de9d325af3156232c34916840210efb5706d6e6a5eba1827c8240e4f71c09fa2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 08:10

Target
LockScreenContentServer.exe
Size 48KB
Sample260731-j2q7jsfc74
SHA256 de9d325af3156232c34916840210efb5706d6e6a5eba1827c8240e4f71c09fa2
MD5 2cf29ef0ae66fcea7056ae948ffd9541
SHA1 3d493a1afae9b38d3c0953016a00ef3d9ac514a0
SHA512 3fd5a0c603ef7630adfc10e69de373aeb66df75f1830cbe83c68df59cbd27bdbe3fe7394a0549ebf8470b48ad207b122acddddc4c0cb1a3ef5e253a462e5fe4b
SSDEEP 768:eQvZAVIG7PsefP8lAd7MtCwIpS9SL4WZwWCXeG1Po9zvR:ZvIIgL5ta+YFWZwWgeePgzZ
TLSH
T1D6233A49ABBA10C1E5ADD23C606A420AF476F262570706EF5199C33C5F73FD4AE39B81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4412	LockScreenContentServer.exe
4412	LockScreenContentServer.exe

C:\Users\Admin\AppData\Local\Temp\LockScreenContentServer.exe
"C:\Users\Admin\AppData\Local\Temp\LockScreenContentServer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4412-5-0x00007FFEF6B90000-0x00007FFEF6EE5000-memory.dmp

Download