Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 12:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe
- Size 860KB
- Sample260604-pcafdsez9r
- SHA256 772749cd9d94e954deaa332239f61dea16f10fb17d3911361a9f046863bc0874
- MD5 c9e4f0f886eef0e1df8323cbe585ee15
- SHA1 bdd6d7a5ec00acd684fdc0d128331aea841a8183
- SHA512 7eefbc6f2f884a04300b69dddee0dc861d210574fc091641c16fff6fd2ba20d879f6ababbb8293cc75a65e02eda22541630a93a7c263c4896513342498cea853
- SSDEEP 12288:nj9Lw63ct47h4QKAzYz+yA4+cw8ZiMvnW4+cF0RzSy:nj9Lw63ct04QFzYbw8ZbnZF3y
- TLSH T195155B12B6D680B4ECB325B519FEAA764235B9210B2087CFA7C8CA5DDE717D08D39353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DbTasker.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\hal.dll 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\DBTASK.EXE 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\dbzip2.dll 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\dbexe2.dll 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\LockFile.dat 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\DbTasker.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\cs\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Todo.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\sl-si\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\de-de\Full warez download sites.html .pif 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\msinfo\it-it\Windows XP SP3 REAL VERSION.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\WinAmp 5.08 FULL.zip ̨Uu¾‰¾ædc:\program files\dotnet\shared\microsoft.netcore.app\8.0.15\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\Pamela Anderson FULL VIDEO.mpg .scr 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\it\Windows XP SP3 REAL VERSION.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\it\Full warez download sites.html .pif 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ru\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\de\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\he-il\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\lv-lv\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\1033\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\Playboy centerfold HOT.gif .scr 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\de\Windows XP SP3 REAL VERSION.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\zh-hant\Windows XP SP3 REAL VERSION.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\msinfo\fr-fr\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\vgx\Full warez download sites.html .pif 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ja\How to stop NetSky.doc .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4692 3432 WerFault.exe 81 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe - NTFS ADS 64 IoCs
description ioc Process File created C:\åóBc:\program files\common files\microsoft shared\ink\cs-cz\WinAmp 5.08 FULL.zip ̨Uu¾‰¾ædc:\program files\common files\microsoft shared\ink\da-dk\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\l[u,ådc:\program files\common files\microsoft shared\ink\fsdefinitions\main\Hacking and Virus Writing for Dummies.pdf .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\l[u¼çdc:\program files\common files\microsoft shared\ink\pt-br\Hacking and Virus Writing for Dummies.pdf .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\l[u,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\pl\Hacking and Virus Writing for Dummies.pdf .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\l[u¼çdc:\program files\common files\microsoft shared\ink\it-it\Hacking and Virus Writing for Dummies.pdf .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Õ¾ðédc:\program files\common files\microsoft shared\officesoftwareprotectionplatform\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\‚c:\program files\common files\microsoft shared\vsto\10.0\1033\Hacking for Dummies.pdf .cpl 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\microsoft shared\vsto\10.0\DVD Xcopy PRO Illegal Warez.iso .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\µ¾Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\ja\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\0Œžc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\tr\Windows 2000.iso .com 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\l[u,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\ko\Hacking and Virus Writing for Dummies.pdf .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ÌÛdc:\program files\common files\microsoft shared\clicktorun\Windows XP SECRET DEVELOPER serials.txt .cmd 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ðˆžc:\program files\common files\microsoft shared\ink\fsdefinitions\insert\Windows 2000.iso .com 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ádc:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\Windows XP SP3 REAL VERSION.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Suc:\program files\common files\microsoft shared\ink\tr-tr\WinAmp 5.08 FULL.zip ̨Uu¾‰¾ædc:\program files\common files\microsoft shared\ink\uk-ua\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Suc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\cs\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\åöBc:\program files\common files\microsoft shared\ink\ar-sa\WinAmp 5.08 FULL.zip ̨Uu¾‰¾ædc:\program files\common files\microsoft shared\ink\ca-es\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\°Šžc:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Windows 2000.iso .com 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ðŒžc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ja\Windows 2000.iso .com 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\p†žc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\fr\Windows 2000.iso .com 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\U Bwc:\program files\common files\microsoft shared\clicktorun\Visual Studio .NET FULL.zip .cpl 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ádc:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Windows XP SP3 REAL VERSION.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\°Šžc:\program files\common files\microsoft shared\ink\fsdefinitions\main\Windows 2000.iso .com 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Suc:\program files\common files\microsoft shared\ink\nb-no\WinAmp 5.08 FULL.zip ̨Uu¾‰¾ædc:\program files\common files\microsoft shared\ink\pl-pl\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Suc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\zh-hans\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Suc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\pl\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\l[u,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\zh-hant\Hacking and Virus Writing for Dummies.pdf .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\åóBc:\program files\common files\microsoft shared\ink\cs-cz\WinAmp 5.08 FULL.zip ̨Uu¾‰¾ædc:\program files\common files\microsoft shared\ink\en-us\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\E¾`çdc:\program files\common files\microsoft shared\ink\he-il\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\E¾`çdc:\program files\common files\microsoft shared\ink\zh-cn\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\µ¾Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\zh-hant\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\µ¾Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\cs\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\l[u¼çdc:\program files\common files\microsoft shared\ink\ar-sa\Hacking and Virus Writing for Dummies.pdf .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\°Šžc:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\Windows 2000.iso .com 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ .cmdc:\program files\common files\microsoft shared\vsto\10.0\Playboy centerfold HOT.gif .scr 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\‡“Bwc:\program files\common files\microsoft shared\clicktorun\NORTON Internet security 2006.rar .scr 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\€¤EwTÛdc:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP2 WORKING activation crack.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\µ¾Ðädc:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\óc:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\Full warez download sites.html .pif 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ÌâóBc:\program files\common files\microsoft shared\ink\fsdefinitions\main\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\als.txt .cmdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\es\Kazaa Lite 2005 Edition.rar .pif 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\µ¾Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\fr\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\E¾`çdc:\program files\common files\microsoft shared\ink\ca-es\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\µ¾Ðädc:\program files\common files\microsoft shared\ink\fsdefinitions\main\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\µ¾Ðädc:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\l[u¼çdc:\program files\common files\microsoft shared\ink\sl-si\Hacking and Virus Writing for Dummies.pdf .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\l[u,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ko\Hacking and Virus Writing for Dummies.pdf .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ð‹žc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\cs\Windows 2000.iso .com 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\l[u¼çdc:\program files\common files\microsoft shared\ink\ru-ru\Hacking and Virus Writing for Dummies.pdf .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Suc:\program files\common files\microsoft shared\ink\th-th\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\l[u,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\de\Hacking and Virus Writing for Dummies.pdf .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Suc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\pt-br\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\xc:\program files\common files\microsoft shared\ink\cs-cz\Hacking for Dummies.pdf .cpl 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ÌâóBc:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\E¾`çdc:\program files\common files\microsoft shared\ink\pt-br\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\E¾`çdc:\program files\common files\microsoft shared\ink\vi-vn\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\l[u,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\es\Hacking and Virus Writing for Dummies.pdf .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\åóBc:\program files\common files\microsoft shared\ink\cs-cz\WinAmp 5.08 FULL.zip ̨Uu¾‰¾ædc:\program files\common files\microsoft shared\ink\fr-ca\WinAmp 5.08 FULL.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\l[u¼çdc:\program files\common files\microsoft shared\ink\uk-ua\Hacking and Virus Writing for Dummies.pdf .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\es\Matrix Reloaded.avi .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\clicktorun\Hacking for Dummies.pdf .cpl 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ádc:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Windows XP SP3 REAL VERSION.zip .exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\E¾`çdc:\program files\common files\microsoft shared\msinfo\ja-jp\WinRAR 4.01 Cracked BETA.exe 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ð‹žc:\program files\common files\microsoft shared\vgx\Windows 2000.iso .com 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe 3432 2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_c9e4f0f886eef0e1df8323cbe585ee15_amadey_elex_glassworm_smoke-loader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3432 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 90602⤵
- Program crash
PID:4692
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3432 -ip 34321⤵PID:2436
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 1024KB
- SHA256 1f1dae91e8d53598e8f066de151b36aea2f841934fe2646178c88611d8ef4333
- MD5 dcdaf19927ecac431adb3d50eac9421c
- SHA1 bd4a3545e8d71105ea339090ef7fb98c6c0b4bd8
- SHA512 6b3897c96d6442e7bd31112ce4b7b8396ef86c495db658efdd8897a64614cd19759f78ce33ed3a9658fc648dbff973291a2b331327e7ce95081b0b19a4cb1e67
- SSDEEP 12288:nj9Lw63ct47h4QKAzYz+yA4+cw8ZiMvnW4+cF0RzSkfqCgsB:nj9Lw63ct04QFzYbw8ZbnZF3tCbB
- TLSH T1B9256C12B6D540B4D8B315B95AFEAA76D335B8150B2187CFA7C8CA1D9F32AE0493D313
- MD5 SHA1 SHA512 SSDEEP TLSH