Overview

overview

10

Static

static

10

2026-06-30...d_.exe

windows10-2004-x64

9

2026-06-30...d_.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    108s
  • max time network
    74s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 05:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_26d91c270d24b5faf9209838d3bd9635_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
  • Size 7.0MB
  • Sample260701-gpv9maft5k
  • SHA256 b91ecf908b8f26a98edbf87ada9406d2a484af49ecc9910be42cc26c49ef0ce4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 31 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_26d91c270d24b5faf9209838d3bd9635_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_26d91c270d24b5faf9209838d3bd9635_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5896
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:6128
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3932
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1272
    • C:\Users\Admin\AppData\Local\Temp\2026-06-30_26d91c270d24b5faf9209838d3bd9635_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_~4.exe
      2026-06-30_26d91c270d24b5faf9209838d3bd9635_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_~4.exe
      2⤵
      • Executes dropped EXE
      PID:3620
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop sharedaccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4788
      • C:\Windows\SysWOW64\net.exe
        net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:696
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1008
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wuauserv
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4252
      • C:\Windows\SysWOW64\net.exe
        net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3264
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3664
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop wscsvc
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3116
      • C:\Windows\SysWOW64\net.exe
        net stop wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2032
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5312
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop srservice
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3756
      • C:\Windows\SysWOW64\net.exe
        net stop srservice
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2232
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3668
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net start TlntSvr
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1292
      • C:\Windows\SysWOW64\net.exe
        net start TlntSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6136
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5176
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net user helpassistant 123456
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1740
      • C:\Windows\SysWOW64\net.exe
        net user helpassistant 123456
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6124
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3572
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net localgroup administrators helpassistant /add
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Windows\SysWOW64\net.exe
        net localgroup administrators helpassistant /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1924
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:5856
    • C:\Windows\SysWOW64\sc.exe
      sc config SharedAccess start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4780
    • C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4876
    • C:\Windows\SysWOW64\sc.exe
      sc config wscsvc start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4552
    • C:\Windows\SysWOW64\sc.exe
      sc config srservice start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:5116
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5544
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5204
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1496
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4412
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3928

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Account Manipulation

          1
          T1098

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Privilege Escalation

          Account Manipulation

          1
          T1098

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Discovery

          Network Share Discovery

          1
          T1135

          Peripheral Device Discovery

          2
          T1120

          Permission Groups Discovery

          1
          T1069

          Local Groups

          1
          T1069.001

          Query Registry

          3
          T1012

          System Information Discovery

          2
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Service Stop

          1
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          7z.exe
          • Path C:\Program Files\7-Zip\7z.exe
          • Size 7.5MB
          • SHA256 3d0d352f53cb9658dc75db0e5abd731bcee195068bd3d0f5d8a1ed92d5500edb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7zFM.exe
          • Path C:\Program Files\7-Zip\7zFM.exe
          • Size 7.9MB
          • SHA256 4feb4cbbd40599a7f922811ae4ec3410dbe1b1fa8c9932acccf4c9bdd1eecb6c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7zG.exe
          • Path C:\Program Files\7-Zip\7zG.exe
          • Size 7.7MB
          • SHA256 91e25dbeadc6ca3c0d82805fb937bd5b2c50e2e92cbe256a03565c4b009a0251
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Uninstall.exe
          • Path C:\Program Files\7-Zip\Uninstall.exe
          • Size 7.0MB
          • SHA256 aff1843b8fc0bbd73539f441ee013d661afb277f2bee451c64d89f698dcc5fbe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrmstp.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
          • Size 13.1MB
          • SHA256 86eedcefbc5480939ee2e86e840858f31106652c51087fb963f4d71e439cb5dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_pwa_launcher.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
          • Size 8.7MB
          • SHA256 8b84621673e23eb8023b876c7e66b457568842e39154a1a412954d49b10a19ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevated_tracing_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
          • Size 10.5MB
          • SHA256 dec22f645e95e38f2034f0a5efb4f4bdbf19aaab6a2a346b8dafbe99e8198d06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          • Size 9.3MB
          • SHA256 b37dbdfe4801e69d203d718d4d0308b4855f7b3a06fb24e14d0ddd11ca9d081d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          notification_helper.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
          • Size 8.6MB
          • SHA256 8642a0158b658af05ac384eeec6f52cf3f6cc7a69d4d3cd565c6b9932da12921
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          os_update_handler.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
          • Size 8.9MB
          • SHA256 aa655fd6d5466e86ebc60ede87988a995255f0938e6f2d7eefecf1c85b1f4753
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome.exe
          • Path C:\Program Files\Google\Chrome\Application\chrome.exe
          • Size 10.1MB
          • SHA256 3b6bdb4f5bc35550e08cc4f795f188f2f61c1f3b064ee5fe44cdffc27138ab7a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_proxy.exe
          • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
          • Size 8.4MB
          • SHA256 4a5b0c30cd43bdf232a07d308819c6aa2418fe3cb38bd73d1f1e922ac46a5b72
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          InitializeBlock.exe
          • Path C:\Program Files\InitializeBlock.exe
          • Size 7.3MB
          • SHA256 2e46b9d8237af0e646caf407b54297533a123167f90d000e1ff5514e270bfd3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          appletviewer.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
          • Size 7.0MB
          • SHA256 fbe5d108db8aadbfcf6e17a9138f94722f20bb24f8b27b2f85cafed630b30d40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          extcheck.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
          • Size 7.0MB
          • SHA256 dec071e183e875e0755e5005c485bb8d3c5a9d63bc9e192d4cd35e6252886361
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          idlj.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
          • Size 7.0MB
          • SHA256 eb7a449d4fb949ebdfd6305fbe5671da805a5ef61cb5c11e0dc689c8fb609ac1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jabswitch.exe
          • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
          • Size 7.0MB
          • SHA256 58214da94b6423d17514e4c146989f9085d7d5b69d6593f8902bba81a2205180
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnet.exe
          • Path C:\Program Files\dotnet\dotnet.exe
          • Size 7.1MB
          • SHA256 027d2434fb7c83b3c0cbc61d7918a74f7db2e6d4d65573dcc264c321ad5aece2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          createdump.exe
          • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
          • Size 7.1MB
          • SHA256 8b7c1a77222a1d4b322765a563aefed581c4b0b5c03d78573623b1a8919fcb42
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          createdump.exe
          • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
          • Size 7.1MB
          • SHA256 9d89befa1210ddfdd9765c5a62aeb251ac5079d965dfaa736ff465cca1e151b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          createdump.exe
          • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
          • Size 7.1MB
          • SHA256 d0e462151158a6851ba639df41a0a2c87a6ea03485420b126af1e6e901604a3d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 599B
          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          2026-06-30_26d91c270d24b5faf9209838d3bd9635_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_~4.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-06-30_26d91c270d24b5faf9209838d3bd9635_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_~4.exe
          • Size 44KB
          • SHA256 edc771decb21316a2c28024f0427019da00cfedcb746378314f5b76cb21b529c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Option.bat
          • Path C:\Windows\SysWOW64\Option.bat
          • Size 53B
          • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          UpdatAuto.exe
          • Path C:\Windows\SysWOW64\UpdatAuto.exe
          • Size 7.0MB
          • SHA256 17e2d142df86f552fa62f8eb904b365174f52fe392879ba1b0d5c44bd02835dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.0MB
          • SHA256 36873d0bfb9819c4d467b832dbc7c1e8b4ea6a4e92225941b17f450a919f3053
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.0MB
          • SHA256 333d361dfbffe83705dac9e21ae2086f52ce4b9c18ed84bb4709319ae2eb9466
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.0MB
          • SHA256 a80a7a05340eeabc4aec2db915680663b0d225a5f7fdad729756d0c4d608c1b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.0MB
          • SHA256 5c10e3f018e93dfa02dae899ca36f3f777b1afe41720e65cf0329cb17755a66c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.0MB
          • SHA256 8475e8dc017c71934326df11a541de71bcacd87fd3b3201980683d54019a0f74
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.0MB
          • SHA256 1eebc2a4861c560bb8afaaeb4e4f503e860f3e060b36798b8ff078f44a4d2e08
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.0MB
          • SHA256 c94a9b2be7a010b80452ebaec8fb67e6f6810ef8a9453733768c52a151c9208d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.0MB
          • SHA256 c679731dccfcd3a92e98f17c73bebcdbf7da22a70482269b394a117ab4a42bd1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ntldr~6
          • Path \??\c:\ntldr~6
          • Size 7.0MB
          • SHA256 a15eb7582e15a1cf243ff2bb7fdbcde02441005550604ed0a25b96a7acb18d09
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1496-246-0x00000210801E0000-0x00000210802E0000-memory.dmp
          Download

          memory/1496-263-0x0000021083A30000-0x0000021083A50000-memory.dmp
          Download

          memory/1496-293-0x0000021094710000-0x0000021094730000-memory.dmp
          Download

          memory/1496-264-0x0000021093F20000-0x0000021094020000-memory.dmp
          Download

          memory/1496-273-0x0000021083C90000-0x0000021083CB0000-memory.dmp
          Download