Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/07/2026, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe
- Size 1.7MB
- Sample260703-ppynrad18k
- SHA256 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66
- MD5 780afcf80bb18feabb6e8e33bc4ddcd0
- SHA1 d1dd8cb03db7bc2c1b0f438f8aec2a2cbb4424a0
- SHA512 ab661dca7d1ae19efbb609f3fe3d74bd9a8c324e1ef08ad782f6af6067f073b0f1e2edc3e1a914494db0129735c5e20f13d2dbb130ec55e72f97634fdcac63d8
- SSDEEP 24576:T2MQpGTpVXTR2mp5kAxMzzVal5zEy4gP5nRrEQs:Tl/z5kAxMMRRZRrRs
- TLSH T1FF85AF26B6A401FDD1B3D1F88A268907E772784A0731AFDF03D056662F276D44E7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3964 ed5d11f7457ab04bf8c53ed1394f860ece5ab8bf7c11cf771b17e472ee7ddd66.exe