Analysis
- max time kernel
150s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 03:14
Behavioral task
behavioral1
Sample
2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe
- Size 3.9MB
- Sample260803-drbffsbd73
- SHA256 b75ed9862589f8004ffc5a9be7f1bb701688507eebe07cc0cbc5a5e1166cd6d2
- MD5 9bbc818264c3a20f15f35962ce331189
- SHA1 cd7b4454960a5c21cc56e2720e37548a962a151f
- SHA512 5e4766d6c1e980d25a6aed41e9fc8453aa36c78851209aa2531cf8d4ffb1aaf076bbca8a6011083b9d3559fe37ad3e270f76b4afda411cd5d15599ce1b3e06dc
- SSDEEP 49152:vj9LxcO4Q5Yrw8ZbnZFhEf2hvZPzN/xw6n1wRjJm6KxturNp5uLgVLKRWTQ6Zs5m:vjBxcO4EYkf2xZPzNsGb6d3KRuy5at
- TLSH T19F16AE23F29240F1D8632170167B76769679BA200B3AA5CF5388DE396E31AC1DF38757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\dbzip2.dll 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\dbexe2.dll 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\LockFile.dat 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\DbTasker.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\hal.dll 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\DBTASK.EXE 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe -
resource yara_rule behavioral2/memory/3412-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/files/0x000c00000001c5d4-6.dat upx behavioral2/memory/3412-66-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3412-187-0x0000000000400000-0x0000000000450000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\Windows XP SP3 REAL VERSION.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ja\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\es-es\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\fr-fr\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\ka-ge\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\languagemodel\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\uk-ua\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\cs\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\bg-bg\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\hr-hr\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\zh-hans\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\uk-ua\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\fr-fr\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\pt-pt\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\am-et\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\en-gb\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\sv-se\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\ru\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\vgx\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\1033\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\ko\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\cy-gb\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\ko-kr\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\tt-ru\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\it\Pamela Anderson FULL VIDEO.mpg .scr 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\cs\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\de\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\ru\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\msinfo\en-us\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\insert\Pamela Anderson FULL VIDEO.mpg .scr 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\gl-es\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\sl-si\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\de\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\pl\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\zh-hans\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\cs\Pamela Anderson FULL VIDEO.mpg .scr 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\insert\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\lt-lt\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\is-is\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\kk-kz\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\ta-in\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\ko\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\lt-lt\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\mk-mk\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\nb-no\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\da-dk\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\nb-no\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\common files\microsoft shared\ink\ne-np\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\pt-br\How to stop NetSky.doc .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3136 3412 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe - NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\clicktorun\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\_smoke-loadedc:\program files\common files\microsoft shared\ink\nb-no\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\sl-si\WinRAR 4.01 Cracked BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\sv-se\WinRAR 4.01 Cracked BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\zh-hant\WinRAR 4.01 Cracked BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ …ý°ãdc:\program files\common files\microsoft shared\ink\eu-es\Windows XP SP3 REAL VERSION.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\_smoke-loadedc:\program files\common files\microsoft shared\ink\ja-jp\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\common files\microsoft shared\ink\el-gr\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\common files\microsoft shared\ink\eu-es\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\kok-in\WinRAR 4.01 Cracked BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ …ý°ãdc:\program files\common files\microsoft shared\ink\sq-al\Windows XP SP3 REAL VERSION.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\_smoke-loadedc:\program files\common files\microsoft shared\ink\sv-se\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Amp 5.08 FULdc:\program files\common files\microsoft shared\vc\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ .cmdc:\program files\dotnet\shared\microsoft.netcore.app\8.0.15c:\program files\dotnet\shared\microsoft.netcore.app\8.0.15\Kazaa Lite 2005 Edition.rar .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Žc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\pl\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\_smoke-loadec:\program files\common files\microsoft shared\ink\hr-hr\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\lb-lu\WinRAR 4.01 Cracked BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ …ý°ãdc:\program files\common files\microsoft shared\msinfo\de-de\Windows XP SP3 REAL VERSION.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\vgx\Internet Explorer 7 FULL BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\it\Internet Explorer 7 FULL BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ "c:\program files\dotnet\shared\mic:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\pt-br\WinAmp 5.08 FULL.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Žc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\zh-hant\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\fr\Internet Explorer 7 FULL BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\af-za\Hacking for Dummies.pdf .cpl 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\_smoke-loadedc:\program files\common files\microsoft shared\ink\pt-pt\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\€c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\WinAmp 5.08 FULL.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\sktop.app\7.0.16c:\program fc:\progrc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\pl\WinAmp 5.08 FULL.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ …ý°ãdc:\program files\common files\microsoft shared\ink\chr-cher-us\Windows XP SP3 REAL VERSION.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\df \program files\common files\ÿc:\program files\common files\microsoft shared\ink\qps-ploc\WinAmp 5.08 FULL.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\common files\microsoft shared\msinfo\ja-jp\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\Internet Explorer 7 FULL BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\de\WinRAR 4.01 Cracked BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\it\NORTON Internet security 2006.rar .scr 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\sktop.app\6.0.27c:\program fc:\progrc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\tr\WinAmp 5.08 FULL.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\…ý ádc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\fr\Windows XP SP3 REAL VERSION.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\common files\microsoft shared\ink\fi-fi\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\gu-in\WinRAR 4.01 Cracked BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\hu-hu\WinRAR 4.01 Cracked BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\_smoke-loadedc:\program files\common files\microsoft shared\ink\kn-in\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\df c:\progrÿc:\program files\common files\microsoft shared\ink\mr-in\WinAmp 5.08 FULL.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ko\WinRAR 4.01 Cracked BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\sktop.app\6.0.27c:\program fc:\progrc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\pl\WinAmp 5.08 FULL.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\de\WinRAR 4.01 Cracked BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ …ý°ãdc:\program files\common files\microsoft shared\ink\bs-latn-ba\Windows XP SP3 REAL VERSION.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\df c:\program files\common files\microsoft shared\ink\fsdefinitions\WinAmp 5.08 FULL.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\_smoke-loadedc:\program files\common files\microsoft shared\ink\it-it\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\_smoke-loadedc:\program files\common files\microsoft shared\ink\ko-kr\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ …ý°ãdc:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\Windows XP SP3 REAL VERSION.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\fr\Internet Explorer 7 FULL BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\pt-br\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\…ý ádc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\de\Windows XP SP3 REAL VERSION.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\af-za\WinRAR 4.01 Cracked BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\~w¦Ù c:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\Full warez download sites.html .pif 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\_smoke-loadec:\program files\common files\microsoft shared\ink\he-il\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\or-in\WinRAR 4.01 Cracked BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\‹c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\zh-hans\Hacking and Virus Writing for Dummies.pdf .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\common files\microsoft shared\ink\az-latn-az\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\mk-mk\WinRAR 4.01 Cracked BETA.exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\_smoke-loadedc:\program files\common files\microsoft shared\ink\or-in\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\€c:\program files\common files\microsoft shared\office16\office setup controller\WinAmp 5.08 FULL.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ "c:\program files\common files\microsoft shared\vsto\10.0\1033\WinAmp 5.08 FULL.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\_smoke-loadedc:\program files\dotnet\shared\microsoft.netcore.app\Windows 2000.iso .com 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe File created C:\Users\Admin\AppData\Local\Temp\ "c:\program files\dotnet\shared\mic:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\de\WinAmp 5.08 FULL.zip .exe 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe 3412 2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_9bbc818264c3a20f15f35962ce331189_amadey_elex_glassworm_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3412 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 24842⤵
- Program crash
PID:3136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3412 -ip 34121⤵PID:3476
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 2.1MB
- SHA256 6f15b06766dae8f6298320a3ceb6e5514d079802021f61be923a3c961acd1928
- MD5 3de622fbcd4ead3e4859cfa6ef1e1fa1
- SHA1 6b9109e0b2c5756a9ffbb010ef360c3d780ff976
- SHA512 b6444c5ed6bfc2cd95561efe67eac90ee832f287bf81061ba36a6842a351a5eeafcd8d7616e0063e538112f3e817eb6a40c3b274862922311bb888fc073d48b3
- SSDEEP 49152:vj9LxcO4Q5Yrw8ZbnZFhEf2hvZPzN/xw6n1wRjJmN:vjBxcO4EYkf2xZPzNsU
- TLSH T1C5A59E22F2D244B0D8B321B116BE7676D735BE310B29A6CF66C8C9796A306D0DB35713
- MD5 SHA1 SHA512 SSDEEP TLSH