14635fa0948b03d6ffb4e86446fe413848803a4fd193298a96974a02dd1915ec

Analysis

max time kernel
150s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
Size 3.0MB
Sample260605-pddjfaew5s
SHA256 14635fa0948b03d6ffb4e86446fe413848803a4fd193298a96974a02dd1915ec
MD5 3fb3ec298e4018dc94abec860aac4134
SHA1 3229c88337f67fd7f22bb3ef0beba69842af7604
SHA512 b016d7e65bb827bac20b1341bd1b076ee25982c766af4c0f1584247440ef516181b0b16b94a6cae1d855d1f8ad8ab87cc051a6f1159bdf47aaa8674f1af52dca
SSDEEP 49152:Vu/dUpCw4SIjcP0idTfTXE5JJ7g97K8Ls6:Vg4midTSJIB
TLSH
T17BE56D13BAC4243AC0AB163A8477A7589D3FBA612B56CD9F57F4484C8E351803E3A75F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe"	icsys.ico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe"	wininit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe"	svchost.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wininit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

UAC bypass 3 TTPs 15 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe

Executes dropped EXE 7 IoCs

pid	Process
5316	icsys.ico.exe
2308	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
4268	wininit.exe
5932	wininit.exe
4216	spoolsv.exe
5400	spoolsv.exe
3212	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Wininit = "c:\\windows\\wininit.exe"	icsys.ico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Svchost = "c:\\windows\\svchost.exe"	icsys.ico.exe

Checks whether UAC is enabled 1 TTPs 10 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	icsys.ico.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\svchost.exe	svchost.exe
File opened for modification	C:\Windows\Wininit	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Wininit	icsys.ico.exe
File created	\??\c:\windows\wininit.exe	icsys.ico.exe
File opened for modification	\??\c:\windows\wininit.exe	icsys.ico.exe
File opened for modification	\??\c:\windows\wininit.exe	wininit.exe
File created	\??\c:\windows\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.ico.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5316	icsys.ico.exe
5316	icsys.ico.exe
4216	spoolsv.exe
4216	spoolsv.exe
4268	wininit.exe
4268	wininit.exe
4268	wininit.exe
4268	wininit.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe
4268	wininit.exe
4268	wininit.exe
3212	svchost.exe
3212	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4268	wininit.exe
3212	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 5316	4872	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe	80
PID 4872 wrote to memory of 2308	4872	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe	81
PID 5316 wrote to memory of 4268	5316	icsys.ico.exe	83
PID 4268 wrote to memory of 4216	4268	wininit.exe	87
PID 4268 wrote to memory of 5400	4268	wininit.exe	88
PID 4216 wrote to memory of 3212	4216	spoolsv.exe	89

System policy modification 1 TTPs 15 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	svchost.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4872
- C:\Users\Admin\AppData\Roaming\icsys.ico.exe
  C:\Users\Admin\AppData\Roaming\icsys.ico.exe
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5316
- - C:\windows\wininit.exe
    "C:\windows\wininit.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of hidden/system files in Explorer
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4268
  - - C:\Users\Admin\appdata\roaming\spoolsv.exe
      "C:\Users\Admin\appdata\roaming\spoolsv.exe" /SE
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4216
    - - C:\windows\svchost.exe
        
        "C:\windows\svchost.exe"
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of hidden/system files in Explorer
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        System policy modification
        
        PID:3212
  - - C:\Users\Admin\appdata\roaming\spoolsv.exe
      "C:\Users\Admin\appdata\roaming\spoolsv.exe" /SE
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5400
- \??\c:\users\admin\appdata\local\temp\2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
  c:\users\admin\appdata\local\temp\2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2308

\??\c:\windows\wininit.exe
c:\windows\wininit.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-05_3fb3ec298e4018dc94abec860aac4134_darkgate_datper_elex_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
Size 155KB
SHA256 81ba64a836bcc83edfe22c0bd5a7aabc0d0412e06d585477bb46dc7ec829b9c6
MD5 a9a05bfbecb56b93169710635d606e90
SHA1 d91d0728940c8537f9b7c16982fb8ce4ccd786ca
SHA512 bde16883059b7ac1c78bae06b5ca004054afd679c82e68f802530f16a8a36da29b03d74c8c9990273f6732609d492ac4cf5261c46e9124ff3620db670344ec18
SSDEEP 3072:Es0tSMzZSFQFgd8ORA3j6DUnGfe0tJfGNDss:Es0t501VAHGVfows
TLSH
T191F36B1036C1C471E173023649F9AB21167EFD764F668ADBB7D84E8E0A741C06B7A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.ico.exe

Path C:\Users\Admin\AppData\Roaming\icsys.ico.exe
Size 2.9MB
SHA256 75ebaa1eecc0370cb7fa03d9badf3654710e5b2aef20581ade760c9e163ab973
MD5 ba0b64d1abd37c0bd13b60a514edd1bf
SHA1 1e0c45955d5fce59fdeffa0789627535544fe939
SHA512 ff1422eaa89083079d304541170ad0b5608a7da6f9a800735458bdf2576eb6920f3f5e4095076edd22e61cb76afcd57540effbc506dbfa282ea56f1ac88694d0
SSDEEP 24576:a2Fu/HGcDdQwWH+7aU2E0lFgG9XqcSUXI+SwBeSwtPpoc+yu0cjZxY6jRt5oHkvT:Vu/dUpCw4SIjcP0idTfTXE5JJ7g97l
TLSH
T1ABD55C23BAC4243AC0AB163A8477A7589D3F76613B56CD9F57F0485C8E361803E3A65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wininit

Path C:\Windows\Wininit
Size 17B
SHA256 764df4d37a31be29b4d87041c66c520cf72260d05b22c92df5f61e1eb67ef728
MD5 dc88c4aa03f5180bbece1abdfec93e70
SHA1 59662d61697f32a522dc6cfeb67202803b311788
SHA512 f3b434bfa1767976744b80abe90c4d9614aecbacca889571ba90e8c848808bed73d37b21eb56afa51234481c36ba74348bb791f43655be4f0ee9bca8df89ae49
MD5 SHA1 SHA512

Submit Download

memory/3212-66-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4216-63-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-79-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-87-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-93-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-33-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-91-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-36-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-89-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-76-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-83-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-64-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-81-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-67-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-69-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-71-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4268-73-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4872-0-0x00000000006F0000-0x00000000006F2000-memory.dmp

Download

memory/4872-1-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4872-19-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/5316-13-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/5316-10-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/5316-32-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/5400-52-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/5932-45-0x0000000000400000-0x0000000000768000-memory.dmp

Download