floxif | 7aa18594c08be6f96b7007adfdb3c12e95d1a47d2dcb7df480367edd21c36f02

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
Size 6.9MB
Sample260809-fm9tkatzdv
SHA256 7aa18594c08be6f96b7007adfdb3c12e95d1a47d2dcb7df480367edd21c36f02
MD5 bd05da70c6e91d398111eee10fc22e7e
SHA1 4e070342f9f1d47867da766c55258461d2a1729c
SHA512 71797ee01ebdb60bb3c43775534667b15702928cf44a3194f8fdf54a92d0ebbd147ca34c92a85aaec509428e52c054060c6810edd6027dbd3bcc55ebbe9cad54
SSDEEP 98304:xntfPRIkF+zywz1Cbj/DS4DUX+TrdtrZtOSsHF/1XM:xt3RTFDwzOh+w8HfM
TLSH
T14F76F101BBD181B2F5E3553089F957B69A317F044B36C8CB63883E147E727E19A39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution floxif persistence privilege_escalation trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/files/0x00070000000245fd-35.dat	Nirsoft

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000b00000002440d-1.dat	floxif

UPX dump on OEP (original entry point) 9 IoCs

resource	yara_rule
behavioral1/files/0x000b00000002440d-1.dat	UPX
behavioral1/memory/1620-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1620-28-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1620-31-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1620-72-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1620-78-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1620-83-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1620-98-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1620-110-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Modifies Windows Firewall 2 TTPs 8 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2808	netsh.exe
1832	netsh.exe
4116	netsh.exe
4308	netsh.exe
4184	netsh.exe
4292	netsh.exe
1904	netsh.exe
4568	netsh.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KMSEmulator\ImagePath = "\"C:\\Windows\\KMS\\bin\\KMSSS.exe\" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP谀"	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KMSEmulator\ImagePath = "\"C:\\Windows\\KMS\\bin\\KMSSS.exe\" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP舀"	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b00000002440d-1.dat	acprotect

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
4984	MSActBackup.exe
2628	pdk.dat
704	bin.dat
3504	pdk.dll
1064	KMSSS.exe

Loads dropped DLL 3 IoCs

pid	Process
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1320	cscript.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b00000002440d-1.dat	upx
behavioral1/memory/1620-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1620-28-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1620-31-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1620-72-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1620-78-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1620-83-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1620-98-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1620-110-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\KMS\bin\KMSSS.exe	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
File opened for modification	C:\Windows\KMS\bin\KMSSS.log	KMSSS.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4472	sc.exe
4708	sc.exe
4332	sc.exe
1488	sc.exe
3904	sc.exe
5060	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2552	cmd.exe
3016	cmd.exe
3032	cmd.exe
4084	cmd.exe
1772	cmd.exe
4044	cmd.exe
888	cmd.exe
3028	cmd.exe
3224	cmd.exe
4188	cmd.exe
4468	cmd.exe
1440	cmd.exe
4888	cmd.exe
2416	cmd.exe
4492	cmd.exe
3408	cmd.exe
1972	cmd.exe
228	cmd.exe
3488	cmd.exe
3472	cmd.exe
5112	cmd.exe
1272	cmd.exe
3500	cmd.exe
3796	cmd.exe
3440	cmd.exe
3596	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdk.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSSS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdk.dat

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
Token: SeIncreaseQuotaPrivilege	220	WMIC.exe
Token: SeSecurityPrivilege	220	WMIC.exe
Token: SeTakeOwnershipPrivilege	220	WMIC.exe
Token: SeLoadDriverPrivilege	220	WMIC.exe
Token: SeSystemProfilePrivilege	220	WMIC.exe
Token: SeSystemtimePrivilege	220	WMIC.exe
Token: SeProfSingleProcessPrivilege	220	WMIC.exe
Token: SeIncBasePriorityPrivilege	220	WMIC.exe
Token: SeCreatePagefilePrivilege	220	WMIC.exe
Token: SeBackupPrivilege	220	WMIC.exe
Token: SeRestorePrivilege	220	WMIC.exe
Token: SeShutdownPrivilege	220	WMIC.exe
Token: SeDebugPrivilege	220	WMIC.exe
Token: SeSystemEnvironmentPrivilege	220	WMIC.exe
Token: SeRemoteShutdownPrivilege	220	WMIC.exe
Token: SeUndockPrivilege	220	WMIC.exe
Token: SeManageVolumePrivilege	220	WMIC.exe
Token: 33	220	WMIC.exe
Token: 34	220	WMIC.exe
Token: 35	220	WMIC.exe
Token: 36	220	WMIC.exe
Token: SeIncreaseQuotaPrivilege	220	WMIC.exe
Token: SeSecurityPrivilege	220	WMIC.exe
Token: SeTakeOwnershipPrivilege	220	WMIC.exe
Token: SeLoadDriverPrivilege	220	WMIC.exe
Token: SeSystemProfilePrivilege	220	WMIC.exe
Token: SeSystemtimePrivilege	220	WMIC.exe
Token: SeProfSingleProcessPrivilege	220	WMIC.exe
Token: SeIncBasePriorityPrivilege	220	WMIC.exe
Token: SeCreatePagefilePrivilege	220	WMIC.exe
Token: SeBackupPrivilege	220	WMIC.exe
Token: SeRestorePrivilege	220	WMIC.exe
Token: SeShutdownPrivilege	220	WMIC.exe
Token: SeDebugPrivilege	220	WMIC.exe
Token: SeSystemEnvironmentPrivilege	220	WMIC.exe
Token: SeRemoteShutdownPrivilege	220	WMIC.exe
Token: SeUndockPrivilege	220	WMIC.exe
Token: SeManageVolumePrivilege	220	WMIC.exe
Token: 33	220	WMIC.exe
Token: 34	220	WMIC.exe
Token: 35	220	WMIC.exe
Token: 36	220	WMIC.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3472	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	85
PID 1620 wrote to memory of 2552	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	88
PID 1620 wrote to memory of 4984	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	90
PID 2552 wrote to memory of 5060	2552	cmd.exe	91
PID 1620 wrote to memory of 3016	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	92
PID 3016 wrote to memory of 4472	3016	cmd.exe	94
PID 1620 wrote to memory of 1440	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	95
PID 4984 wrote to memory of 5112	4984	MSActBackup.exe	97
PID 1440 wrote to memory of 4184	1440	cmd.exe	99
PID 5112 wrote to memory of 2628	5112	cmd.exe	100
PID 4984 wrote to memory of 4888	4984	MSActBackup.exe	101
PID 4888 wrote to memory of 704	4888	cmd.exe	103
PID 4984 wrote to memory of 2416	4984	MSActBackup.exe	104
PID 1620 wrote to memory of 1772	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	106
PID 2416 wrote to memory of 1320	2416	cmd.exe	108
PID 1772 wrote to memory of 4292	1772	cmd.exe	109
PID 1620 wrote to memory of 4492	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	110
PID 4492 wrote to memory of 220	4492	cmd.exe	112
PID 1620 wrote to memory of 3408	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	114
PID 3408 wrote to memory of 1904	3408	cmd.exe	116
PID 1620 wrote to memory of 4044	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	118
PID 4984 wrote to memory of 888	4984	MSActBackup.exe	120
PID 4044 wrote to memory of 4568	4044	cmd.exe	122
PID 888 wrote to memory of 3504	888	cmd.exe	123
PID 1620 wrote to memory of 3028	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	124
PID 3028 wrote to memory of 2808	3028	cmd.exe	126
PID 1620 wrote to memory of 1272	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	127
PID 1272 wrote to memory of 1832	1272	cmd.exe	129
PID 1620 wrote to memory of 3032	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	130
PID 3032 wrote to memory of 4708	3032	cmd.exe	132
PID 1620 wrote to memory of 3500	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	133
PID 3500 wrote to memory of 4332	3500	cmd.exe	135
PID 1620 wrote to memory of 1972	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	137
PID 1972 wrote to memory of 4116	1972	cmd.exe	139
PID 1620 wrote to memory of 3796	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	140
PID 3796 wrote to memory of 4308	3796	cmd.exe	142
PID 1620 wrote to memory of 3440	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	143
PID 3440 wrote to memory of 1488	3440	cmd.exe	145
PID 1620 wrote to memory of 3224	1620	2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	146
PID 3224 wrote to memory of 3904	3224	cmd.exe	148
PID 4984 wrote to memory of 228	4984	MSActBackup.exe	156
PID 228 wrote to memory of 5020	228	cmd.exe	158
PID 5020 wrote to memory of 1040	5020	net.exe	159
PID 4984 wrote to memory of 4084	4984	MSActBackup.exe	160
PID 4084 wrote to memory of 4396	4084	cmd.exe	162
PID 4396 wrote to memory of 4848	4396	net.exe	163
PID 4984 wrote to memory of 4188	4984	MSActBackup.exe	164
PID 4188 wrote to memory of 2636	4188	cmd.exe	166
PID 2636 wrote to memory of 4592	2636	net.exe	167
PID 4984 wrote to memory of 3596	4984	MSActBackup.exe	172
PID 3596 wrote to memory of 4156	3596	cmd.exe	174
PID 4156 wrote to memory of 1184	4156	net.exe	175
PID 4984 wrote to memory of 4468	4984	MSActBackup.exe	176
PID 4468 wrote to memory of 824	4468	cmd.exe	178
PID 824 wrote to memory of 2904	824	net.exe	179
PID 4984 wrote to memory of 3488	4984	MSActBackup.exe	181
PID 3488 wrote to memory of 2776	3488	cmd.exe	183
PID 2776 wrote to memory of 4132	2776	net.exe	184

C:\Users\Admin\AppData\Local\Temp\2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_bd05da70c6e91d398111eee10fc22e7e_amadey_coinminer_elex_floxif_glassworm_wannacry.exe"
1⤵
- Sets service image path in registry
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y
  2⤵
  - Executes a command shell one-liner
  PID:3472
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe stop KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\system32\sc.exe
    sc.exe stop KMSEmulator
    3⤵
    - Launches sc.exe
    PID:5060
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c pdk.dat -y -pkmsauto
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\pdk.dat
      pdk.dat -y -pkmsauto
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2628
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c bin.dat -y -pkmsauto
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\bin.dat
      bin.dat -y -pkmsauto
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:704
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c cscript.exe MSActBackup.vbs //NoLogo
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\system32\cscript.exe
      cscript.exe MSActBackup.vbs //NoLogo
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1320
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c pdk.dll /nosavereg /IEKeys 0 /WindowsKeys 1 /OfficeKeys 1 /sort 3 /ExtractEdition 1 /stext
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Users\Admin\AppData\Local\Temp\PDK\pdk.dll
      pdk.dll /nosavereg /IEKeys 0 /WindowsKeys 1 /OfficeKeys 1 /sort 3 /ExtractEdition 1 /stext
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3504
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\system32\net.exe
      net stop sppsvc /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5020
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop sppsvc /y
        5⤵
        
        PID:1040
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\system32\net.exe
      net stop sppsvc /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop sppsvc /y
        5⤵
        
        PID:4848
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Windows\system32\net.exe
      net stop sppsvc /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop sppsvc /y
        5⤵
        
        PID:4592
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Windows\system32\net.exe
      net stop sppsvc /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4156
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop sppsvc /y
        5⤵
        
        PID:1184
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\system32\net.exe
      net stop sppsvc /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:824
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop sppsvc /y
        5⤵
        
        PID:2904
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\Windows\system32\net.exe
      net stop sppsvc /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop sppsvc /y
        5⤵
        
        PID:4132
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe delete KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\system32\sc.exe
    sc.exe delete KMSEmulator
    3⤵
    - Launches sc.exe
    PID:4472
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4184
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4292
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\KMS"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\KMS"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:220
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1904
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4568
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2808
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=1688
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1832
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\system32\sc.exe
    sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
    3⤵
    - Launches sc.exe
    PID:4708
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe start KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\sc.exe
    sc.exe start KMSEmulator
    3⤵
    - Launches sc.exe
    PID:4332
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4116
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4308
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\system32\sc.exe
    sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
    3⤵
    - Launches sc.exe
    PID:1488
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe start KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\system32\sc.exe
    sc.exe start KMSEmulator
    3⤵
    - Launches sc.exe
    PID:3904

C:\Windows\KMS\bin\KMSSS.exe
"C:\Windows\KMS\bin\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

office.ini

Path C:\Users\Admin\AppData\Local\Temp\Backup\Windows 10 Pro\=== 08.09.2026-06.02.14 ===\office.ini
Size 87B
SHA256 7ca18b6e55b371ccb5c1d2cb0274b1aca6563901310f0b66af1e314a77672c9a
MD5 42be5684a04b8df1aeebaee46d3554f9
SHA1 431d82098f229305c543e5298d24ff022b264da2
SHA512 3f008eaadbbc981d7612e02e4aaf87ffe8380183d6c7f7b758597c9122a6864c101aee9abbef996a82bb89ffb946e2d0fcfeca9ca35f91dffabc4f120f7db7db
TLSH
T1EBB01207B3C36B12100BCB8CC9C00011EC200C1004A38964126F80014E0206733D7000
MD5 SHA1 SHA512 TLSH

Submit Download

windows.ini

Path C:\Users\Admin\AppData\Local\Temp\Backup\Windows 10 Pro\=== 08.09.2026-06.02.14 ===\windows.ini
Size 46B
SHA256 e823d5217694c1b10b2cc200af2522f1b1a2ca61ca24b38b3a7d986345ada12b
MD5 d2668d8c953b09abd74323dfc1599d1f
SHA1 0389cf3ed6830c496a38ee66038658bd53ae10c2
SHA512 96a07f82b82b2144028a5b00354b3d7a624d6cdaa90d1ef4f45e8c158911a30adf25da0963bc316fdf2632c33854a938c0256cca7089b6a07f5cf90ce5a4b24c
MD5 SHA1 SHA512

Submit Download

MSActBackUp.ini

Path C:\Users\Admin\AppData\Local\Temp\MSActBackUp.ini
Size 29B
SHA256 9226c1e7270875fbe1a767271aad96e7447086d2b8dbdfb2bac78432e6173629
MD5 d4e5c484aa6662fa1949c2e6d140e38d
SHA1 8fee8d4743d6e43179f12995a11a26a3cc82bd9f
SHA512 e87b2903cf405810f1f77d11b188708c504a0cccd2617d5a27d2567262392534f1c8c50fe29f186cd53748b9046ba9371b2ab0e049afd648a74a6df731e1d159
MD5 SHA1 SHA512

Submit Download

MSActBackUpPath.ini

Path C:\Users\Admin\AppData\Local\Temp\MSActBackUpPath.ini
Size 36B
SHA256 ad9e97b9f2190ba89ce6f4cc70f1c7b4a45d2603dac2c2cd81d0b30dac2c456f
MD5 1c2349d78149035ec324ef221af89a7f
SHA1 7a5fe3bccf80995db71879d39cebbb30e4758417
SHA512 aadc21c0a490f21d1fbc61c7bc1ec5b58671590e8377bbdf69f94d2b2157c4ef3dbdc84ce31cf82cc74e87ca5b8b44a40699248e118895c042c2a324dd9393c1
MD5 SHA1 SHA512

Submit Download

MSActBackup.exe

Path C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
Size 1.1MB
SHA256 190b51fde585baac00b59f026acf36e501a18db726f850e1dcf192220b946bb0
MD5 bf5cb5abd4e5ba52d2bcc3af6c31db13
SHA1 2ff3d4b8fd1c7e0d40e8c4a3aa30fdd86176644f
SHA512 17f4ed70bdeef84dca517a8d39f1d48afb06bf6084d8ac4d46e780fb217272ad2fcc95b0e2ed094f8f358ce2146e9d7e3dfa902cdc0d6deeea3b802db3170668
SSDEEP 12288:T+S6RCgFDPPKR6UJr8WzA3qzJlwqku8FgIKXNvogIKXNvx+KDGgIKXNvdl:T+TRlFDPe+qzJlw7bCNwCNECNVl
TLSH
T11B45AE107BEAC0F2D5934530CCED6BF666756F088B2298C353C0BF19B9316D1AA36769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSActBackup.exe.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe.tmp
Size 1.2MB
SHA256 c24b2c6520d1f7ed5e6cf161d4347554c39ecca13126315e9fbd652a3a273259
MD5 504dddf466ac637d101cc27937ff11ef
SHA1 0f0157e312c564f421f42d4472de3122b4884b46
SHA512 576b4afbb32366a8f89ff3097e9fb1ce32600ef912aa94e38d25034a463033c96db3c0120f0ce8bd68d6553193f2605f96b9da2e5132b3b9ab42ed0d6423172b
SSDEEP 24576:N+lRlFDPe+qzJlw7bCNwCNECNVl8rEH7us:Ulr1PozWC2CqCQs
TLSH
T12745AE1037E6C1F6D0934130DCED6BF666A16F1C8B2698C393C0BF19B9356D1AA36729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdk.dll

Path C:\Users\Admin\AppData\Local\Temp\PDK\pdk.dll
Size 93KB
SHA256 814320cb353bcbd7f5df3fdb702487b14d1d1784e3af0f78c31496742a5f97c0
MD5 572c3a9213b1716851e7e3c971106b01
SHA1 f19056f326542459fdfe9465862e57c703409733
SHA512 ba39502b605be78aabfe54d695138202c835f834a3a9949ac3acb91ec64fbd89cc1e10becdfe96bfed84bfb71a2ae39dbadf439b4c86cab837190dccaeb9dd57
SSDEEP 1536:Oksz71hIrxMChN8lIDIT0PuuNZAX1b7k/5iECnKKbtNo2G4env4OUbiA/:871hixMCzBD91oX1b7k/U9LTG4env4tX
TLSH
T1F8936B43B7E04431F6E309702AF69B369EF57D715938C90F57545A8A2CB0780EE2A39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bin.dat

Path C:\Users\Admin\AppData\Local\Temp\bin.dat
Size 174KB
SHA256 635f4b5106767cc3b82e4d5fff081a028fbba08d0ff92c96f1163a34eab2086c
MD5 7758b09b145db821d9bfe5d322bf9576
SHA1 e0bc1c38095b72aaeb5ff7dd1622e8501c60f9cb
SHA512 780d479d0583d26e095a3f072396e665440961b65a7087304297d0b755cd990e7e5709cda8320e56d4b9bc6cee6c0abc498e68c546a34d0ea1d637748dd0b339
SSDEEP 3072:Ns2SFNy2gFHADJBehDWPKVj7J31JPUAAAAA+/MbNpdeuZBX/lYOgs:C/cgD+APKVjtbNCuZl/lD
TLSH
T139047C213AE5C1F7D28211308EDCABB6B1EA97480F1509C323D49B1D5F7AAE5D339A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSActBackup.vbs

Path C:\Users\Admin\AppData\Local\Temp\bin\MSActBackup.vbs
Size 34KB
SHA256 41df74896f1ab540efa72675b3fecb974af25abcee7b8bb28669d84811de3aa2
MD5 1474147d65a01143da2e7c4169801a6c
SHA1 85159efc968439e49befb85652029e7a582a3e1c
SHA512 b8d204fd4257d6e52905c0a5be1dd9d1c245c6868380c18a2ef6b12975e06af8c51438e04b516f7f7619cd9efa9d6885a0b9c6bef823767b288ce201296e8add
SSDEEP 384:2Grc7E0/hmpr7kcTcbzQ9eHF6YLSQR1vvY9WWNKe4VmE8vpgMDJRoILdHSZGbsHb:Tc7E0/spL9eHZfmGmEQv5OMaQ0mnoP7
TLSH
T140F2B79BFFCE91250A81C0A26D750953CDFDC272A2255DE5FF54882A22D1A4EC3BD3C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdk.dat

Path C:\Users\Admin\AppData\Local\Temp\pdk.dat
Size 211KB
SHA256 090f6e5e4a23d3ea6d0fc42d377135dfb5babedff9028c1bb254be7c323b7e11
MD5 75997577f7a961cafeba684f61dde343
SHA1 624fb0a6480323ebdebe6021bd53f5c7a394cc27
SHA512 4d7c1405f431ea04d503aad487aac721bfc43c191c4359c4daaf4a4a5c985a40c4ac3295fa09ac342ba4bc981ae19a78d0a75e076cbc0a9fec9a0911387272ce
SSDEEP 3072:Ns2SFNy2gFHADJBehDWPKVj7J31JPUAAAAA+/MbNpdeuZBX/lY8Z+H2vvr/7inxa:C/cgD+APKVjtbNCuZl/l/+Hqr/j
TLSH
T1DE249D213AE5C1F7C29215308EDCABB6B0FA97480F1508C723C49B1D5F76AE6D339A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMSSS.exe

Path C:\Windows\KMS\bin\KMSSS.exe
Size 35KB
SHA256 3506a4a739e12bd87fa706e8c098f238ef8fbd6167d9502d12ef8fccfd1acad7
MD5 fb2db5630b355c54db5133e0da1bd229
SHA1 e8b3ee78f6591d4915eb8aa64691e8b3786491a1
SHA512 5edbde297abe2527c76d29af109f9851d7f327bb31774c365c46a1715bd6609ac52ed5dd325ce6cf1187b46207ebd2cded8a2b874649780107a21e3b9c3fe60c
SSDEEP 384:Ywpny0JWtByh3n95GXNFCLoKnIi2quSTfqcEcXTdof0mhBjpLfh/oCqkg4XZmblC:Yw8ntq3S+8hsnUrekDDqfjGkI1T
TLSH
T16FF217C39AE26AB0F0B242F4445B9F07DA77623006E34655FBDE8091AED1943AF1E5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMSSS.log

Path C:\Windows\KMS\bin\KMSSS.log
Size 773B
SHA256 700b01ed154dca7c48f69bff76ed17c998375b3d41c0621a08d112febd01a51c
MD5 22a897c77364c22cb4bdef9347e86998
SHA1 e6785bc52923add6ea3bbc06239927bc2bf04f6e
SHA512 e7b061f1f5b10f6f30a66f2665ca8b119d3ea294eefaf808a81dbfd5721b01db8f4267ec9a99548de3858286c2659562e70b8300ea4381878ac153d006c44571
TLSH
T1670128015EAFB6554A63C98A00834D43E3A1E0234B5E690132DF60D65BE8B68B3CC508
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1620-72-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1620-78-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1620-83-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1620-31-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1620-98-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1620-28-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1620-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1620-110-0x0000000010000000-0x0000000010030000-memory.dmp

Download