Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 21:30
Behavioral task
behavioral1
Sample
2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe
- Size 664KB
- Sample260729-1csshswvhy
- SHA256 5d8e489eb40f402e6860cf557305389e701094d50be64e39373a7cf6cb6da9d9
- MD5 0653d8212ef8cd54783ee8ba5f982e20
- SHA1 8296238888198649c73cad1f0694a991ac8a5e9f
- SHA512 03bb65c8ed1ffa69bbb3489d427ce8f9de332627edaa6c9388502088ef3f0d8fe2ada3db5878bed6b53f450ab056ff642a8824ef807d84e134586c56480d48df
- SSDEEP 12288:vj9Lw63ct47h4QKAzYzTFjX92XH0NNmC3U0RzSa:vj9Lw63ct04QFzY1jX96H0NNn3U3a
- TLSH T1BFE46E12B7C24075ECB3067105BBEB7B5A34F9204A21C68FA788C959AF736D19D39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\dbzip2.dll 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\dbexe2.dll 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\LockFile.dat 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\DbTasker.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\hal.dll 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Windows\SysWOW64\DBTASK.EXE 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe -
resource yara_rule behavioral2/memory/2660-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/files/0x000c00000001c64a-5.dat upx behavioral2/memory/2660-315-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2660-412-0x0000000000400000-0x0000000000450000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files\common files\microsoft shared\clicktorun\Norton AntiVirus 2006 BETA.rar .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\az-latn-az\Pamela Anderson FULL VIDEO.mpg .scr 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\fr-fr\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\is-is\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\es\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\ja\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\af-za\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\am-et\NORTON Internet security 2006.rar .scr 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\be-by\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\bn-in\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\en-gb\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\et-ee\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\hu-hu\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\sv-se\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\tt-ru\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\office16\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\vgx\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\zh-hans\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\cs\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\af-za\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\hi-in\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\hy-am\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\vsto\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\8.0.15\Internet Explorer 7 FULL BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\ru\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\ca-es-valencia\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\es-mx\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\ga-ie\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\zh-tw\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\msinfo\en-us\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\msinfo\es-es\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\msinfo\it-it\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\de\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\tr\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\cs\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\mk-mk\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\vi-vn\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\fr\How to stop NetSky.doc .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\it\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\es\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\insert\Windows XP SP3 REAL VERSION.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\fr\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\fr\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\it\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe - Program crash 1 IoCs
pid pid_target Process procid_target 5744 2660 WerFault.exe 86 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe - NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\WinRAR 4.01 Cracked BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\èpxc:\program files\common files\microsoft shared\ink\id-id\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\.exec:\progrdc:\program files\common files\microsoft shared\ink\id-id\Windows 2000.iso .com 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\=« 1°ãdc:\program files\common files\microsoft shared\ink\nb-no\Windows XP SP3 REAL VERSION.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\.exec:\progrdc:\program files\common files\microsoft shared\ink\uk-ua\Windows 2000.iso .com 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ Dummies.pdf .exec:\program files\¼UXv5 1¨èdc:\program files\common files\microsoft shared\source engine\WinAmp 5.08 FULL.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\fïÏw\c:\program files\common files\microsoft shared\ink\az-latn-az\WinAmp 5.08 FULL.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\cy-gb\WinRAR 4.01 Cracked BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\èpxc:\program files\common files\microsoft shared\ink\sr-latn-rs\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\èpxc:\program files\common files\microsoft shared\ink\ug-cn\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\uz-latn-uz\WinRAR 4.01 Cracked BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\Hacking for Dummies.pdf .cpl 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\DEO.mpg c:\progrc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\pl\WinAmp 5.08 FULL.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\¨ 1 ádc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\de\Windows XP SP3 REAL VERSION.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\ga-ie\WinRAR 4.01 Cracked BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\=« 1°ãdc:\program files\common files\microsoft shared\ink\af-za\Windows XP SP3 REAL VERSION.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\~Ïw¿¬Ûc:\program files\common files\microsoft shared\ink\fsdefinitions\main\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\~Ïw¿¬Ûc:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\gl-es\WinRAR 4.01 Cracked BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\èpxc:\program files\common files\microsoft shared\ink\ja-jp\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\=« 1°ãdc:\program files\common files\microsoft shared\ink\kn-in\Windows XP SP3 REAL VERSION.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\=« 1°ãdc:\program files\common files\microsoft shared\ink\ug-cn\Windows XP SP3 REAL VERSION.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\fïÏw \program files\common files\ÿc:\program files\common files\microsoft shared\ink\fr-ca\WinAmp 5.08 FULL.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\~Ïw¿¬Ûc:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\Full warez download sites.html .pif 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\s.pd \program files\common files\ÿc:\program files\common files\microsoft shared\ink\mr-in\WinAmp 5.08 FULL.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\=« 1°ãdc:\program files\common files\microsoft shared\ink\sq-al\Windows XP SP3 REAL VERSION.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\.exec:\progrdc:\program files\common files\microsoft shared\ink\ur-pk\Windows 2000.iso .com 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\èpxc:\program files\common files\microsoft shared\vsto\10.0\1033\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\èpxc:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ .pifc:\program files\dotnet\shared\microsoft.netcore.app\Internet Explorer 7 FULL BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\èpxc:\program files\common files\microsoft shared\ink\fsdefinitions\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\common files\microsoft shared\ink\am-et\Windows 2000.iso .com 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\bg-bg\WinRAR 4.01 Cracked BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\fïÏwWc:\program files\common files\microsoft shared\ink\bs-latn-ba\WinAmp 5.08 FULL.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\fïÏwVc:\program files\common files\microsoft shared\ink\da-dk\WinAmp 5.08 FULL.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\ms-my\WinRAR 4.01 Cracked BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\.exec:\progrdc:\program files\common files\microsoft shared\ink\quz-pe\Windows 2000.iso .com 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\sl-si\WinRAR 4.01 Cracked BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\tt-ru\WinRAR 4.01 Cracked BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ènxc:\program files\common files\microsoft shared\vsto\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\ko\Windows 2000.iso .com 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\zh-hans\Windows 2000.iso .com 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\¨ 1 ádc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\pt-br\Windows XP SP3 REAL VERSION.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ènxc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\tr\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\#îÒw$Üdc:\program files\common files\microsoft shared\ink\af-za\HalfLife 2 WORKING Steam Activation crack.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\common files\microsoft shared\ink\fsdefinitions\main\WinRAR 4.01 Cracked BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\s.pd \program files\common files\c:\program files\common files\microsoft shared\¼UXv¥ 1ædc:\program files\common files\microsoft shared\ink\ta-in\WinAmp 5.08 FULL.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Amp 5.08 FULdc:\program files\common files\microsoft shared\vc\Windows 2000.iso .com 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\Windows 2000.iso .com 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\DEO.mpg c:\progrc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\pt-br\WinAmp 5.08 FULL.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\DEO.mpg c:\progrc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\zh-hans\WinAmp 5.08 FULL.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\es\WinRAR 4.01 Cracked BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\èpxc:\program files\common files\microsoft shared\ink\be-by\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\=« 1°ãdc:\program files\common files\microsoft shared\ink\fa-ir\Windows XP SP3 REAL VERSION.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\common files\microsoft shared\ink\fr-ca\Windows 2000.iso .com 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Àc:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Visual Studio .NET FULL.zip .cpl 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\fïÏw <Zvc:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\WinAmp 5.08 FULL.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\DVD Xcopy PRO Illegal Warez.iso .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\H‹tc:\program files\dotnet\shared\mic:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\zh-hans\WinAmp 5.08 FULL.zip .exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\cs\Windows 2000.iso .com 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Àc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\Visual Studio .NET FULL.zip .cpl 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\tr\WinRAR 4.01 Cracked BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\zh-hans\Windows 2000.iso .com 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\zh-hans\WinRAR 4.01 Cracked BETA.exe 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe 2660 2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_0653d8212ef8cd54783ee8ba5f982e20_amadey_elex_glassworm_smoke-loader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2660 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 50082⤵
- Program crash
PID:5744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2660 -ip 26601⤵PID:1504
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 678KB
- SHA256 dd3cd3735666599209e171a10fac96c69df3878609a512fc33e8233cd03d0cac
- MD5 0640e6c52a3e6506ebd73c5d5925b8ab
- SHA1 b86c9aeafd77497a9aa6a6df8df1a3e97bb9ba9e
- SHA512 0f6b95faa66458430bd2c92e4f8c8e5ff320e6a33db6f5468ab2aadf281d7ca11d25749b8cdb6eacc4fe5158df105e4eb4ab88d1ded36f2d4eff0805deeb9214
- SSDEEP 12288:vj9Lw63ct47h4QKAzYzTFjX92XH0NNmC3U0RzSYaW:vj9Lw63ct04QFzY1jX96H0NNn3U3YaW
- TLSH T1D3E46E12B7C24075E9B3067105BBEB775A34F9204A21C68FA788CA5DAF736C19D39327
- MD5 SHA1 SHA512 SSDEEP TLSH