.1.0-setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1448	Chronicler-of-Kings-0.1.0-setup.exe
1448	Chronicler-of-Kings-0.1.0-setup.exe

C:\Users\Admin\AppData\Local\Temp\Chronicler-of-Kings-0.1.0-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Chronicler-of-Kings-0.1.0-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nse1AB4.tmp\System.dll
Size 27KB
SHA256 eea2235845ec4a401f3c0ecd23a0fb72f8160c78a665a02e4ca2b79d5ec109ab
MD5 e4cc464438a5a9db63482644d6b06569
SHA1 4c4311345ebdb58526c51efa9a8e8bec1ec9ab66
SHA512 75f37c00710b5357339ad488cded748508a65694340c293ce205e9b6452b58dbbfaf4fa125b8c7a7bacbc08f81b376a513370017f053db099a990b09c49eef85
SSDEEP 768:EaeiijipN+NtNmPuBL2Ip4sGTxf1ml9dHgjLFq:Je9iD+NtNxi9smfIbHgvFq
TLSH
T109C26DC64A3880A3FA539D30A2E8ED93BF7D57D728D549B369E791C119063C3F32A146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nse1AB4.tmp\modern-wizard.bmp
Size 150KB
SHA256 e8dee89201fd237856d2f0d9831d53b62129336cfa1a6b743c086f3588c177fd
MD5 d9efcb46aa0c054f2bc87fcedb5cdbea
SHA1 7e17dd561525c0574627d3d5268edd8450f91028
SHA512 63ef43ef0d9ecb21b7bb86713d7c9f0d92a27f310c3324fb70b8f54f66dfcffdaa86e7edf825984bba9e5fb19b7032dba20b8ec2c7857dec558ecef779f8dd26
SSDEEP 768:DccccccccccccccccccccccccccccVccccccccccccccccccccccccccccLcccc7:dKraKH91EynqFVD0CvoM
TLSH
T1E2E3BBA8431985A6289740D4CFB7FDE2F942ECC244318DD61E265EE8BD4FB16DE60D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nse1AB4.tmp\nsDialogs.dll
Size 24KB
SHA256 3dbbb0f7be369ef45904b4af258fb27dcfebfecafb435aef76bee8f0e2fd218c
MD5 fedb6f11492ea3c25780010137aad8e7
SHA1 64e59e5b91075ebf2d522edf16e73be39d5a5376
SHA512 0f3b0ea7952a1499e9a4a0ba395201a58e60cbb672db273eeb15688974d613e05fdca97483a5cdd9695bcdcb35f42975904c3e8ebe3725c49f715720747dd2e0
SSDEEP 768:NNi5U3/Aw0fINtNmPuBL2Ip452Txf1ml6Z+7U5Fg0:NNuU3/Aw0fINtNxi952fIL+3
TLSH
T110B27DC745788063DA93AA31B2E8EE9BFF3C53E374819C1250A7D285151A3D2BF29359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nse1AB4.tmp\nsis_tauri_utils.dll
Size 48KB
SHA256 ff958752df6aeda950256249a1992b7fee23cdcabe06e1828bb96fc4000d3e36
MD5 8817fd298380c2acb60111bf5cf0da14
SHA1 8ad6ea0a73f3877496a83adcec403ccac101d551
SHA512 f4bd3e504c249221bd41be6cbb60904aa99cf7b3ecf961b1a0f2212560cf5e85f8143c1f678e0052b06a1171aaa8d81c626815c09ecb4ced94242dfe1b4da895
SSDEEP 1536:HwODZzTrAV5Oevq4DtXHVGQNtNxi9IrfIYf:Hwwy0gqaXHMOs
TLSH
T1B4237DC8FDC56966E7CF19301088C9AF6A3FC7061500C96BA3B25E92C596372EFD521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download