Overview

overview

9

Static

static

3

2026-07-06...ar.exe

windows10-2004-x64

9

2026-07-06...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    43s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 22:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
  • Size 16.8MB
  • Sample260706-1192pscv3y
  • SHA256 e1e1fef2526145dd8e13840b98f77c2d781d83a8e43c5cae130a968115b05127
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryexecutionpersistencespyware

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 4 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 38 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 49 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1532
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:6064
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4692
    • C:\Users\Admin\AppData\Local\Temp\2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe
      2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5788
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1832
      • C:\Windows\SysWOW64\UpdatAuto.exe
        C:\Windows\system32\UpdatAuto.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2096
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2084
      • C:\Users\Admin\AppData\Local\Temp\2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4~4.exe
        2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4~4.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5956
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\Windows\SysWOW64\net.exe
          net stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1740
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop sharedaccess
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3452
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5804
        • C:\Windows\SysWOW64\net.exe
          net stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5284
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wuauserv
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2392
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1608
        • C:\Windows\SysWOW64\net.exe
          net stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3340
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wscsvc
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5356
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop srservice
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\Windows\SysWOW64\net.exe
          net stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6084
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop srservice
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3944
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net start TlntSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5240
        • C:\Windows\SysWOW64\net.exe
          net start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4496
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start TlntSvr
            5⤵
            • System Location Discovery: System Language Discovery
            PID:616
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net user helpassistant 123456
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3888
        • C:\Windows\SysWOW64\net.exe
          net user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1988
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user helpassistant 123456
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2956
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net localgroup administrators helpassistant /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3748
        • C:\Windows\SysWOW64\net.exe
          net localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5692
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 localgroup administrators helpassistant /add
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2328
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2248
      • C:\Windows\SysWOW64\sc.exe
        sc config SharedAccess start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:6080
      • C:\Windows\SysWOW64\sc.exe
        sc config wuauserv start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4256
      • C:\Windows\SysWOW64\sc.exe
        sc config wscsvc start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:920
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3624
  • C:\Windows\system32\userinit.exe
    C:\Windows\system32\userinit.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5832
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3428
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5996
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:916
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4240
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2680
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:1972
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
        PID:2404

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            System Services

            1
            T1569

            Service Execution

            1
            T1569.002

            Persistence

            Account Manipulation

            1
            T1098

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Privilege Escalation

            Account Manipulation

            1
            T1098

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Defense Evasion

            Modify Registry

            2
            T1112

            Credential Access

            Discovery

            Network Share Discovery

            1
            T1135

            Peripheral Device Discovery

            2
            T1120

            Permission Groups Discovery

            1
            T1069

            Local Groups

            1
            T1069.001

            Query Registry

            2
            T1012

            System Information Discovery

            2
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Service Stop

            1
            T1489

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 8.8MB
            • SHA256 1c57296db22bf609a462a6cfece3b6d3ecc9f0cde5e48ae4ef30fbd9c864e7b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 17.1MB
            • SHA256 d0c005de5c6f177f14fb0ff8f2601c3b20e39eb29edd94006638d2f8a4db52f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 9.2MB
            • SHA256 f051f5ce8293c6dc968445028d679383718b2a6e8128c3a92afab45c89d3c0be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 17.5MB
            • SHA256 db94695adbfff4c0f68e70043d56d4fc2220cfe1fa0894ad04d71394dac8dd3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 9.0MB
            • SHA256 046886be27880455a4e2cdfd356af14ad80fda57173bb14eb472eef84b22e109
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 17.2MB
            • SHA256 be303572cd20b186b5e305535833a2db726dbd56753db2df5b5128c86546d6eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 8.3MB
            • SHA256 2e737d2c5eed75a4e866fbf8c144c97febf847968093109a3218768c9d62eac9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 16.6MB
            • SHA256 44a4d032afbc28caa7e238bdf2058ba6aceb36566bcd2528d9cec46627539c5f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ConnectReceive.exe
            • Path C:\Program Files\ConnectReceive.exe
            • Size 8.6MB
            • SHA256 3597d7e2657faded5a49f54f5251104010e7a2d6053fbdae8d145e5a69c544ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ConnectReceive.exe
            • Path C:\Program Files\ConnectReceive.exe
            • Size 16.9MB
            • SHA256 3e3f9257b34dac9926cd5024d56bfd5bf185e7ade9849c572f2c297ceda85c87
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
            • Size 10.0MB
            • SHA256 7473ba8853271e909ed4e7b7885846f72f289c3a4ee3d97d4bc09cb603c658d0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 10.6MB
            • SHA256 d472bf84d4827bbe9d762ecc1d8a2bb2f8bb134aa901cc9c8463bf1d5a715273
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome.exe
            • Size 11.4MB
            • SHA256 f8ae977ff4d60293b76b7d0a30d853666d291d57199a11cec8957ad2f56afab3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 9.7MB
            • SHA256 2708d13cf80e1d8a7bd095b5cdd6318b2f0a00128da3485ec49a5dcec81bddb2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 8.4MB
            • SHA256 c667c0187f84a9ea916482493ac53b735f15924de5ab4be39670301a123ec3f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 16.7MB
            • SHA256 1bb8ee7afe9f8c520333fe18ac3b5c3f599ec6ecd6b778630d724a3ff871ded8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            createdump.exe
            • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
            • Size 8.3MB
            • SHA256 3860100c24e99ab32c2649e6e35f3d9a766625330c6e7a2f6ca5d74c0f82b754
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            createdump.exe
            • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
            • Size 16.6MB
            • SHA256 12014574afb2b0eae2034826d78dd42c1af059b95105cb503dedc3147974603d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            createdump.exe
            • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
            • Size 8.3MB
            • SHA256 41a8362d61596fb2b42f95656b4b64b267b02107e9b699230e20f30d25f06b75
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            createdump.exe
            • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
            • Size 8.3MB
            • SHA256 f7c91f4ca8c1912654cf0f65a790751abbd994b7041c974a40e5e8fb13f5186a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 587B
            • SHA256 b2209b771ee60d35244635ab8f98535ef42b3831cc6d543be82fcdb2195a3fb9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe
            • Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe
            • Size 8.5MB
            • SHA256 1ee568b07f46f4772f1718d37101f4ff9ef2a2ae6f2bd6568f8f9f4c397b43c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4~4.exe
            • Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_323c57cb31490432a3bbae52b636c495_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4~4.exe
            • Size 202KB
            • SHA256 89c1a1302d9814e4443e24b51d8b9edb87b25c8f866d222e1e277df3d15a09bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Option.bat
            • Path C:\Windows\SysWOW64\Option.bat
            • Size 53B
            • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            UpdatAuto.exe
            • Path C:\Windows\SysWOW64\UpdatAuto.exe
            • Size 8.3MB
            • SHA256 eb96b0eae9fe9b3af7a6ef722788923ca4df456e6dd45d1f7718a9038fc54345
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ntldr~6
            • Path \??\c:\ntldr~6
            • Size 8.3MB
            • SHA256 a1d5ae6764e3797210317a0f69df9a39db72c5d2c4542afcfe8c00787e4628b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ntldr~6
            • Path \??\c:\ntldr~6
            • Size 8.3MB
            • SHA256 3e2ebe9dd942114b027f6a082b4ddd67db69de7149892ea5c37989dc180fbb86
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ntldr~6
            • Path \??\c:\ntldr~6
            • Size 8.3MB
            • SHA256 9e967f99fea61a3d5f802c5f48b72d764ba7ae5fa3f4aa68da2a763e190e566f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ntldr~6
            • Path \??\c:\ntldr~6
            • Size 8.3MB
            • SHA256 073e5987cbd77cef74253d92ee364867d5d2cb064044eeac307f32963f6feff7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ntldr~6
            • Path \??\c:\ntldr~6
            • Size 8.3MB
            • SHA256 4776a25b745afb52bedd4601b948d5a200b4460bc68f8b4b6b3dfadc2c525def
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ntldr~6
            • Path \??\c:\ntldr~6
            • Size 8.3MB
            • SHA256 c05e308d9ed5264d9ea339db3def78afff981ec502ecc1e207ef4ba9bb13c1fb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ntldr~8
            • Path \??\c:\ntldr~8
            • Size 8.3MB
            • SHA256 54deccf3191a7824779b8afd029d51d5b4a32cde4b11b2d52c1d7f66de05a6bf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/916-161-0x0000019B82C90000-0x0000019B82CB0000-memory.dmp
            Download

            memory/916-155-0x0000019B801E0000-0x0000019B802E0000-memory.dmp
            Download

            memory/916-167-0x0000019B82CB0000-0x0000019B82CD0000-memory.dmp
            Download

            memory/916-162-0x0000019B82E90000-0x0000019B82F90000-memory.dmp
            Download

            memory/916-176-0x0000019B94230000-0x0000019B94250000-memory.dmp
            Download

            memory/2404-418-0x000002C1142D0000-0x000002C1142F0000-memory.dmp
            Download

            memory/2404-372-0x000002C1001E0000-0x000002C1002E0000-memory.dmp
            Download

            memory/2404-374-0x000002C1001E0000-0x000002C1002E0000-memory.dmp
            Download

            memory/2404-395-0x000002C103C90000-0x000002C103CB0000-memory.dmp
            Download

            memory/2404-386-0x000002C113E50000-0x000002C113F50000-memory.dmp
            Download

            memory/2404-385-0x000002C103A30000-0x000002C103A50000-memory.dmp
            Download

            memory/3428-312-0x0000000003770000-0x0000000003771000-memory.dmp
            Download