floxif | 30fa07f79653a7e29b3130f7108d1008db2743c81dc7c6379d10527d52005ac3

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
Size 6.9MB
Sample260809-ghv1aa1hjf
SHA256 30fa07f79653a7e29b3130f7108d1008db2743c81dc7c6379d10527d52005ac3
MD5 153b630e264c36ba6f7cebd4ef7489b4
SHA1 c1a623f24afa696cf926fe11833c5260f938818e
SHA512 22bd172da1cbad39f3c3cbe2b297d0ddcba4166894e4b8d5a34d914f3a9590738b9d2091d16d7e57ba3c3c5433554f66c08fb64e04c7ea98eff45cd1ff23c1e0
SSDEEP 98304:IntfPRIkF+zywz1Cbj/DS4DUX+TrdtrZtOSsHF/1Xn:It3RTFDwzOh+w8Hfn
TLSH
T12776F101BBD180B2F5E3553089F957B69A317E044B36C8CB63C83E157E727E19A39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution floxif persistence privilege_escalation trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/files/0x0007000000024354-35.dat	Nirsoft

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x00240000000242e9-1.dat	floxif

UPX dump on OEP (original entry point) 9 IoCs

resource	yara_rule
behavioral1/files/0x00240000000242e9-1.dat	UPX
behavioral1/memory/1680-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1680-28-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1680-29-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1680-72-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1680-77-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1680-85-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1680-93-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1680-109-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Modifies Windows Firewall 2 TTPs 8 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
752	netsh.exe
3392	netsh.exe
2836	netsh.exe
1480	netsh.exe
2444	netsh.exe
4640	netsh.exe
2372	netsh.exe
5032	netsh.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KMSEmulator\ImagePath = "\"C:\\Windows\\KMS\\bin\\KMSSS.exe\" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP쐀"	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KMSEmulator\ImagePath = "\"C:\\Windows\\KMS\\bin\\KMSSS.exe\" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP退"	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00240000000242e9-1.dat	acprotect

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
4632	MSActBackup.exe
4612	pdk.dat
3988	bin.dat
536	pdk.dll
3056	KMSSS.exe

Loads dropped DLL 3 IoCs

pid	Process
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1708	cscript.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00240000000242e9-1.dat	upx
behavioral1/memory/1680-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1680-28-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1680-29-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1680-72-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1680-77-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1680-85-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1680-93-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1680-109-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\KMS\bin\KMSSS.exe	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
File opened for modification	C:\Windows\KMS\bin\KMSSS.log	KMSSS.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4024	sc.exe
1872	sc.exe
2760	sc.exe
1752	sc.exe
3316	sc.exe
2692	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1864	cmd.exe
1580	cmd.exe
4304	cmd.exe
4728	cmd.exe
1448	cmd.exe
216	cmd.exe
4736	cmd.exe
4572	cmd.exe
2744	cmd.exe
1308	cmd.exe
4820	cmd.exe
1828	cmd.exe
2352	cmd.exe
5052	cmd.exe
4160	cmd.exe
2708	cmd.exe
4960	cmd.exe
1440	cmd.exe
2812	cmd.exe
2212	cmd.exe
2188	cmd.exe
4808	cmd.exe
432	cmd.exe
3428	cmd.exe
4660	cmd.exe
396	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdk.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSSS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdk.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.dat

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
Token: SeIncreaseQuotaPrivilege	896	WMIC.exe
Token: SeSecurityPrivilege	896	WMIC.exe
Token: SeTakeOwnershipPrivilege	896	WMIC.exe
Token: SeLoadDriverPrivilege	896	WMIC.exe
Token: SeSystemProfilePrivilege	896	WMIC.exe
Token: SeSystemtimePrivilege	896	WMIC.exe
Token: SeProfSingleProcessPrivilege	896	WMIC.exe
Token: SeIncBasePriorityPrivilege	896	WMIC.exe
Token: SeCreatePagefilePrivilege	896	WMIC.exe
Token: SeBackupPrivilege	896	WMIC.exe
Token: SeRestorePrivilege	896	WMIC.exe
Token: SeShutdownPrivilege	896	WMIC.exe
Token: SeDebugPrivilege	896	WMIC.exe
Token: SeSystemEnvironmentPrivilege	896	WMIC.exe
Token: SeRemoteShutdownPrivilege	896	WMIC.exe
Token: SeUndockPrivilege	896	WMIC.exe
Token: SeManageVolumePrivilege	896	WMIC.exe
Token: 33	896	WMIC.exe
Token: 34	896	WMIC.exe
Token: 35	896	WMIC.exe
Token: 36	896	WMIC.exe
Token: SeIncreaseQuotaPrivilege	896	WMIC.exe
Token: SeSecurityPrivilege	896	WMIC.exe
Token: SeTakeOwnershipPrivilege	896	WMIC.exe
Token: SeLoadDriverPrivilege	896	WMIC.exe
Token: SeSystemProfilePrivilege	896	WMIC.exe
Token: SeSystemtimePrivilege	896	WMIC.exe
Token: SeProfSingleProcessPrivilege	896	WMIC.exe
Token: SeIncBasePriorityPrivilege	896	WMIC.exe
Token: SeCreatePagefilePrivilege	896	WMIC.exe
Token: SeBackupPrivilege	896	WMIC.exe
Token: SeRestorePrivilege	896	WMIC.exe
Token: SeShutdownPrivilege	896	WMIC.exe
Token: SeDebugPrivilege	896	WMIC.exe
Token: SeSystemEnvironmentPrivilege	896	WMIC.exe
Token: SeRemoteShutdownPrivilege	896	WMIC.exe
Token: SeUndockPrivilege	896	WMIC.exe
Token: SeManageVolumePrivilege	896	WMIC.exe
Token: 33	896	WMIC.exe
Token: 34	896	WMIC.exe
Token: 35	896	WMIC.exe
Token: 36	896	WMIC.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1448	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	86
PID 1680 wrote to memory of 2188	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	89
PID 1680 wrote to memory of 4632	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	91
PID 2188 wrote to memory of 1872	2188	cmd.exe	92
PID 1680 wrote to memory of 1864	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	93
PID 1864 wrote to memory of 2760	1864	cmd.exe	95
PID 1680 wrote to memory of 2352	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	96
PID 4632 wrote to memory of 4808	4632	MSActBackup.exe	98
PID 2352 wrote to memory of 752	2352	cmd.exe	100
PID 4808 wrote to memory of 4612	4808	cmd.exe	101
PID 4632 wrote to memory of 1580	4632	MSActBackup.exe	102
PID 1580 wrote to memory of 3988	1580	cmd.exe	104
PID 1680 wrote to memory of 216	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	105
PID 4632 wrote to memory of 4736	4632	MSActBackup.exe	107
PID 216 wrote to memory of 3392	216	cmd.exe	109
PID 4736 wrote to memory of 1708	4736	cmd.exe	110
PID 1680 wrote to memory of 4572	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	111
PID 4572 wrote to memory of 896	4572	cmd.exe	113
PID 1680 wrote to memory of 5052	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	115
PID 5052 wrote to memory of 2836	5052	cmd.exe	118
PID 1680 wrote to memory of 4160	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	119
PID 4160 wrote to memory of 1480	4160	cmd.exe	121
PID 4632 wrote to memory of 4304	4632	MSActBackup.exe	123
PID 4304 wrote to memory of 536	4304	cmd.exe	125
PID 1680 wrote to memory of 2708	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	126
PID 2708 wrote to memory of 2444	2708	cmd.exe	128
PID 1680 wrote to memory of 4960	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	129
PID 4960 wrote to memory of 4640	4960	cmd.exe	131
PID 1680 wrote to memory of 4728	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	132
PID 4728 wrote to memory of 1752	4728	cmd.exe	134
PID 1680 wrote to memory of 1440	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	135
PID 1440 wrote to memory of 3316	1440	cmd.exe	137
PID 1680 wrote to memory of 2744	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	139
PID 2744 wrote to memory of 2372	2744	cmd.exe	141
PID 1680 wrote to memory of 432	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	142
PID 432 wrote to memory of 5032	432	cmd.exe	144
PID 1680 wrote to memory of 1308	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	145
PID 1308 wrote to memory of 2692	1308	cmd.exe	147
PID 1680 wrote to memory of 4820	1680	2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe	148
PID 4820 wrote to memory of 4024	4820	cmd.exe	150
PID 4632 wrote to memory of 3428	4632	MSActBackup.exe	152
PID 3428 wrote to memory of 204	3428	cmd.exe	154
PID 204 wrote to memory of 4180	204	net.exe	155
PID 4632 wrote to memory of 4660	4632	MSActBackup.exe	160
PID 4660 wrote to memory of 1456	4660	cmd.exe	162
PID 1456 wrote to memory of 3868	1456	net.exe	163
PID 4632 wrote to memory of 1828	4632	MSActBackup.exe	172
PID 1828 wrote to memory of 4004	1828	cmd.exe	174
PID 4004 wrote to memory of 3068	4004	net.exe	175
PID 4632 wrote to memory of 396	4632	MSActBackup.exe	176
PID 396 wrote to memory of 4864	396	cmd.exe	178
PID 4864 wrote to memory of 1872	4864	net.exe	179
PID 4632 wrote to memory of 2812	4632	MSActBackup.exe	181
PID 2812 wrote to memory of 5016	2812	cmd.exe	183
PID 5016 wrote to memory of 4140	5016	net.exe	184
PID 4632 wrote to memory of 2212	4632	MSActBackup.exe	186
PID 2212 wrote to memory of 4700	2212	cmd.exe	188
PID 4700 wrote to memory of 4248	4700	net.exe	189

C:\Users\Admin\AppData\Local\Temp\2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_153b630e264c36ba6f7cebd4ef7489b4_amadey_coinminer_elex_floxif_glassworm_wannacry.exe"
1⤵
- Sets service image path in registry
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y
  2⤵
  - Executes a command shell one-liner
  PID:1448
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe stop KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\system32\sc.exe
    sc.exe stop KMSEmulator
    3⤵
    - Launches sc.exe
    PID:1872
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c pdk.dat -y -pkmsauto
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\pdk.dat
      pdk.dat -y -pkmsauto
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4612
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c bin.dat -y -pkmsauto
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\bin.dat
      bin.dat -y -pkmsauto
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3988
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c cscript.exe MSActBackup.vbs //NoLogo
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Windows\system32\cscript.exe
      cscript.exe MSActBackup.vbs //NoLogo
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1708
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c pdk.dll /nosavereg /IEKeys 0 /WindowsKeys 1 /OfficeKeys 1 /sort 3 /ExtractEdition 1 /stext
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\PDK\pdk.dll
      pdk.dll /nosavereg /IEKeys 0 /WindowsKeys 1 /OfficeKeys 1 /sort 3 /ExtractEdition 1 /stext
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:536
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\system32\net.exe
      net stop sppsvc /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:204
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop sppsvc /y
        5⤵
        
        PID:4180
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\system32\net.exe
      net stop sppsvc /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1456
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop sppsvc /y
        5⤵
        
        PID:3868
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\system32\net.exe
      net stop sppsvc /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4004
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop sppsvc /y
        5⤵
        
        PID:3068
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Windows\system32\net.exe
      net stop sppsvc /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4864
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop sppsvc /y
        5⤵
        
        PID:1872
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\system32\net.exe
      net stop sppsvc /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5016
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop sppsvc /y
        5⤵
        
        PID:4140
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c net stop sppsvc /y
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\system32\net.exe
      net stop sppsvc /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4700
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop sppsvc /y
        5⤵
        
        PID:4248
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe delete KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\system32\sc.exe
    sc.exe delete KMSEmulator
    3⤵
    - Launches sc.exe
    PID:2760
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:752
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3392
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\KMS"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\KMS"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:896
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2836
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1480
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2444
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=1688
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4640
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\system32\sc.exe
    sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
    3⤵
    - Launches sc.exe
    PID:1752
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe start KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\sc.exe
    sc.exe start KMSEmulator
    3⤵
    - Launches sc.exe
    PID:3316
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2372
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5032
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\system32\sc.exe
    sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
    3⤵
    - Launches sc.exe
    PID:2692
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe start KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\system32\sc.exe
    sc.exe start KMSEmulator
    3⤵
    - Launches sc.exe
    PID:4024

C:\Windows\KMS\bin\KMSSS.exe
"C:\Windows\KMS\bin\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office.ini

Path C:\Users\Admin\AppData\Local\Temp\Backup\Windows 10 Pro\=== 08.09.2026-06.50.29 ===\office.ini
Size 87B
SHA256 7ca18b6e55b371ccb5c1d2cb0274b1aca6563901310f0b66af1e314a77672c9a
MD5 42be5684a04b8df1aeebaee46d3554f9
SHA1 431d82098f229305c543e5298d24ff022b264da2
SHA512 3f008eaadbbc981d7612e02e4aaf87ffe8380183d6c7f7b758597c9122a6864c101aee9abbef996a82bb89ffb946e2d0fcfeca9ca35f91dffabc4f120f7db7db
TLSH
T1EBB01207B3C36B12100BCB8CC9C00011EC200C1004A38964126F80014E0206733D7000
MD5 SHA1 SHA512 TLSH

Submit Download

windows.ini

Path C:\Users\Admin\AppData\Local\Temp\Backup\Windows 10 Pro\=== 08.09.2026-06.50.29 ===\windows.ini
Size 46B
SHA256 e823d5217694c1b10b2cc200af2522f1b1a2ca61ca24b38b3a7d986345ada12b
MD5 d2668d8c953b09abd74323dfc1599d1f
SHA1 0389cf3ed6830c496a38ee66038658bd53ae10c2
SHA512 96a07f82b82b2144028a5b00354b3d7a624d6cdaa90d1ef4f45e8c158911a30adf25da0963bc316fdf2632c33854a938c0256cca7089b6a07f5cf90ce5a4b24c
MD5 SHA1 SHA512

Submit Download

MSActBackUp.ini

Path C:\Users\Admin\AppData\Local\Temp\MSActBackUp.ini
Size 29B
SHA256 9226c1e7270875fbe1a767271aad96e7447086d2b8dbdfb2bac78432e6173629
MD5 d4e5c484aa6662fa1949c2e6d140e38d
SHA1 8fee8d4743d6e43179f12995a11a26a3cc82bd9f
SHA512 e87b2903cf405810f1f77d11b188708c504a0cccd2617d5a27d2567262392534f1c8c50fe29f186cd53748b9046ba9371b2ab0e049afd648a74a6df731e1d159
MD5 SHA1 SHA512

Submit Download

MSActBackUpPath.ini

Path C:\Users\Admin\AppData\Local\Temp\MSActBackUpPath.ini
Size 36B
SHA256 ad9e97b9f2190ba89ce6f4cc70f1c7b4a45d2603dac2c2cd81d0b30dac2c456f
MD5 1c2349d78149035ec324ef221af89a7f
SHA1 7a5fe3bccf80995db71879d39cebbb30e4758417
SHA512 aadc21c0a490f21d1fbc61c7bc1ec5b58671590e8377bbdf69f94d2b2157c4ef3dbdc84ce31cf82cc74e87ca5b8b44a40699248e118895c042c2a324dd9393c1
MD5 SHA1 SHA512

Submit Download

MSActBackup.exe

Path C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
Size 1.1MB
SHA256 190b51fde585baac00b59f026acf36e501a18db726f850e1dcf192220b946bb0
MD5 bf5cb5abd4e5ba52d2bcc3af6c31db13
SHA1 2ff3d4b8fd1c7e0d40e8c4a3aa30fdd86176644f
SHA512 17f4ed70bdeef84dca517a8d39f1d48afb06bf6084d8ac4d46e780fb217272ad2fcc95b0e2ed094f8f358ce2146e9d7e3dfa902cdc0d6deeea3b802db3170668
SSDEEP 12288:T+S6RCgFDPPKR6UJr8WzA3qzJlwqku8FgIKXNvogIKXNvx+KDGgIKXNvdl:T+TRlFDPe+qzJlw7bCNwCNECNVl
TLSH
T11B45AE107BEAC0F2D5934530CCED6BF666756F088B2298C353C0BF19B9316D1AA36769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSActBackup.exe.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe.tmp
Size 1.2MB
SHA256 f8b057146d13bf30e8597e66c0448eceae1c2eb68daf3c4a79c12a2d2914225e
MD5 f9c591a81d13550a60d469b04645c861
SHA1 61b026b2064d35662596b9918a0d23d0f1e5ac34
SHA512 a32d2ba430f3ec40f54c8cfa0df12a2fd7034340368c823d459f2a7fb5c27436df65aa322097622c75bf4ea010e24fde6e07d710fd791caa59f642d32e2d35b9
SSDEEP 12288:w+SFNCgFDPPKR6UJr8WzA3qzJlwqku8FgIKXNvogIKXNvx+KDGgIKXNvdlKBjvrV:w+QlFDPe+qzJlw7bCNwCNECNVl8rEH7s
TLSH
T11645BE103BE6C1F6D0934130DCED6BF666A16F1C8B2698C393C0BF05B9356D1AA36769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdk.dll

Path C:\Users\Admin\AppData\Local\Temp\PDK\pdk.dll
Size 93KB
SHA256 814320cb353bcbd7f5df3fdb702487b14d1d1784e3af0f78c31496742a5f97c0
MD5 572c3a9213b1716851e7e3c971106b01
SHA1 f19056f326542459fdfe9465862e57c703409733
SHA512 ba39502b605be78aabfe54d695138202c835f834a3a9949ac3acb91ec64fbd89cc1e10becdfe96bfed84bfb71a2ae39dbadf439b4c86cab837190dccaeb9dd57
SSDEEP 1536:Oksz71hIrxMChN8lIDIT0PuuNZAX1b7k/5iECnKKbtNo2G4env4OUbiA/:871hixMCzBD91oX1b7k/U9LTG4env4tX
TLSH
T1F8936B43B7E04431F6E309702AF69B369EF57D715938C90F57545A8A2CB0780EE2A39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bin.dat

Path C:\Users\Admin\AppData\Local\Temp\bin.dat
Size 174KB
SHA256 635f4b5106767cc3b82e4d5fff081a028fbba08d0ff92c96f1163a34eab2086c
MD5 7758b09b145db821d9bfe5d322bf9576
SHA1 e0bc1c38095b72aaeb5ff7dd1622e8501c60f9cb
SHA512 780d479d0583d26e095a3f072396e665440961b65a7087304297d0b755cd990e7e5709cda8320e56d4b9bc6cee6c0abc498e68c546a34d0ea1d637748dd0b339
SSDEEP 3072:Ns2SFNy2gFHADJBehDWPKVj7J31JPUAAAAA+/MbNpdeuZBX/lYOgs:C/cgD+APKVjtbNCuZl/lD
TLSH
T139047C213AE5C1F7D28211308EDCABB6B1EA97480F1509C323D49B1D5F7AAE5D339A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSActBackup.vbs

Path C:\Users\Admin\AppData\Local\Temp\bin\MSActBackup.vbs
Size 34KB
SHA256 41df74896f1ab540efa72675b3fecb974af25abcee7b8bb28669d84811de3aa2
MD5 1474147d65a01143da2e7c4169801a6c
SHA1 85159efc968439e49befb85652029e7a582a3e1c
SHA512 b8d204fd4257d6e52905c0a5be1dd9d1c245c6868380c18a2ef6b12975e06af8c51438e04b516f7f7619cd9efa9d6885a0b9c6bef823767b288ce201296e8add
SSDEEP 384:2Grc7E0/hmpr7kcTcbzQ9eHF6YLSQR1vvY9WWNKe4VmE8vpgMDJRoILdHSZGbsHb:Tc7E0/spL9eHZfmGmEQv5OMaQ0mnoP7
TLSH
T140F2B79BFFCE91250A81C0A26D750953CDFDC272A2255DE5FF54882A22D1A4EC3BD3C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdk.dat

Path C:\Users\Admin\AppData\Local\Temp\pdk.dat
Size 211KB
SHA256 090f6e5e4a23d3ea6d0fc42d377135dfb5babedff9028c1bb254be7c323b7e11
MD5 75997577f7a961cafeba684f61dde343
SHA1 624fb0a6480323ebdebe6021bd53f5c7a394cc27
SHA512 4d7c1405f431ea04d503aad487aac721bfc43c191c4359c4daaf4a4a5c985a40c4ac3295fa09ac342ba4bc981ae19a78d0a75e076cbc0a9fec9a0911387272ce
SSDEEP 3072:Ns2SFNy2gFHADJBehDWPKVj7J31JPUAAAAA+/MbNpdeuZBX/lY8Z+H2vvr/7inxa:C/cgD+APKVjtbNCuZl/l/+Hqr/j
TLSH
T1DE249D213AE5C1F7C29215308EDCABB6B0FA97480F1508C723C49B1D5F76AE6D339A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMSSS.exe

Path C:\Windows\KMS\bin\KMSSS.exe
Size 35KB
SHA256 3506a4a739e12bd87fa706e8c098f238ef8fbd6167d9502d12ef8fccfd1acad7
MD5 fb2db5630b355c54db5133e0da1bd229
SHA1 e8b3ee78f6591d4915eb8aa64691e8b3786491a1
SHA512 5edbde297abe2527c76d29af109f9851d7f327bb31774c365c46a1715bd6609ac52ed5dd325ce6cf1187b46207ebd2cded8a2b874649780107a21e3b9c3fe60c
SSDEEP 384:Ywpny0JWtByh3n95GXNFCLoKnIi2quSTfqcEcXTdof0mhBjpLfh/oCqkg4XZmblC:Yw8ntq3S+8hsnUrekDDqfjGkI1T
TLSH
T16FF217C39AE26AB0F0B242F4445B9F07DA77623006E34655FBDE8091AED1943AF1E5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMSSS.log

Path C:\Windows\KMS\bin\KMSSS.log
Size 78B
SHA256 819a8b325238756dd9bd432e7309e108c94e15620bf1642cab3ef7a07b180439
MD5 c86df090f06cc0a46be57ff45b5bec01
SHA1 49e42c045d8f064176489b6733d2fcad03be3570
SHA512 12fbf0d4dac6b7e933da58b8de3b2685a54b8dde27e7c2f6f97ce7140ac5e07be5969b519d90f25a49f7cf8d8390a7c97c22f3380a9d1e73bcc37f5ea188d512
TLSH
T1C5A00410CD7544111741D54711D74417D15154530445714530CF411D5F1147D15CCD04
MD5 SHA1 SHA512 TLSH

Submit Download

KMSSS.log

Path C:\Windows\KMS\bin\KMSSS.log
Size 773B
SHA256 8f376211c3b8730bdc584b3c9ba92beb7e7c1be6fae7d5f3ad12e97541615955
MD5 3388ae95a604b1db8ad58d17608e6a93
SHA1 7d8f7a996a4d0f41124a5875d2a4914b9e368f2c
SHA512 bda9c21cab89286aa8e286c37d1a9c129426b34cd88546238d425b192909a182d3c94270ad35392e2e99094f68877bf274681a6d2a96b0c43bc44e2aaadfc259
TLSH
T1A80122009E9F76554A63C98A00824D43E3A1E0234B4E690632DF60D61BE8B68B3CC508
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1680-72-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1680-77-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1680-85-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1680-29-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1680-28-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1680-93-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1680-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1680-109-0x0000000010000000-0x0000000010030000-memory.dmp

Download