Analysis
- max time kernel
162s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 15:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cx-programmer 9.1 free download full.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
cx-programmer 9.1 free download full.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target cx-programmer 9.1 free download full.exe
- Size 877.7MB
- Sample260919-s8fttssgla
- SHA256 74704eab9241f57a02807da4b67ac9de49a806d2c968d30eeb32b488ea82df5a
- MD5 a7d8414c99e0b68a074f0703230c39a6
- SHA1 feae03f2438d5a5c9269689ca086e0597541b0c7
- SHA512 902a372fdd9e3621eb15a136a79c5a2037930e7c32c51cd26624daf510f701c55dab9112505e828e215abd336c1a6170db117081360d0319845cf3d306640bec
- SSDEEP 393216:ehHJs7LkBafQSn/9iwnT0Yb2/8zpdHir3kBZL1nLHUUGEeVV+IZzCi9:nLkBafQWtRu8f43kBO
- TLSH T15DA9CE02B7E80066F5FB563499B78A12EA36BD611B21C3DF1294A26D1E737C09F34727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Google\qiouwnety cx-programmer 9.1 free download full.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2620 explorer.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe Token: SeShutdownPrivilege 2620 explorer.exe Token: SeCreatePagefilePrivilege 2620 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1160 cx-programmer 9.1 free download full.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1160 wrote to memory of 2620 1160 cx-programmer 9.1 free download full.exe 80
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\cx-programmer 9.1 free download full.exe"C:\Users\Admin\AppData\Local\Temp\cx-programmer 9.1 free download full.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1160
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4120