Overview

overview

9

Static

static

3

2026-06-27...ra.exe

windows10-2004-x64

9

2026-06-27...ra.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    96s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 05:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_7c56f4b34baa0053a3678553b9ba90eb_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
  • Size 15.3MB
  • Sample260629-ghk53ses2x
  • SHA256 4d08d68186144e5b42c2fb89a3453ad980711976fa727a0bdf90c0316a76d3ae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryexecutionpersistencespyware

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 4 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 20 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_7c56f4b34baa0053a3678553b9ba90eb_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_7c56f4b34baa0053a3678553b9ba90eb_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1848
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2016
    • C:\Users\Admin\AppData\Local\Temp\2026-06-27_7c56f4b34baa0053a3678553b9ba90eb_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra~4.exe
      2026-06-27_7c56f4b34baa0053a3678553b9ba90eb_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra~4.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4896
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:868
      • C:\Windows\SysWOW64\UpdatAuto.exe
        C:\Windows\system32\UpdatAuto.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1324
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5044
      • C:\Users\Admin\AppData\Local\Temp\2026-06-27_7c56f4b34baa0053a3678553b9ba90eb_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra~4~4.exe
        2026-06-27_7c56f4b34baa0053a3678553b9ba90eb_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra~4~4.exe
        3⤵
        • Executes dropped EXE
        PID:5104
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3932
        • C:\Windows\SysWOW64\net.exe
          net stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1144
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop sharedaccess
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1696
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5900
        • C:\Windows\SysWOW64\net.exe
          net stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6084
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wuauserv
            5⤵
            • System Location Discovery: System Language Discovery
            PID:432
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5856
        • C:\Windows\SysWOW64\net.exe
          net stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5324
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wscsvc
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3320
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop srservice
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3328
        • C:\Windows\SysWOW64\net.exe
          net stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5716
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop srservice
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3448
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net start TlntSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2468
        • C:\Windows\SysWOW64\net.exe
          net start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3916
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start TlntSvr
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2988
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net user helpassistant 123456
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4000
        • C:\Windows\SysWOW64\net.exe
          net user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2360
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user helpassistant 123456
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5432
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net localgroup administrators helpassistant /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5952
        • C:\Windows\SysWOW64\net.exe
          net localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5792
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 localgroup administrators helpassistant /add
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2252
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3640
      • C:\Windows\SysWOW64\sc.exe
        sc config SharedAccess start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1268
      • C:\Windows\SysWOW64\sc.exe
        sc config wuauserv start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3504
      • C:\Windows\SysWOW64\sc.exe
        sc config wscsvc start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5640
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4012
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4724
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:6004
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3252
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1968
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5436

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Account Manipulation

          1
          T1098

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Privilege Escalation

          Account Manipulation

          1
          T1098

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Discovery

          Network Share Discovery

          1
          T1135

          Peripheral Device Discovery

          2
          T1120

          Permission Groups Discovery

          1
          T1069

          Local Groups

          1
          T1069.001

          Query Registry

          3
          T1012

          System Information Discovery

          2
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Service Stop

          1
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          7z.exe
          • Path C:\Program Files\7-Zip\7z.exe
          • Size 8.2MB
          • SHA256 7aa3e39b5026efa85b080c3bcc229e28112f6c61cc0e0c4927b292cb0c29bd24
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7z.exe
          • Path C:\Program Files\7-Zip\7z.exe
          • Size 15.8MB
          • SHA256 92854fe4b785f5703dd7f384e3079b09fe836d9e25fb91e0f77fcdbb850aa731
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7zFM.exe
          • Path C:\Program Files\7-Zip\7zFM.exe
          • Size 8.6MB
          • SHA256 e6fe49ceb2bd91a4e8e2bc1b7e89af53b13f63e2efee0cbb39e1a47a4bc375de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7zFM.exe
          • Path C:\Program Files\7-Zip\7zFM.exe
          • Size 16.2MB
          • SHA256 baf99b8f917c3b0d7f027604ed0ec9673505a0bc7ae76faa4d1253bfb3d21167
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7zG.exe
          • Path C:\Program Files\7-Zip\7zG.exe
          • Size 8.3MB
          • SHA256 ce288c9e285b8d0aae5bd99fb0f4aaf14d308b03598bdb1c5c17b35a4f9bb10a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7zG.exe
          • Path C:\Program Files\7-Zip\7zG.exe
          • Size 16.0MB
          • SHA256 4a0d1291c2d39f474c71e6d2f5b54d46a513a7044c91bbdadab91fd2676bad4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Uninstall.exe
          • Path C:\Program Files\7-Zip\Uninstall.exe
          • Size 7.7MB
          • SHA256 1924acf7a4df0966a8168b1715b17848310665f9fe4b75fabc844ba7a6bcb133
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Uninstall.exe
          • Path C:\Program Files\7-Zip\Uninstall.exe
          • Size 15.3MB
          • SHA256 5da18548c639f3b70554c1fb90ee818ad66c6d6c983bca9f5bb77b198337dc20
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_pwa_launcher.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
          • Size 9.4MB
          • SHA256 902c34819279456a758cab9940ff0965a0727b3b49b2b0d72fbe6ff2bbe81513
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevated_tracing_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
          • Size 11.1MB
          • SHA256 04cd89505f58646de3c4927c9b3d20abac38d2502a97290f3297eff291a4265a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome.exe
          • Path C:\Program Files\Google\Chrome\Application\chrome.exe
          • Size 10.7MB
          • SHA256 e9e580c88a45a92f28c9b13c5f862fa7581c04e81bc53bd250c11a1a355de6ee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome.exe
          • Path C:\Program Files\Google\Chrome\Application\chrome.exe
          • Size 18.3MB
          • SHA256 68ef02b0bff671239a32d7139ffb53d75f432a2bcfbf25bf7ac68f0e3d6ac491
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_proxy.exe
          • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
          • Size 9.1MB
          • SHA256 d2c36a67cfe5a8c37bd88072355927e6611b688d6be57c06bbf3e72a1311efa4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet.exe
          • Path C:\Program Files\dotnet\dotnet.exe
          • Size 7.8MB
          • SHA256 4423a8d413191d45375f60115d60bfd9e07fc465d4a9426c2e41462b3e9463ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet.exe
          • Path C:\Program Files\dotnet\dotnet.exe
          • Size 15.4MB
          • SHA256 e1440d3592c9b86bd42f2069a0d5414dd1fcc9900788129d84123069ba969899
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          createdump.exe
          • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
          • Size 7.7MB
          • SHA256 95f14d7985d252693576cd172f88f511510ebcfaf57a966f779db1b0cf472387
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          createdump.exe
          • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
          • Size 15.3MB
          • SHA256 8171606900b8a63c432f259232f04daeea50a7969d179f94e60046bd96177566
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          createdump.exe
          • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
          • Size 7.7MB
          • SHA256 58cd73e792093b2a068f7404a36d908f61388b29b96a206ff88e32fdae490d91
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          createdump.exe
          • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
          • Size 15.3MB
          • SHA256 a547a18287f0745e3439dcd8d3c41564ddd831c92b193beef69dac24596f4508
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          createdump.exe
          • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
          • Size 7.7MB
          • SHA256 5a33a87a36d1072e79b4d4a323e3cde8fba638396d38855068f1526b1bacc871
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          createdump.exe
          • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
          • Size 15.3MB
          • SHA256 a96e65452b24d838f98fa9248eb6159bdc8b9da30eff651a89195ebfc16fdb48
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 607B
          • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          2026-06-27_7c56f4b34baa0053a3678553b9ba90eb_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra~4.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-06-27_7c56f4b34baa0053a3678553b9ba90eb_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra~4.exe
          • Size 7.7MB
          • SHA256 0e5b13d4cfc289fcfc1fc0b5812a65f3fde7391c864af35a6208a0a071cf7f78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-06-27_7c56f4b34baa0053a3678553b9ba90eb_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra~4~4.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-06-27_7c56f4b34baa0053a3678553b9ba90eb_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njra~4~4.exe
          • Size 44KB
          • SHA256 f7722702e33e9c02a8b11b96472f9a7b08afd5bcc090a6da818677956b73a559
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Option.bat
          • Path C:\Windows\SysWOW64\Option.bat
          • Size 53B
          • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          UpdatAuto.exe
          • Path C:\Windows\SysWOW64\UpdatAuto.exe
          • Size 7.6MB
          • SHA256 0637c5542a6c6e4fce9f77ff84b5e8d581c2dfd5e694435f20d266f1d5b0d091
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.6MB
          • SHA256 1049f12e595bb6c55050f2bc4ba24f4bb0e186d1b12b50561832dbadcde30425
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.6MB
          • SHA256 db26c569038ab71a314aa335173e016ee9ee1e1357c0da492a267bd36f5b9672
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.6MB
          • SHA256 76d876d3bffc910fde168fc35e78aa89650696105148d2188853e3918080ffbc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.6MB
          • SHA256 c0ae06b98fdaad033b0c649f6f8fc12ddf2c2eb330abc490c631cc553c47eecd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 1.2MB
          • SHA256 a1514437bd637ea8ce61a3e8d592f7dfe644ef612879715885133f057bcee04a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.6MB
          • SHA256 ae11b90de029d5924a8fb51c348303c99074b2e989232f0c516138317d8cc0bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.6MB
          • SHA256 435b78d2cce4c3ea16c8ab914c36884ce6e46a1719a6095ad0266af2ddf08648
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.6MB
          • SHA256 8bfb261042100ed4cc086b5a2c069f24b58e2d52dca4a092ab160515e803444a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1968-413-0x000001DA001F0000-0x000001DA002F0000-memory.dmp
          Download

          memory/1968-443-0x000001DA03BC0000-0x000001DA03BE0000-memory.dmp
          Download

          memory/1968-457-0x000001DA15140000-0x000001DA15160000-memory.dmp
          Download

          memory/1968-422-0x000001DA03DA0000-0x000001DA03EA0000-memory.dmp
          Download

          memory/1968-420-0x000001DA038F0000-0x000001DA03910000-memory.dmp
          Download