Analysis
- max time kernel
114s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 16:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe
- Size 2.7MB
- Sample260423-vb39zaas5j
- SHA256 1493ca46bc344bb4212534bf9ae25b70d0d3a330139c9748081dd494c94a5ad6
- MD5 95a6458454cfdefbf4fb0341265a2a86
- SHA1 1424477e9883fd82a67482f29879461897a346b8
- SHA512 165b32dbcbe926b4cecd5e32ebf60aa3a460a7d198bcc57d560fc92198ad81e57852b3e20e06aee24179b3bbf1d35844f13057b0ced2ccdeeb8a701cc5e4f41d
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOHr2lapPji0Aj:4K5N55sgjOk9WObjo
- TLSH T11FD57B12FB6087FAC8624171C9A693B4E6767C610B20E7CB525CEB1D1E32BD15E37722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/2732-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b3a2-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5032-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a19d-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028e0f-1223.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2732-1332-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5032-1333-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001a5fe-1345.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001400000001a5fe-1449.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001800000001a5fe-1492.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000025023-2098.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 5032 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2732 2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe 5032 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_95a6458454cfdefbf4fb0341265a2a86_amadey_darkgate_elex_glassworm_rhadamanthys_stop_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2732
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5032
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 1493ca46bc344bb4212534bf9ae25b70d0d3a330139c9748081dd494c94a5ad6
- MD5 95a6458454cfdefbf4fb0341265a2a86
- SHA1 1424477e9883fd82a67482f29879461897a346b8
- SHA512 165b32dbcbe926b4cecd5e32ebf60aa3a460a7d198bcc57d560fc92198ad81e57852b3e20e06aee24179b3bbf1d35844f13057b0ced2ccdeeb8a701cc5e4f41d
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOHr2lapPji0Aj:4K5N55sgjOk9WObjo
- TLSH T11FD57B12FB6087FAC8624171C9A693B4E6767C610B20E7CB525CEB1D1E32BD15E37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 3.4MB
- SHA256 29a144c5ca6172a4243d8c0f946b560973bf96b6c5df15339a900368c750ee9c
- MD5 46b89f8ea4a4c9f970dc24269db75175
- SHA1 cd5d601854acdd10d997cd9f329ee7c011b1edd6
- SHA512 f57e1d1cbf9c8ea83147f63f9e3599233b6755b36136f413b1eb13ad9f62322e3b2b4f1a275bc49a0bfd1eb0651fb63c8d5ad180ec79a14039c05695c434a630
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOHr2lapPji0AjPVk0QGTvntQb:4K5N55sgjOk9WObjoCHaib
- TLSH T17EF58B12F7A487FAD8768135C5A69265E6717C210730E7CB02A8E71D1F33AE19E3B721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 2.8MB
- SHA256 e1b15b2c77f12cd3bb5d332721cf82bc9b0679a9e273d3ca10d7b955d0e5234c
- MD5 6cdd3244c8294be0d8b8f3892a716fb3
- SHA1 0dfa7a134bf864cc91bb2ed74a5e69b1db3b7a6e
- SHA512 f36d3e8febcbbaa39bd04a4078b0595b299259ffc9c26f8fe49ad94f7a6e5341398e1f556caa629681b7aec655b90a210020b92046d6ad62b325a5235c9e0d48
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOHr2lapPji0AjOW:4K5N55sgjOk9WObjoSW
- TLSH T123D57B12FB6087FAC8624171C9A69374E6767C610B20E7CB525CEB1D1E32BD19E37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.2MB
- SHA256 a359abf53d530c434e05c2d37e63d21cab7fdb7787d0d50a4cf6dbe05d125e86
- MD5 53b709251530b5fe4c3caf76086a3afd
- SHA1 317b6b64e19864c7c6b991f786e7a754e5f16fe4
- SHA512 970dfe612435a28f546cceacdba2050dbe9399ea56df6c589ca7c391c9488232dd6959c08c5ee3786f89e51ce6da41fb96ccdaf4a8eabd1fedc983c28cb496e4
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOHr2lapPji0AjoTd9CHKyao:4K5N55sgjOk9WObjoKCqo
- TLSH T1FBF57C12F7A086FAD8734131C9A69374E6767C610B20E7CB529CA61D1E33BD15E37B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.3MB
- SHA256 54fd359386c81c77df127781c296ffa2b133125cb2f660f0b59e5061c0940c12
- MD5 ac222cda76d676db3060a601861da100
- SHA1 d208c9a2e6ad86eee0e24caf0a22d310c0f69a5c
- SHA512 4890bce4a1f852fd90ec1c00c182e9da9fab2f17533ee3c505e363833ec7125c4a245596c1829f02d98728c7724e968ce4163c20c6d3f8ecfc25923b8ba38fdc
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOHr2lapPji0AjKPji0Aj:4K5N55sgjOk9WObjo0jo
- TLSH T1DAF56B12F76487FAD8728075C9A293A9E97178510B30D7CB5249E72C2E33BD19E37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 2.8MB
- SHA256 8fdb7d5b20301e5b90cfdb0db10c5fee525ee75423af4a2e628cd3425f93d9d3
- MD5 4616ca5979af24979035319f0f68503d
- SHA1 c9742d01dcb0e5c29cd4bda50f600ada6325ea54
- SHA512 37fc817ad4b5b2f1e22ebbc67022760c4d92b838b1e7721b62cfba664a78278763ca380d0f9f7e4f533efefb2af8789f741f75fd7d45cb2bf7fb1ff1a5f7a3cf
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOHr2lapPji0Ajq:4K5N55sgjOk9WObjo2
- TLSH T109D56A12FBA087FAC8624131C9A69374A6767C610B20E7CB525CFB1D5E32BD15E37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe
- Size 2.7MB
- SHA256 adfa99ad5b34c1ca3125af4c8f1f18f52eb6d37d70658f023bb3cf89d064aba0
- MD5 ec69991fcd1b7a4f4db489283f001da5
- SHA1 0b47c40a3db12c66d12ea8efedfcd88c61332f65
- SHA512 016e203615e815165e5156252819a2b64394c72db58b7a45fff3e375c039d15f24ed4333b5e20785a68fb02c5fe56db8ff10f3d7a2a95336fa561ce8d987f732
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOHr2lapPji0Aj:4K5N55sgjOk9WObjo
- TLSH T13CD57B12FB6087FAC8624171C9A693B4E6767C610B20E7CB524CEB1D1E32BD15E37722
- MD5 SHA1 SHA512 SSDEEP TLSH