278991f45ed9fd921ce51d414e98581b9299327b5a884b8133d69545e07a27b1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe
Size 669KB
Sample260824-ehc4cssfpe
SHA256 278991f45ed9fd921ce51d414e98581b9299327b5a884b8133d69545e07a27b1
MD5 9ccadbc5e2082fcd7769b2f27f3e4ccb
SHA1 667fa5218f6db40a7b0068807f1aa0508b3d82ff
SHA512 12356a40b6b96d0a42eaa0cec6f7201abf6c1d26935007b671f268e2d4eae69f3ba3357b3381506314fbc615b0b2fecb310438419ceeeb05f73b153264c7d44b
SSDEEP 12288:X7+soi98fUE5wJVOGfq6fKqTUHT3WK8IjtRXE/pw5VBgB2f+h0xs3sgXOT:X7cfUE5wJkSzTUHT3WK8IjtRX8Yg4C0b
TLSH
T113E49D22F900C032E5D1027A87BB4BB55D2E9921172E94D3BBD0ADE85E705F2BD3971B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3860	Logo1_.exe
2708	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\reports\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Speech\en-GB\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\telemetryrules\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ha-Latn-NG\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_game_assist\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
332	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe
3860	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 332	4188	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe	83
PID 4188 wrote to memory of 3860	4188	2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe	84
PID 3860 wrote to memory of 1924	3860	Logo1_.exe	86
PID 1924 wrote to memory of 452	1924	net.exe	88
PID 332 wrote to memory of 2708	332	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AF.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:332
- - C:\Users\Admin\AppData\Local\Temp\2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2708
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 1b97503920be6acb1cff4e9b39dfc612e819ae6e5eea3a59537d894214935edf
MD5 c75db9a2975af44b314b4e378bb3bebf
SHA1 fe83b8cd23b11e54e4f213ee1eef398e0da807bd
SHA512 bfc60fe549be48448cd3ac620a6d5f50d04e8d27583d63bdd1b38efd8d0ab43382118f6225ac12c3c7a0c77dd7843505c949ba7ac143313544082f896adb410c
SSDEEP 3072:GNftffjmNqYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:GdVfjmNqYCk3ET+Tu3fC0zB+JHv
TLSH
T1EEC39D1335D08472E4B2593109A1EDB18A3EFD620950DE7B33D52B3E0F316D1DE2AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 4e5092f4b8ccbcbb41582e3e320d29f7d54544eeed9b774cd85857a743202968
MD5 0fa097b141e0a1d891a9003024838149
SHA1 07744d03c933b35558f83a3878d615719cecde39
SHA512 2305efa70be293048d18cd996db2a70271e41005ed5de7400d2dfe62d71321644c5c5e1288e92afd32e91af5396a1b4e6da9d9c39483b5c21e27481740b553e3
SSDEEP 12288:X7+7XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:X7o0Le5ji0hmxNrM
TLSH
T1E3C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a9AF.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a9AF.bat
Size 919B
SHA256 6c3763f0948dd26dd4f4b6e9666b1b95b4878b3eba8ac7d02ead51585889318f
MD5 cc5160fd3d51e1becb15e7dc7ebf9df8
SHA1 cf8e19bc0798c59c4b89ee678ac576bb1717f1b2
SHA512 b036811949ac2b24711cb2742abe1882301ec70d4f4cb468c711cbfc4ea54a963962b08eb1698d0ebc75fa8852ac24cf44c36603492fae47da28c9d1ceb02b43
TLSH
T1EE11274181E7CE3F26C9D18B06706CCAD290751A9F8A1356E231CDCF69E2CCB75E3280
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-23_9ccadbc5e2082fcd7769b2f27f3e4ccb_amadey_coinminer_elex_glassworm_smoke-loader_wannacry.exe.exe
Size 643KB
SHA256 c84e4070d426407ceb8bacc59cb075241dde62dd7052b95f730f115281dcbcca
MD5 b529de1fb3c4492b029aa2a236210c6d
SHA1 3b5a708a331042a81976e7f8f6fefa81a4fa795d
SHA512 bb9049d741128d4594150b0a1683eda15cba9a30ebe087fbda014f0c897ffd15a70fec907a364d6b233ec8305d9d79ee14585c74c5bc88c7214a7721a16fda79
SSDEEP 12288:goi98fUE5wJVOGfq6fKqTUHT3WK8IjtRXE/pw5VBgB2f+h0xs3sgXOT:LfUE5wJkSzTUHT3WK8IjtRX8Yg4C0xN3
TLSH
T191E49D22F900C032E5D1027A87BB4BB65D2E9921172E94D3BBD09DE85E705F2BD3971B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 ff8473e9ad4d91b9833df39354443a7ebedb44e0c124d727350f800f5a3565f8
MD5 b7d645e07b6a27a8838afa9d0e40e4d9
SHA1 71e380a1ea280e8231b82c1a7769dfbd4763e769
SHA512 14e0cc13de63e6abe56c1c272e6d505e0688f78426e4e4228eb2cbb3882c0e00bbe6b50972278e9c695e3fb0eaa4a5db0a1e67f36225c93b883022e59a7d57bd
SSDEEP 768:Lf1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:LNfgLdQAQfcfymN
TLSH
T17CC2D06A26C83578D826497CDBE39791833D0E7A045F546726F1BA7F2270B64200FA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-1788976790-1541110888-1636651838-1000\_desktop.ini
Size 9B
SHA256 e07dae18d1c9e3faccd99072147b44802c3ffbcefa92d8d8654aae300bb90ea1
MD5 850eb823eee2ce797df21707e6b85aa0
SHA1 31b4732d09d96a871d0e41c96794a2a56b416220
SHA512 db614e00c73f8d5ca58c5375dccadc0234097d0681533ff1624923a667cfb642098481f9e7bdee9db85c93f658216a7f854cfcce526f2d792eeb9e4a14932546
MD5 SHA1 SHA512

Submit Download

memory/3860-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3860-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3860-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3860-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3860-423-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3860-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3860-5035-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3860-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3860-5538-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4188-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4188-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download