Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe
- Size 852KB
- Sample260729-e7dq7agn61
- SHA256 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c
- MD5 b559bcdb628c734e0a7f69d5b5ab1757
- SHA1 319726e3f419f8cfad4ee38227336c10f8300998
- SHA512 316ce22c226d628e7cabbdb55e5c0d8e01685979cd5e2ceb921f23bf6e7ed317ba3ae14f0800ce88667119d19d8bd382696e4c8df70a18946e8eefffabde7bea
- SSDEEP 6144:ew7ydSbIEu/IE0fhiZ0bpEYqzW/Kb3egnDRebs5AobAtZvPETvy7v6hF:ewHR0IEozbbaW/Kb3egndev0+2hF
- TLSH T18E052F5467FA8904F5F7AB3CA8B943611B7ABE626E74C30E0A00660D1C76E90DD75B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Wine\TaskManager b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\TypedURLs b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe 2448 b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe"C:\Users\Admin\AppData\Local\Temp\b47ce54366146f4c894c0ed08b10b94db11a43cca9d1e366b28d94d0c6cfa88c.exe"1⤵
- Identifies Wine through registry keys
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2448