Overview

overview

9

Static

static

3

2026-07-06...ar.exe

windows10-2004-x64

9

2026-07-06...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/07/2026, 22:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
  • Size 16.8MB
  • Sample260706-1192pscv3y
  • SHA256 e1e1fef2526145dd8e13840b98f77c2d781d83a8e43c5cae130a968115b05127
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceransomware

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 4 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3408
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:420
    • C:\Users\Admin\AppData\Local\Temp\2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe
      2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2208
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3784
      • C:\Windows\SysWOW64\UpdatAuto.exe
        C:\Windows\system32\UpdatAuto.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2856
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3136
      • C:\Users\Admin\AppData\Local\Temp\2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4~4.exe
        2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4~4.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:212
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2544
        • C:\Windows\SysWOW64\net.exe
          net stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4184
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop sharedaccess
            5⤵
            • System Location Discovery: System Language Discovery
            PID:948
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4256
        • C:\Windows\SysWOW64\net.exe
          net stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:632
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wuauserv
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3280
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3920
        • C:\Windows\SysWOW64\net.exe
          net stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2308
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wscsvc
            5⤵
            • System Location Discovery: System Language Discovery
            PID:892
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop srservice
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:736
        • C:\Windows\SysWOW64\net.exe
          net stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:944
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop srservice
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4576
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net start TlntSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3496
        • C:\Windows\SysWOW64\net.exe
          net start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start TlntSvr
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3672
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net user helpassistant 123456
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3908
        • C:\Windows\SysWOW64\net.exe
          net user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2420
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user helpassistant 123456
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4136
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net localgroup administrators helpassistant /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\SysWOW64\net.exe
          net localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2036
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 localgroup administrators helpassistant /add
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2180
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3240
      • C:\Windows\SysWOW64\sc.exe
        sc config SharedAccess start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4976
      • C:\Windows\SysWOW64\sc.exe
        sc config wuauserv start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4440
      • C:\Windows\SysWOW64\sc.exe
        sc config wscsvc start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2356
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4540
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1668
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4008
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:468

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        System Services

        1
        T1569

        Service Execution

        1
        T1569.002

        Persistence

        Account Manipulation

        1
        T1098

        Boot or Logon Autostart Execution

        1
        T1547

        Active Setup

        1
        T1547.014

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Privilege Escalation

        Account Manipulation

        1
        T1098

        Boot or Logon Autostart Execution

        1
        T1547

        Active Setup

        1
        T1547.014

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Network Share Discovery

        1
        T1135

        Peripheral Device Discovery

        2
        T1120

        Permission Groups Discovery

        1
        T1069

        Local Groups

        1
        T1069.001

        Query Registry

        3
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Service Stop

        1
        T1489

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 8.8MB
        • SHA256 1c57296db22bf609a462a6cfece3b6d3ecc9f0cde5e48ae4ef30fbd9c864e7b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 17.1MB
        • SHA256 d0c005de5c6f177f14fb0ff8f2601c3b20e39eb29edd94006638d2f8a4db52f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.2MB
        • SHA256 f051f5ce8293c6dc968445028d679383718b2a6e8128c3a92afab45c89d3c0be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 17.5MB
        • SHA256 db94695adbfff4c0f68e70043d56d4fc2220cfe1fa0894ad04d71394dac8dd3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 9.0MB
        • SHA256 046886be27880455a4e2cdfd356af14ad80fda57173bb14eb472eef84b22e109
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 17.2MB
        • SHA256 afeea28c1b1e958867ac812aae39a424277c22d839034e495784757f2e8631e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.3MB
        • SHA256 2e737d2c5eed75a4e866fbf8c144c97febf847968093109a3218768c9d62eac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 16.6MB
        • SHA256 ca0ddbbc4aafca73bda0fcc45a8ed3b33d0d4a9533d712dbce20322bc1cc0761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 10.0MB
        • SHA256 03039d3b322bbf954bee2762b4be0267283c64939b355195ab367cc9e880b6fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.7MB
        • SHA256 8607cd009396057ecfa9b0fb341845766dd8630508291e78e826330649c5da71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.4MB
        • SHA256 002512444c82a3d1ae30ac6bb59f99d6cbea42ef64f432b8b5f846b8e55cdfd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.7MB
        • SHA256 559d76913f9e96e0956354eba04002b1f9de07799f26091a8f7b485c1012a512
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SendSet.exe
        • Path C:\Program Files\SendSet.exe
        • Size 17.5MB
        • SHA256 fb0d235f59cf1d02a42c4bc40808fbf521a2561d843ad06499c3d22b6b7ccd36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SendSet.exe
        • Path C:\Program Files\SendSet.exe
        • Size 9.2MB
        • SHA256 aea918f1dcdd3debcb1f7f08cd480c33277cfc9e6c2418c31914775a87ee8fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 16.7MB
        • SHA256 1bb8ee7afe9f8c520333fe18ac3b5c3f599ec6ecd6b778630d724a3ff871ded8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.4MB
        • SHA256 c667c0187f84a9ea916482493ac53b735f15924de5ab4be39670301a123ec3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.3MB
        • SHA256 28957691c7448811ab62be544afcecf4f3e1a0504b3ae5b5e7685988c1f0ffc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.6MB
        • SHA256 f6e7a64462f3a6e1e449916fd31327ba988d103bd3a15545b9cc5b4cd26114b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.3MB
        • SHA256 41a8362d61596fb2b42f95656b4b64b267b02107e9b699230e20f30d25f06b75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.3MB
        • SHA256 f7c91f4ca8c1912654cf0f65a790751abbd994b7041c974a40e5e8fb13f5186a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppCache134278493402872823.txt
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134278493402872823.txt
        • Size 83KB
        • SHA256 3255c9983ed57cff457d009eba3c5022c021197dd31b7f04afb084b4153fd57b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe
        • Size 8.5MB
        • SHA256 1ee568b07f46f4772f1718d37101f4ff9ef2a2ae6f2bd6568f8f9f4c397b43c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4~4.exe
        • Size 202KB
        • SHA256 89c1a1302d9814e4443e24b51d8b9edb87b25c8f866d222e1e277df3d15a09bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 8.3MB
        • SHA256 eb96b0eae9fe9b3af7a6ef722788923ca4df456e6dd45d1f7718a9038fc54345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.3MB
        • SHA256 a1d5ae6764e3797210317a0f69df9a39db72c5d2c4542afcfe8c00787e4628b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.3MB
        • SHA256 cc156ac2cb6a4969522cc2aaef8403475029d9b8f605d15b11d09a82a018ee9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.3MB
        • SHA256 9e967f99fea61a3d5f802c5f48b72d764ba7ae5fa3f4aa68da2a763e190e566f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.3MB
        • SHA256 4776a25b745afb52bedd4601b948d5a200b4460bc68f8b4b6b3dfadc2c525def
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.3MB
        • SHA256 073e5987cbd77cef74253d92ee364867d5d2cb064044eeac307f32963f6feff7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.3MB
        • SHA256 c05e308d9ed5264d9ea339db3def78afff981ec502ecc1e207ef4ba9bb13c1fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~8
        • Path \??\c:\ntldr~8
        • Size 444KB
        • SHA256 0ceb04b4431e936b9e5f37a2d02e2e6ba4da43b27b5c7bf4bbdebfe8b7e16a0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~8
        • Path \??\c:\ntldr~8
        • Size 8.3MB
        • SHA256 252a1a7b5f39d90a20286b69aa560d2479a7bb00afce41095f6cf710bd152461
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1668-246-0x0000000004880000-0x0000000004881000-memory.dmp
        Download

        memory/4008-248-0x000002563D720000-0x000002563D820000-memory.dmp
        Download

        memory/4008-256-0x000002563E940000-0x000002563E960000-memory.dmp
        Download

        memory/4008-271-0x000002563E900000-0x000002563E920000-memory.dmp
        Download

        memory/4008-288-0x000002563ED00000-0x000002563ED20000-memory.dmp
        Download