Overview

overview

7

Static

static

3

gtkhash-w3...er.exe

windows10-ltsc_2021-x64

7

_icons/org...sh.ico

windows10-ltsc_2021-x64

3

_scripts/postinst.cmd

windows10-ltsc_2021-x64

3

_scripts/postinst.sh

windows10-ltsc_2021-x64

3

mingw32/bin/edit.dll

windows10-ltsc_2021-x64

3

mingw32/bi...he.exe

windows10-ltsc_2021-x64

1

mingw32/bi...rs.exe

windows10-ltsc_2021-x64

3

mingw32/bi...as.exe

windows10-ltsc_2021-x64

1

mingw32/bi...le.exe

windows10-ltsc_2021-x64

3

mingw32/bi...er.exe

windows10-ltsc_2021-x64

3

mingw32/bi...ch.exe

windows10-ltsc_2021-x64

3

mingw32/bi....0.exe

windows10-ltsc_2021-x64

1

mingw32/bi...sh.exe

windows10-ltsc_2021-x64

3

mingw32/bi...-0.dll

windows10-ltsc_2021-x64

3

mingw32/bi...-0.dll

windows10-ltsc_2021-x64

3

mingw32/bi...-1.dll

windows10-ltsc_2021-x64

3

mingw32/bi...on.dll

windows10-ltsc_2021-x64

3

mingw32/bi...ec.dll

windows10-ltsc_2021-x64

3

mingw32/bi...nc.dll

windows10-ltsc_2021-x64

3

mingw32/bi...-1.dll

windows10-ltsc_2021-x64

3

mingw32/bi...-2.dll

windows10-ltsc_2021-x64

3

mingw32/bi...-2.dll

windows10-ltsc_2021-x64

3

mingw32/bi...-1.dll

windows10-ltsc_2021-x64

3

mingw32/bi...-1.dll

windows10-ltsc_2021-x64

3

mingw32/bi...-1.dll

windows10-ltsc_2021-x64

3

mingw32/bi...-0.dll

windows10-ltsc_2021-x64

3

mingw32/bi...-1.dll

windows10-ltsc_2021-x64

3

mingw32/bi...-0.dll

windows10-ltsc_2021-x64

3

var/lib/pa...nstall

windows10-ltsc_2021-x64

1

var/lib/pa...nstall

windows10-ltsc_2021-x64

1

var/lib/pa...nstall

windows10-ltsc_2021-x64

1

var/lib/pa...nstall

windows10-ltsc_2021-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    1799s
  • max time network
    1133s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260126-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    29/04/2026, 11:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    gtkhash-w32-1.4-1-installer.exe
  • Size 22.2MB
  • Sample260429-nplhrafs2p
  • SHA256 b1d077d2a373db9dbbac28fcdb4286fb992bd40d1c875179f5c778f89df52c35
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\gtkhash-w32-1.4-1-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\gtkhash-w32-1.4-1-installer.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\gtkhash-w32\_scripts\postinst.cmd" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs""
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4732
      • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
        usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
          usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4660
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
            usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2052
            • C:\Program Files (x86)\gtkhash-w32\usr\bin\cygpath.exe
              "C:\Program Files (x86)\gtkhash-w32\usr\bin\cygpath.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1192
        • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
          usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1764
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
            usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5740
            • C:\Program Files (x86)\gtkhash-w32\usr\bin\basename.exe
              "C:\Program Files (x86)\gtkhash-w32\usr\bin\basename.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1832
        • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
          usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2600
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
            usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2616
            • C:\Program Files (x86)\gtkhash-w32\mingw32\bin\gtk-update-icon-cache-3.0.exe
              "C:\Program Files (x86)\gtkhash-w32\mingw32\bin\gtk-update-icon-cache-3.0.exe" -q -t -f mingw32/share/icons/Adwaita
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1312
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
            usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5884
            • C:\Program Files (x86)\gtkhash-w32\mingw32\bin\gdk-pixbuf-query-loaders.exe
              "C:\Program Files (x86)\gtkhash-w32\mingw32\bin\gdk-pixbuf-query-loaders.exe" --update-cache
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:3476
        • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
          usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1904
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
            usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2468
            • C:\Program Files (x86)\gtkhash-w32\usr\bin\basename.exe
              "C:\Program Files (x86)\gtkhash-w32\usr\bin\basename.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1476
        • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
          usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3364
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
            usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3900
            • C:\Program Files (x86)\gtkhash-w32\usr\bin\cat.exe
              "C:\Program Files (x86)\gtkhash-w32\usr\bin\cat.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:5548
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
            usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:464
            • C:\Program Files (x86)\gtkhash-w32\mingw32\bin\fc-cache.exe
              "C:\Program Files (x86)\gtkhash-w32\mingw32\bin\fc-cache.exe" -f
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4912
        • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
          usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3828
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
            usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:648
            • C:\Program Files (x86)\gtkhash-w32\usr\bin\basename.exe
              "C:\Program Files (x86)\gtkhash-w32\usr\bin\basename.exe"
              6⤵
              • Executes dropped EXE
              PID:5780
        • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
          usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1524
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
            usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1400
            • C:\Program Files (x86)\gtkhash-w32\mingw32\bin\glib-compile-schemas.exe
              "C:\Program Files (x86)\gtkhash-w32\mingw32\bin\glib-compile-schemas.exe" mingw32/share/glib-2.0/schemas
              6⤵
              • Executes dropped EXE
              PID:5972
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
            usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2388
            • C:\Program Files (x86)\gtkhash-w32\mingw32\bin\gtk-update-icon-cache-3.0.exe
              "C:\Program Files (x86)\gtkhash-w32\mingw32\bin\gtk-update-icon-cache-3.0.exe" -qf mingw32/share/icons/hicolor
              6⤵
              • Executes dropped EXE
              PID:3340
        • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
          usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6032
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
            usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6000
            • C:\Program Files (x86)\gtkhash-w32\usr\bin\basename.exe
              "C:\Program Files (x86)\gtkhash-w32\usr\bin\basename.exe"
              6⤵
              • Executes dropped EXE
              PID:5432
        • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
          usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:664
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
            usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:996
            • C:\Program Files (x86)\gtkhash-w32\mingw32\bin\gtk-update-icon-cache-3.0.exe
              "C:\Program Files (x86)\gtkhash-w32\mingw32\bin\gtk-update-icon-cache-3.0.exe" -q -t -f mingw32/share/icons/hicolor
              6⤵
              • Executes dropped EXE
              PID:1060
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
            usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2996
            • C:\Program Files (x86)\gtkhash-w32\mingw32\bin\gdk-pixbuf-query-loaders.exe
              "C:\Program Files (x86)\gtkhash-w32\mingw32\bin\gdk-pixbuf-query-loaders.exe" --update-cache
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1916
        • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
          usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2508
          • C:\Program Files (x86)\gtkhash-w32\usr\bin\touch.exe
            "C:\Program Files (x86)\gtkhash-w32\usr\bin\touch.exe"
            5⤵
            • Executes dropped EXE
            PID:5964
        • C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
          usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" -- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2596
          • C:\Program Files (x86)\gtkhash-w32\mingw32\bin\win7appid.exe
            "C:\Program Files (x86)\gtkhash-w32\mingw32\bin\win7appid.exe" "C:/ProgramData/Microsoft/Windows/Start Menu/Programs/GtkHash (w32)/GtkHash.lnk" MSYS2.gtkhash-w32.org.gtkhash.gtkhash.1.4-1
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3732

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        postinst.cmd
        • Path C:\Program Files (x86)\gtkhash-w32\_scripts\postinst.cmd
        • Size 509B
        • SHA256 0d8f8b1b03a3f76bfbab7861bde74f83f87b0722922135ef89db8975acc8c736
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        postinst.sh
        • Path C:\Program Files (x86)\gtkhash-w32\_scripts\postinst.sh
        • Size 2KB
        • SHA256 58aabb206ea587c23a89e4ec18dc0865033be9e3de8cea1b54fb3b3fa12e523f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        gdk-pixbuf-query-loaders.exe
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\gdk-pixbuf-query-loaders.exe
        • Size 25KB
        • SHA256 84dcc4469a330b4d6fc3dd002fac229b0f792252eed4beebb494697210a4fc2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gtk-update-icon-cache-3.0.exe
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\gtk-update-icon-cache-3.0.exe
        • Size 45KB
        • SHA256 738bbfb7429fdd7e4726660ff9a45a1077f57ef15aab7a7b567ae7866e938fe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\libffi-7.dll
        • Size 33KB
        • SHA256 b5f9dacd663f8937317d48ee9e692a0b01aca68a98b4841707a84dae7bb9e0fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libgcc_s_dw2-1.dll
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\libgcc_s_dw2-1.dll
        • Size 121KB
        • SHA256 851e72093c615942f18c31c706c8024735a256f2a9ef2004463cd69801ed55cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libgdk_pixbuf-2.0-0.dll
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\libgdk_pixbuf-2.0-0.dll
        • Size 189KB
        • SHA256 d1541dba6e20ad4c92b885bc96840bf40789d2fc44bff067e52c9dae81a462f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libgio-2.0-0.dll
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\libgio-2.0-0.dll
        • Size 1.7MB
        • SHA256 350b2e969966de247528a53348488a076fb2c1851781aca56c7e1214189ca024
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libglib-2.0-0.dll
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\libglib-2.0-0.dll
        • Size 1.3MB
        • SHA256 55971e07842a3d0ad41861c12c4fea81682d3ff223033caec03123b0fad2720a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libgmodule-2.0-0.dll
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\libgmodule-2.0-0.dll
        • Size 21KB
        • SHA256 bda4fb463be5f8fba91a6e71bfd25733231157891f5c005573dc3e107e00e237
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libgobject-2.0-0.dll
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\libgobject-2.0-0.dll
        • Size 325KB
        • SHA256 981c893379fbb5a86ed3c9504155bfe0b8663f682a4bfe101187426271694c8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libiconv-2.dll
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\libiconv-2.dll
        • Size 1.0MB
        • SHA256 1428a13678d6436d59501f8afed42424615201466f77d89d01c7e1be6bd3c998
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libintl-8.dll
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\libintl-8.dll
        • Size 141KB
        • SHA256 bfea70d28f9fe01338b3c788579cd74ce8e6d348fa12176759bd56e949ceedfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libpcre-1.dll
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\libpcre-1.dll
        • Size 278KB
        • SHA256 e3550469990ab30539496481b274762088cef4a312d725f9409a36137e862573
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libwinpthread-1.dll
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\libwinpthread-1.dll
        • Size 63KB
        • SHA256 42fb56816fa9ae18b957c2211e3f2b96393576957b77efdd0588f591e7ff66c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\bin\zlib1.dll
        • Size 95KB
        • SHA256 6bce2b823d11af082511f3d69bcc61d9654719f63f757921a8f0e7a01e11f220
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        .icon-theme.cache
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\share\icons\hicolor\.icon-theme.cache
        • Size 228B
        • SHA256 fbc75a3f7d112c41d37057cfb9321dbaf4be3120136064b8a734aa5a2a151e76
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        gtk30.mo
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\share\locale\en_GB\LC_MESSAGES\gtk30.mo
        • Size 101KB
        • SHA256 f3aba8aaf7cfe4f0861590a30fce08281756713878eb197de7c1b5b50010046b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        glib20.mo
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\share\locale\es\LC_MESSAGES\glib20.mo
        • Size 130KB
        • SHA256 0cd096d75226b201fb0e708dd059d32c8f34036a30b02cb816bd2cb32f40a058
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        glib20.mo
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\share\locale\ta\LC_MESSAGES\glib20.mo
        • Size 157KB
        • SHA256 292ad95287dc58eb45ab381b6b5a54a5ee864f4177b16721428e05a95dc9224e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gtk30.mo
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\share\locale\tr\LC_MESSAGES\gtk30.mo
        • Size 105KB
        • SHA256 d3a08c2698c23bfcffe31181b13fe2cc8c77d6fafa1b0db985830f05263f8e56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d031bbba323fd9e5b47e0ee5a0353f11-i686.cache-7
        • Path C:\Program Files (x86)\gtkhash-w32\mingw32\var\cache\fontconfig\d031bbba323fd9e5b47e0ee5a0353f11-i686.cache-7
        • Size 1.3MB
        • SHA256 bb7072735c4ae7f9b8e739694b8875b6a2985e434f6ab0c2897012a629275396
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        basename.exe
        • Path C:\Program Files (x86)\gtkhash-w32\usr\bin\basename.exe
        • Size 34KB
        • SHA256 a22525cc03f5b852ee8192b4f187fd075ec96a85275f60f14a5297afae331dba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bash.exe
        • Path C:\Program Files (x86)\gtkhash-w32\usr\bin\bash.exe
        • Size 1.9MB
        • SHA256 64903cbceb56192c52707f8c2541cb00b4daba44d9d5fe2f2dbcc7b3bd56f370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cygpath.exe
        • Path C:\Program Files (x86)\gtkhash-w32\usr\bin\cygpath.exe
        • Size 263KB
        • SHA256 c8f53124e47485b2400b07cd5cb8c10f24b74eb5f8a47b1187a057a633ba0bf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msys-2.0.dll
        • Path C:\Program Files (x86)\gtkhash-w32\usr\bin\msys-2.0.dll
        • Size 3.0MB
        • SHA256 c4ab1a519f6b8f594c27e5bb150b61cf623444c968e89124ef78ea393024ee4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msys-gcc_s-1.dll
        • Path C:\Program Files (x86)\gtkhash-w32\usr\bin\msys-gcc_s-1.dll
        • Size 108KB
        • SHA256 513bf47ce87c3d71d1d0a64861bd786327356c1a67006ea5a27ddbaa5dd98024
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msys-iconv-2.dll
        • Path C:\Program Files (x86)\gtkhash-w32\usr\bin\msys-iconv-2.dll
        • Size 903KB
        • SHA256 814f3b871a64ea226b955e818568d5ab8238e88abc3f439bb2972b0422a66037
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msys-intl-8.dll
        • Path C:\Program Files (x86)\gtkhash-w32\usr\bin\msys-intl-8.dll
        • Size 44KB
        • SHA256 f8d79f52f5599dfc02f86f4962c9e5cc2eb61753e92b7cef4e72a70e9e3e086e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        install
        • Path C:\Program Files (x86)\gtkhash-w32\var\lib\pacman\local\mingw-w64-i686-adwaita-icon-theme-3.36.0-1\install
        • Size 483B
        • SHA256 60788a7f2fdc26a7cd1c962093991171b4236c2ff74dcb4a23aba8da74a41ff2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/464-2418-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/464-2384-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/648-2427-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/648-2423-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/1192-2236-0x0000000000400000-0x0000000000444000-memory.dmp
        Download

        memory/1192-2235-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/1192-2238-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/1312-2316-0x0000000066200000-0x000000006630A000-memory.dmp
        Download

        memory/1312-2311-0x0000000061EC0000-0x0000000061EEB000-memory.dmp
        Download

        memory/1312-2314-0x0000000066E40000-0x0000000066E4E000-memory.dmp
        Download

        memory/1312-2315-0x0000000068100000-0x0000000068159000-memory.dmp
        Download

        memory/1312-2312-0x000000006EB40000-0x000000006EB66000-memory.dmp
        Download

        memory/1312-2308-0x0000000000400000-0x0000000000410000-memory.dmp
        Download

        memory/1312-2309-0x000000006F940000-0x000000006F976000-memory.dmp
        Download

        memory/1312-2317-0x0000000064B40000-0x0000000064B58000-memory.dmp
        Download

        memory/1312-2310-0x0000000064BC0000-0x0000000064D13000-memory.dmp
        Download

        memory/1312-2318-0x0000000071240000-0x0000000071250000-memory.dmp
        Download

        memory/1312-2319-0x0000000069340000-0x000000006938C000-memory.dmp
        Download

        memory/1312-2320-0x0000000063080000-0x000000006309E000-memory.dmp
        Download

        memory/1312-2321-0x0000000000EC0000-0x000000000105D000-memory.dmp
        Download

        memory/1312-2313-0x00000000615C0000-0x0000000061777000-memory.dmp
        Download

        memory/1476-2355-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/1476-2364-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/1524-2472-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/1524-2437-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/1764-2245-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/1764-2270-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/1764-2268-0x0000000000400000-0x00000000005FE000-memory.dmp
        Download

        memory/1832-2265-0x000000006AC00000-0x000000006AC22000-memory.dmp
        Download

        memory/1832-2267-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/1832-2266-0x00000000618C0000-0x00000000619A7000-memory.dmp
        Download

        memory/1832-2262-0x0000000000400000-0x000000000040F000-memory.dmp
        Download

        memory/1832-2264-0x0000000062000000-0x0000000062010000-memory.dmp
        Download

        memory/1832-2258-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/1904-2367-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/1904-2365-0x0000000000400000-0x00000000005FE000-memory.dmp
        Download

        memory/1904-2353-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/2052-2233-0x0000000000400000-0x00000000005FE000-memory.dmp
        Download

        memory/2052-2234-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/2052-2230-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/2468-2354-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/2468-2356-0x0000000000400000-0x00000000005FE000-memory.dmp
        Download

        memory/2468-2358-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/2600-2349-0x0000000000400000-0x00000000005FE000-memory.dmp
        Download

        memory/2600-2273-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/2600-2351-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/2616-2322-0x0000000000400000-0x00000000005FE000-memory.dmp
        Download

        memory/2616-2324-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/2616-2277-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/3364-2368-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/3364-2421-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/3476-2340-0x000000006EB40000-0x000000006EB66000-memory.dmp
        Download

        memory/3476-2345-0x0000000066200000-0x000000006630A000-memory.dmp
        Download

        memory/3476-2336-0x0000000064BC0000-0x0000000064D13000-memory.dmp
        Download

        memory/3476-2338-0x0000000068100000-0x0000000068159000-memory.dmp
        Download

        memory/3476-2337-0x0000000066E40000-0x0000000066E4E000-memory.dmp
        Download

        memory/3476-2343-0x0000000069340000-0x000000006938C000-memory.dmp
        Download

        memory/3476-2344-0x0000000071240000-0x0000000071250000-memory.dmp
        Download

        memory/3476-2339-0x0000000061EC0000-0x0000000061EEB000-memory.dmp
        Download

        memory/3476-2342-0x0000000064B40000-0x0000000064B58000-memory.dmp
        Download

        memory/3476-2341-0x0000000063080000-0x000000006309E000-memory.dmp
        Download

        memory/3476-2334-0x0000000000400000-0x000000000040C000-memory.dmp
        Download

        memory/3476-2335-0x00000000615C0000-0x0000000061777000-memory.dmp
        Download

        memory/3828-2436-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/3828-2422-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/3900-2377-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/3900-2375-0x0000000000400000-0x00000000005FE000-memory.dmp
        Download

        memory/3900-2369-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/4356-1946-0x0000000001080000-0x000000000121D000-memory.dmp
        Download

        memory/4356-1-0x0000000001080000-0x000000000121D000-memory.dmp
        Download

        memory/4356-2393-0x0000000000400000-0x000000000081F000-memory.dmp
        Download

        memory/4356-1945-0x0000000000400000-0x000000000081F000-memory.dmp
        Download

        memory/4356-0-0x0000000000400000-0x000000000081F000-memory.dmp
        Download

        memory/4660-2239-0x0000000000400000-0x00000000005FE000-memory.dmp
        Download

        memory/4660-2241-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/4660-2228-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/4724-2395-0x0000000000400000-0x00000000005FE000-memory.dmp
        Download

        memory/4724-2396-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/4724-2537-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/4724-2221-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/4724-2352-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/4912-2409-0x0000000063080000-0x000000006309E000-memory.dmp
        Download

        memory/4912-2400-0x000000006EB40000-0x000000006EB66000-memory.dmp
        Download

        memory/4912-2403-0x0000000066200000-0x000000006630A000-memory.dmp
        Download

        memory/4912-2404-0x0000000064B40000-0x0000000064B58000-memory.dmp
        Download

        memory/4912-2405-0x000000006E640000-0x000000006E655000-memory.dmp
        Download

        memory/4912-2406-0x00000000628C0000-0x00000000628D9000-memory.dmp
        Download

        memory/4912-2407-0x000000006FA40000-0x000000006FB4D000-memory.dmp
        Download

        memory/4912-2408-0x0000000068D40000-0x0000000068D82000-memory.dmp
        Download

        memory/4912-2398-0x0000000065180000-0x00000000651D5000-memory.dmp
        Download

        memory/4912-2399-0x0000000061EC0000-0x0000000061EEB000-memory.dmp
        Download

        memory/4912-2397-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/4912-2401-0x0000000069140000-0x0000000069177000-memory.dmp
        Download

        memory/4912-2402-0x0000000063600000-0x00000000636C1000-memory.dmp
        Download

        memory/5548-2379-0x0000000062000000-0x0000000062010000-memory.dmp
        Download

        memory/5548-2374-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/5548-2378-0x0000000000400000-0x0000000000410000-memory.dmp
        Download

        memory/5548-2383-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/5740-2261-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/5740-2259-0x0000000000400000-0x00000000005FE000-memory.dmp
        Download

        memory/5740-2249-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/5780-2433-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/5780-2424-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/5884-2348-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download

        memory/5884-2346-0x0000000000400000-0x00000000005FE000-memory.dmp
        Download

        memory/5884-2328-0x0000000061000000-0x00000000614C0000-memory.dmp
        Download