mofksys | a8cb4081abd10d9e60575006569497ba287155056b8b3699b288ab02ff6a2cbd

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe
Size 8.3MB
Sample260720-nff7nsf19r
SHA256 a8cb4081abd10d9e60575006569497ba287155056b8b3699b288ab02ff6a2cbd
MD5 b0d6a65cc21baeddcc5983d6c3c63de4
SHA1 dfbb6f64c64a40f3d72644ae7378d316a2a4710d
SHA512 afd444f3061c97853d6ec4f45ea312d892e5292b4efdecf1d8a3b7af6fcf2287cd5d080893f0180a9786b38088c2ac2e6e2832479ed6ebc85db8d053e80d782b
SSDEEP 196608:W7sYvBD91pTdjhGHbHtDrcjdcqWz0kCJGotn0/OULy47TakAwn2bJvv4JxAFQ0+:W7sYvN91pT4
TLSH
T18F962902B380E437D1190AB0493AD7B97775FE251B228A0B6EE42E1F3E757907D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery mofksys persistence worm

Malware Config

Signatures

Family: Mofksys
Mofksys is a worm written in VisualBasic.
worm mofksys

Detects Mofksys worm 13 IoCs

resource	yara_rule
behavioral2/memory/1332-0-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/files/0x000c00000001c619-12.dat	family_mofksys
behavioral2/memory/3812-18-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/files/0x000e00000001c616-20.dat	family_mofksys
behavioral2/memory/1332-22-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/files/0x000d00000001c61d-33.dat	family_mofksys
behavioral2/files/0x000d00000001c61f-42.dat	family_mofksys
behavioral2/memory/4856-51-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/2900-54-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/3812-55-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/files/0x000d00000001c622-56.dat	family_mofksys
behavioral2/memory/4244-58-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/1344-59-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
4552	2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe
3812	icsys.icn.exe
4244	explorer.exe
2900	spoolsv.exe
1344	svchost.exe
4856	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3812	icsys.icn.exe
3812	icsys.icn.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
1344	svchost.exe
1344	svchost.exe
1344	svchost.exe
1344	svchost.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
1344	svchost.exe
1344	svchost.exe
4244	explorer.exe
1344	svchost.exe
4244	explorer.exe
1344	svchost.exe
1344	svchost.exe
4244	explorer.exe
4244	explorer.exe
1344	svchost.exe
4244	explorer.exe
4244	explorer.exe
1344	svchost.exe
1344	svchost.exe
1344	svchost.exe
1344	svchost.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
1344	svchost.exe
1344	svchost.exe
4244	explorer.exe
1344	svchost.exe
1344	svchost.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
1344	svchost.exe
1344	svchost.exe
4244	explorer.exe
1344	svchost.exe
1344	svchost.exe
4244	explorer.exe
4244	explorer.exe
1344	svchost.exe
4244	explorer.exe
1344	svchost.exe
4244	explorer.exe
1344	svchost.exe
4244	explorer.exe
1344	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4244	explorer.exe
1344	svchost.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1332	2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe
1332	2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe
3812	icsys.icn.exe
3812	icsys.icn.exe
4244	explorer.exe
4244	explorer.exe
2900	spoolsv.exe
2900	spoolsv.exe
1344	svchost.exe
1344	svchost.exe
4856	spoolsv.exe
4856	spoolsv.exe
4244	explorer.exe
4244	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 4552	1332	2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe	89
PID 1332 wrote to memory of 3812	1332	2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe	90
PID 3812 wrote to memory of 4244	3812	icsys.icn.exe	91
PID 4244 wrote to memory of 2900	4244	explorer.exe	92
PID 2900 wrote to memory of 1344	2900	spoolsv.exe	93
PID 1344 wrote to memory of 4856	1344	svchost.exe	94
PID 1344 wrote to memory of 4128	1344	svchost.exe	97
PID 1344 wrote to memory of 5808	1344	svchost.exe	100
PID 1344 wrote to memory of 2452	1344	svchost.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332
- \??\c:\users\admin\appdata\local\temp\2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe
  c:\users\admin\appdata\local\temp\2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4552
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3812
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of hidden/system files in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2900
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1344
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4856
      - C:\Windows\SysWOW64\at.exe
        
        at 12:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4128
      - C:\Windows\SysWOW64\at.exe
        
        at 12:23 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
      - C:\Windows\SysWOW64\at.exe
        
        at 12:24 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-20_b0d6a65cc21baeddcc5983d6c3c63de4_darkgate_elex_gcleaner_glassworm_wannacry.exe
Size 8.1MB
SHA256 6c91bfd1dd3d2c37c7fc34a097fd636bf70bfadd438357738f73c14b2448e707
MD5 b0b2d505acbeddc39caeba9fca5c9dec
SHA1 a9253e6b9e06fd00bdc13bd836d79a2982b1b4bc
SHA512 eb3700d8c5d5b9b37a0773a64294c99f448750f14202a2db0a4cf469033c347b3560700fc5936f82d580fb332fa08d29fc6ee0f5416b678268e6c145b007da17
SSDEEP 196608:ysYvBD91pTdjhGHbHtDrcjdcqWz0kCJGotn0/OULy47TakAwn2bJvv4JxAFQ0:ysYvN91pT
TLSH
T18A861802B380E437C1190AB4493AD7B97775FE251B22860B6EE42E1F3E757907D2AB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Users\Admin\AppData\Local\icsys.icn.exe
Size 206KB
SHA256 09706d6ac90560452ada482d1b9112fc11e933c3f95ffb73821c968448e63e48
MD5 fb1785e1fef91a9f194acd6f01f7c8da
SHA1 4667146e91c5ce750eb791929e8c2c8154b3d6d0
SHA512 ffec80d6b67c003b2f2563497ab6e8ad20c31b76d4f2c2d85a98f519147046979d0e44ec93e409dba87bad1d8bc4b2886443d107e9635fa9c1630b59c716c47a
SSDEEP 3072:wvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un4p:wvEN2U+T6i5LirrllHy4HUcMQY6F
TLSH
T18124FB1BFE40603EE8A786F018A6A166BA256D351F90AC4F67D1AF463875513F0F431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 206KB
SHA256 a765ec602f514f1aa1c1ce5fa2cf128caaebbae2bdd8925aadd2f70dfcda74e8
MD5 87993d6f2a0ffcec3ee485365e479dc5
SHA1 6cc4884181d2b1d5022233dd1a1d9ece2e096f8f
SHA512 5bfbb033c6f76a675aec3fa506274b079991756ad5723998297a59b09ac543a5bb83b39ec8c287a41d382540711a0d9807495288c5e76c8b571860db1f45ba3d
SSDEEP 3072:wvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un4V:wvEN2U+T6i5LirrllHy4HUcMQY6h
TLSH
T1C3240B1BFE40603ED863C5F15822A196BA362E661FA19C0F67D1AF8674B1913B5F031F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 206KB
SHA256 8bcf03ba8deee0c4a011b26b9d9f5579cf997487507de8625baeae2f20a50011
MD5 9c58ce7324f5c0aeaeccdb6bc9061f2d
SHA1 97e64f60e8636a68bf091a094dc3a6864cf7ca9b
SHA512 c7e919d2d03a4515e1f905a4853ba145c423314e3cc11faeebb8d05659b4dbbc394d0bf1f004249b219dc90a72c8d2c583808a3ee2415a6aee202f0b79b4f8f6
SSDEEP 3072:wvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un4i:wvEN2U+T6i5LirrllHy4HUcMQY62
TLSH
T1F824F92BE600702FD46385F19C62A2AABA712E351B915D0F6381EF4A3DB4513B6F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 206KB
SHA256 9d5ecd15b04eeb86c2f664181f7022f5e7c808e6db7ae0edacf6ea3190f5cfd6
MD5 8f9c8f115a22375afec1117fd04cc900
SHA1 ffdc1d67fd75965bdf86e0e093045e37a78165ea
SHA512 cfe9cb0947598849bd1375fa935dd79f01119af88575a7819f211ab725e912de5b959af1da18f86a3f76e10ea2e0cf742fdcd9a9c4115c22c80c21b367de798f
SSDEEP 3072:wvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un47:wvEN2U+T6i5LirrllHy4HUcMQY6n
TLSH
T19424F92BEA00602FE8A7D1F02867B55BB6216E661F91AC4B6BD0EF453875553B0F430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 206KB
SHA256 3b7fd5099ab42ed3c0450726a66310e6778fc6e6a1a4192e7f31a5f7a071e439
MD5 223d3f5818185e6a15f721a6f0a90abc
SHA1 201ca149d5cd697ca98236f50eaf32a42aa35a64
SHA512 464144155516a46ad312e4043468863e362bd7562522af8badfad74c43ec59bfe111f4412259e73ca25978c10a70e6cc049ed4dc9291851be5d209d6b5e9cddc
SSDEEP 3072:wvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un4V:wvEN2U+T6i5LirrllHy4HUcMQY6Z
TLSH
T1AA240B2BEA40711ED8A785F0592662A5F7216E760B81DC0B5B90AF8974F3A03F4F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1332-22-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1332-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1344-59-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2900-54-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3812-18-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3812-55-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4244-58-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4552-14-0x0000000000400000-0x0000000000C69000-memory.dmp

Download

memory/4552-57-0x0000000000400000-0x0000000000C69000-memory.dmp

Download

memory/4856-51-0x0000000000400000-0x000000000042F000-memory.dmp

Download