07d5bdffd14707ae82165e578cae060cc27a413d5a2e619f9fb97f61d81e271c

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
Size 9.2MB
Sample260701-exp2gaes3l
SHA256 07d5bdffd14707ae82165e578cae060cc27a413d5a2e619f9fb97f61d81e271c
MD5 76031e3dc7b409e39740a964c97ec733
SHA1 eac635b936c432adcf76ad79c54ada3ff8e139f3
SHA512 eac8a1cfdc21eb18f5c3786e12fcb3fc29e37e6b9d3e17dcef4f79dfbdd4825b82b8470b6c465f8795116154037a7dd7a96921243f17d1131aeeedb5fa13ac95
SSDEEP 196608:xvsJD+MPo0VTqtQxkNtfv9cycyv+Yug/tUNGi1J:xkxO6xSF7zX/WNGWJ
TLSH
T186A6F113BAC4243AC4BA063A843B97589D3F7A616756CD9F1BF4485C8E361803E3A75F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence pyinstaller trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe"	wininit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe"	icsys.ico.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wininit.exe

UAC bypass 3 TTPs 15 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe

Executes dropped EXE 7 IoCs

pid	Process
5496	icsys.ico.exe
6092	2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
2500	wininit.exe
5008	wininit.exe
4708	spoolsv.exe
856	spoolsv.exe
1920	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Svchost = "c:\\windows\\svchost.exe"	icsys.ico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Wininit = "c:\\windows\\wininit.exe"	icsys.ico.exe

Checks whether UAC is enabled 1 TTPs 10 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	icsys.ico.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	icsys.ico.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\svchost.exe	svchost.exe
File opened for modification	C:\Windows\Wininit	2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Wininit	icsys.ico.exe
File created	\??\c:\windows\wininit.exe	icsys.ico.exe
File opened for modification	\??\c:\windows\wininit.exe	icsys.ico.exe
File opened for modification	\??\c:\windows\wininit.exe	wininit.exe
File created	\??\c:\windows\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\svchost.exe	spoolsv.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d00000001c55a-17.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.ico.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5496	icsys.ico.exe
5496	icsys.ico.exe
4708	spoolsv.exe
4708	spoolsv.exe
2500	wininit.exe
2500	wininit.exe
2500	wininit.exe
2500	wininit.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe
2500	wininit.exe
2500	wininit.exe
1920	svchost.exe
1920	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2500	wininit.exe
1920	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 5496	2752	2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe	88
PID 2752 wrote to memory of 6092	2752	2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe	89
PID 5496 wrote to memory of 2500	5496	icsys.ico.exe	90
PID 2500 wrote to memory of 4708	2500	wininit.exe	94
PID 2500 wrote to memory of 856	2500	wininit.exe	95
PID 4708 wrote to memory of 1920	4708	spoolsv.exe	96

System policy modification 1 TTPs 15 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	icsys.ico.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2752
- C:\Users\Admin\AppData\Roaming\icsys.ico.exe
  C:\Users\Admin\AppData\Roaming\icsys.ico.exe
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5496
- - C:\windows\wininit.exe
    "C:\windows\wininit.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of hidden/system files in Explorer
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2500
  - - C:\Users\Admin\appdata\roaming\spoolsv.exe
      "C:\Users\Admin\appdata\roaming\spoolsv.exe" /SE
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4708
    - - C:\windows\svchost.exe
        
        "C:\windows\svchost.exe"
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of hidden/system files in Explorer
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        System policy modification
        
        PID:1920
  - - C:\Users\Admin\appdata\roaming\spoolsv.exe
      "C:\Users\Admin\appdata\roaming\spoolsv.exe" /SE
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:856
- \??\c:\users\admin\appdata\local\temp\2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
  c:\users\admin\appdata\local\temp\2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
  2⤵
  - Executes dropped EXE
  PID:6092

\??\c:\windows\wininit.exe
c:\windows\wininit.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-30_76031e3dc7b409e39740a964c97ec733_darkgate_datper_elex_gcleaner_glassworm_icedid_luca-stealer_njrat.exe
Size 6.4MB
SHA256 0cc78669aeae1a15a984f7ff2517cda5c7ed3f992a45f0a7fb55f29587260db8
MD5 a5bd0b28207a5353024189be48427d90
SHA1 7c215e5e29e86bf4f3728e191b57f5db7a340d9c
SHA512 6ff78fa2b50ddedde3743cc26d9171bb85b43167774791e10d698849b4decdcfede3bb44d078064cd794f2f4ffc95bbfe019f4ffa7e1c261d8065d182b7775b5
SSDEEP 196608:0+MPo0VTqtQxkNtfv9cycyv+Yug/tUNGi1:AO6xSF7zX/WNGW
TLSH
T1156623527B4015E7EEFD4037D44B49045AA238FFC7A19EEE3AE862A917431E5093BF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.ico.exe

Path C:\Users\Admin\AppData\Roaming\icsys.ico.exe
Size 2.9MB
SHA256 4489dea2931f34ef0d1baca5b8c79dd6eababf4dd91304239f7a5fb53a080dda
MD5 2a92b9ccc8650b382f4b85b837ffdcf2
SHA1 2009c63b74ae4586e5c6318f4b19c377de1e851f
SHA512 50e175b885b3f5fff0d8e9bd8e485dcf743a87830cc2bce44f32da64cfc6e8e731c5a1afc5e0cdbb18f1e47dc950d2fa2f71a482cfdadd74313a6c402dd0c1f8
SSDEEP 24576:a2Fu/HGcDdQwWH+7aU2E0lFgG9XqcSUXI+SwBeSwtPpoc+yu0cjZxY6jRt5oHkvb:Vu/dUpCw4SIjcP0idTfTXE5JJ7g97B
TLSH
T1DAD55C13BAC4243AC0AB163A847BA7589D3F76613B56CD9F57F0485C8E361803E3A65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wininit

Path C:\Windows\Wininit
Size 17B
SHA256 764df4d37a31be29b4d87041c66c520cf72260d05b22c92df5f61e1eb67ef728
MD5 dc88c4aa03f5180bbece1abdfec93e70
SHA1 59662d61697f32a522dc6cfeb67202803b311788
SHA512 f3b434bfa1767976744b80abe90c4d9614aecbacca889571ba90e8c848808bed73d37b21eb56afa51234481c36ba74348bb791f43655be4f0ee9bca8df89ae49
MD5 SHA1 SHA512

Submit Download

memory/856-28-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1920-34-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/1920-32-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-47-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-38-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-59-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-57-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-55-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-53-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-31-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-51-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-33-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-49-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-35-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-45-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-40-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2500-43-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2752-20-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/2752-0-0x00000000006F0000-0x00000000006F2000-memory.dmp

Download

memory/2752-1-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/4708-30-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/5008-25-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/5496-11-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/5496-12-0x0000000000400000-0x0000000000768000-memory.dmp

Download

memory/5496-23-0x0000000000400000-0x0000000000768000-memory.dmp

Download