cc6174aa776a0b1bc29c8a466de095e281cc9a238dee7363196dbbdbb7bb2873

Analysis

max time kernel
146s
max time network
120s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GlassWireSetup.exe
Size

66.0MB
MD5

cbdff02625ef580bf509b60832bf06c3
SHA1

fd3ce416b3d8e4ce1af8b310a89e2ef58d25c263
SHA256

cc6174aa776a0b1bc29c8a466de095e281cc9a238dee7363196dbbdbb7bb2873
SHA512

4c2e645780466e58015e678c3dbd2041cdd39089d50d2afe7c250b5aa813023ff2b23a57cc0fe31986e4fb0f50f374feb5b45315e47da144f74875341a1f3964
SSDEEP

1572864:uHAyCN598RzIxTnHF7d1pXTygI9hbl0rcmjXFcI9BKvBiSVwzfZf4:ugJyoTHz1ByV1Sr3FcIXiALzW

Score

9^/10

discovery evasion persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

GWCtlSrv.exeGlassWire.exeGlassWire.exeGlassWireSetup.exeGWCtlSrv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GWCtlSrv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GlassWire.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GlassWire.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GlassWireSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GWCtlSrv.exe

Drops file in Drivers directory 9 IoCs

Processes:

cmd.exerundll32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Drivers\gwdrv.sys	cmd.exe
File created	C:\Windows\system32\DRIVERS\SET6D73.tmp	rundll32.exe
File opened for modification	C:\Windows\System32\Drivers\gwdrv.inf	cmd.exe
File created	C:\Windows\System32\Drivers\gwdrv.sys	cmd.exe
File created	C:\Windows\System32\Drivers\gwdrv.inf	cmd.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET6D73.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\DRIVERS\gwdrv.sys	rundll32.exe
File created	C:\Windows\System32\Drivers\gwdrv.cat	cmd.exe
File opened for modification	C:\Windows\System32\Drivers\gwdrv.cat	cmd.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

GlassWire.exeGlassWire.exeGWCtlSrv.exeGWCtlSrv.exeGlassWireSetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GlassWire.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GlassWire.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GlassWire.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GWCtlSrv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GWCtlSrv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GWCtlSrv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GlassWire.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GlassWireSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GlassWireSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GWCtlSrv.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

GlassWireSetup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation	GlassWireSetup.exe

Executes dropped EXE 7 IoCs

Processes:

vc_redist.x86.exevc_redist.x86.exeGWInstSt.exeGWCtlSrv.exeGWCtlSrv.exeGlassWire.exeGlassWire.exe

pid process

768 vc_redist.x86.exe
1532 vc_redist.x86.exe
1792 GWInstSt.exe
1176 GWCtlSrv.exe
772 GWCtlSrv.exe
764 GlassWire.exe
1288 GlassWire.exe

pid	process
768	vc_redist.x86.exe
1532	vc_redist.x86.exe
1792	GWInstSt.exe
1176	GWCtlSrv.exe
772	GWCtlSrv.exe
764	GlassWire.exe
1288	GlassWire.exe

Loads dropped DLL 45 IoCs

Processes:

GlassWireSetup.exevc_redist.x86.exevc_redist.x86.exerundll32.exeGWCtlSrv.exeGWCtlSrv.exeGlassWire.exeGlassWire.exe

pid	process
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
768	vc_redist.x86.exe
1532	vc_redist.x86.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1364	rundll32.exe
1364	rundll32.exe
1364	rundll32.exe
1364	rundll32.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1176	GWCtlSrv.exe
1252	GlassWireSetup.exe
772	GWCtlSrv.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
764	GlassWire.exe
764	GlassWire.exe
764	GlassWire.exe
764	GlassWire.exe
764	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
764	GlassWire.exe
764	GlassWire.exe
764	GlassWire.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

GlassWireSetup.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	GlassWireSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\GlassWire = "\"C:\\Program Files (x86)\\GlassWire\\glasswire.exe\" -hide"	GlassWireSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

GWCtlSrv.exeGWCtlSrv.exeGlassWire.exeGlassWire.exeGlassWireSetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GWCtlSrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GWCtlSrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GlassWire.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GlassWire.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GlassWireSetup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

Processes:

GlassWireSetup.exeGWCtlSrv.exeGWCtlSrv.exeGlassWire.exeGlassWire.exe

pid	process
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1252	GlassWireSetup.exe
1176	GWCtlSrv.exe
1176	GWCtlSrv.exe
772	GWCtlSrv.exe
772	GWCtlSrv.exe
1288	GlassWire.exe
764	GlassWire.exe

Drops file in Program Files directory 52 IoCs

Processes:

GlassWireSetup.exe

description	ioc	process
File created	C:\Program Files (x86)\GlassWire\lang\pt_br.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\ASIO-LICENSE_1_0.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\driver\x64\gwdrv.sys	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\GlassWire.exe	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\GWUpgradeMonitor.exe	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\lang\en_us.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\lang\zh_cn.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\SQLITE-COPYING.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\driver\x86\gwdrv.cat	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\driver\x64\gwdrv.cat	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\GWIdlMon.exe	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\lang\en_gb.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\lang\pl_pl.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\lang\ru_ru.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\LZ4-LICENSE.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\PROTOBYUF-LICENSE.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\driver\x86\gwdrv.inf	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\driver\x86\gwdrv.sys	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\GWUnlock.exe	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\Qt5OpenGL.dll	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\lang\de_de.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\RAPIDXML-LICENSE.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\ZLIB-LICENSE.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\platforms\qwindows.dll	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\Qt5Gui.dll	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\Qt5Widgets.dll	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\Qt5WinExtras.dll	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\RECOG-COPYING.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\RLOTTIE-COPYING.MIT.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\driver\x64\gwdrv.inf	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\uninstall.exe	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\imageformats\qico.dll	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\Qt5Core.dll	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\Qt5Svg.dll	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\lang\fr_fr.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\lang\ja_jp.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\CURL-COPYING.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\GEOIP-LICENSE.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\GEOLITE2-COPYRIGHT.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\GWCtlSrv.exe	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\GWEventLog.dll	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\GEOLITE2-LICENSE.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\lang\ko_kr.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\lang\tr_tr.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\lang\zh_tw.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\QT-LICENSE.GPL3-EXCEPT.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\RAPIDJSON-LICENSE.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\iconengines\qsvgicon.dll	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\lang\es_es.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\QT-LICENSE.txt	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\lang\it_it.qm	GlassWireSetup.exe
File created	C:\Program Files (x86)\GlassWire\copyrights\OPENSSL-LICENSE.txt	GlassWireSetup.exe

Drops file in Windows directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\INF\setupapi.app.log rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

runonce.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

GWInstSt.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	GWInstSt.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	GWInstSt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	GWInstSt.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	GWInstSt.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	GWInstSt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	GWInstSt.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	GWInstSt.exe

Runs net.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

GlassWire.exeGlassWire.exe

pid process

1288 GlassWire.exe
764 GlassWire.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

GlassWire.exe

pid process

1288 GlassWire.exe
Suspicious behavior: LoadsDriver 3 IoCs

Processes:

pid process

460
460
460

pid	process
460
460
460

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

rundll32.exewevtutil.exewevtutil.exe

description	pid	process
Token: SeRestorePrivilege	1364	rundll32.exe
Token: SeRestorePrivilege	1364	rundll32.exe
Token: SeRestorePrivilege	1364	rundll32.exe
Token: SeRestorePrivilege	1364	rundll32.exe
Token: SeRestorePrivilege	1364	rundll32.exe
Token: SeRestorePrivilege	1364	rundll32.exe
Token: SeRestorePrivilege	1364	rundll32.exe
Token: SeSecurityPrivilege	1984	wevtutil.exe
Token: SeBackupPrivilege	1984	wevtutil.exe
Token: SeSecurityPrivilege	1352	wevtutil.exe
Token: SeBackupPrivilege	1352	wevtutil.exe

Suspicious use of FindShellTrayWindow 24 IoCs

Processes:

GlassWire.exe

pid	process
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe
1288	GlassWire.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

GlassWire.exe

pid process

1288 GlassWire.exe
1288 GlassWire.exe
1288 GlassWire.exe
1288 GlassWire.exe
1288 GlassWire.exe
1288 GlassWire.exe
1288 GlassWire.exe
1288 GlassWire.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

GlassWire.exeGlassWire.exe

pid process

1288 GlassWire.exe
764 GlassWire.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

GlassWireSetup.exevc_redist.x86.execmd.exerundll32.exerunonce.exenet.exenet.exewevtutil.exe

description	pid	process	target process
PID 1252 wrote to memory of 768	1252	GlassWireSetup.exe	vc_redist.x86.exe
PID 1252 wrote to memory of 768	1252	GlassWireSetup.exe	vc_redist.x86.exe
PID 1252 wrote to memory of 768	1252	GlassWireSetup.exe	vc_redist.x86.exe
PID 1252 wrote to memory of 768	1252	GlassWireSetup.exe	vc_redist.x86.exe
PID 1252 wrote to memory of 768	1252	GlassWireSetup.exe	vc_redist.x86.exe
PID 1252 wrote to memory of 768	1252	GlassWireSetup.exe	vc_redist.x86.exe
PID 1252 wrote to memory of 768	1252	GlassWireSetup.exe	vc_redist.x86.exe
PID 768 wrote to memory of 1532	768	vc_redist.x86.exe	vc_redist.x86.exe
PID 768 wrote to memory of 1532	768	vc_redist.x86.exe	vc_redist.x86.exe
PID 768 wrote to memory of 1532	768	vc_redist.x86.exe	vc_redist.x86.exe
PID 768 wrote to memory of 1532	768	vc_redist.x86.exe	vc_redist.x86.exe
PID 768 wrote to memory of 1532	768	vc_redist.x86.exe	vc_redist.x86.exe
PID 768 wrote to memory of 1532	768	vc_redist.x86.exe	vc_redist.x86.exe
PID 768 wrote to memory of 1532	768	vc_redist.x86.exe	vc_redist.x86.exe
PID 1252 wrote to memory of 1792	1252	GlassWireSetup.exe	GWInstSt.exe
PID 1252 wrote to memory of 1792	1252	GlassWireSetup.exe	GWInstSt.exe
PID 1252 wrote to memory of 1792	1252	GlassWireSetup.exe	GWInstSt.exe
PID 1252 wrote to memory of 1792	1252	GlassWireSetup.exe	GWInstSt.exe
PID 1252 wrote to memory of 1636	1252	GlassWireSetup.exe	cmd.exe
PID 1252 wrote to memory of 1636	1252	GlassWireSetup.exe	cmd.exe
PID 1252 wrote to memory of 1636	1252	GlassWireSetup.exe	cmd.exe
PID 1252 wrote to memory of 1636	1252	GlassWireSetup.exe	cmd.exe
PID 1636 wrote to memory of 1364	1636	cmd.exe	rundll32.exe
PID 1636 wrote to memory of 1364	1636	cmd.exe	rundll32.exe
PID 1636 wrote to memory of 1364	1636	cmd.exe	rundll32.exe
PID 1364 wrote to memory of 668	1364	rundll32.exe	runonce.exe
PID 1364 wrote to memory of 668	1364	rundll32.exe	runonce.exe
PID 1364 wrote to memory of 668	1364	rundll32.exe	runonce.exe
PID 668 wrote to memory of 524	668	runonce.exe	grpconv.exe
PID 668 wrote to memory of 524	668	runonce.exe	grpconv.exe
PID 668 wrote to memory of 524	668	runonce.exe	grpconv.exe
PID 1636 wrote to memory of 840	1636	cmd.exe	net.exe
PID 1636 wrote to memory of 840	1636	cmd.exe	net.exe
PID 1636 wrote to memory of 840	1636	cmd.exe	net.exe
PID 840 wrote to memory of 1044	840	net.exe	net1.exe
PID 840 wrote to memory of 1044	840	net.exe	net1.exe
PID 840 wrote to memory of 1044	840	net.exe	net1.exe
PID 1252 wrote to memory of 1880	1252	GlassWireSetup.exe	net.exe
PID 1252 wrote to memory of 1880	1252	GlassWireSetup.exe	net.exe
PID 1252 wrote to memory of 1880	1252	GlassWireSetup.exe	net.exe
PID 1252 wrote to memory of 1880	1252	GlassWireSetup.exe	net.exe
PID 1880 wrote to memory of 980	1880	net.exe	net1.exe
PID 1880 wrote to memory of 980	1880	net.exe	net1.exe
PID 1880 wrote to memory of 980	1880	net.exe	net1.exe
PID 1252 wrote to memory of 1984	1252	GlassWireSetup.exe	wevtutil.exe
PID 1252 wrote to memory of 1984	1252	GlassWireSetup.exe	wevtutil.exe
PID 1252 wrote to memory of 1984	1252	GlassWireSetup.exe	wevtutil.exe
PID 1252 wrote to memory of 1984	1252	GlassWireSetup.exe	wevtutil.exe
PID 1984 wrote to memory of 1352	1984	wevtutil.exe	wevtutil.exe
PID 1984 wrote to memory of 1352	1984	wevtutil.exe	wevtutil.exe
PID 1984 wrote to memory of 1352	1984	wevtutil.exe	wevtutil.exe
PID 1984 wrote to memory of 1352	1984	wevtutil.exe	wevtutil.exe
PID 1252 wrote to memory of 1176	1252	GlassWireSetup.exe	GWCtlSrv.exe
PID 1252 wrote to memory of 1176	1252	GlassWireSetup.exe	GWCtlSrv.exe
PID 1252 wrote to memory of 1176	1252	GlassWireSetup.exe	GWCtlSrv.exe
PID 1252 wrote to memory of 1176	1252	GlassWireSetup.exe	GWCtlSrv.exe
PID 1252 wrote to memory of 772	1252	GlassWireSetup.exe	GWCtlSrv.exe
PID 1252 wrote to memory of 772	1252	GlassWireSetup.exe	GWCtlSrv.exe
PID 1252 wrote to memory of 772	1252	GlassWireSetup.exe	GWCtlSrv.exe
PID 1252 wrote to memory of 772	1252	GlassWireSetup.exe	GWCtlSrv.exe
PID 1252 wrote to memory of 768	1252	GlassWireSetup.exe	explorer.exe
PID 1252 wrote to memory of 768	1252	GlassWireSetup.exe	explorer.exe
PID 1252 wrote to memory of 768	1252	GlassWireSetup.exe	explorer.exe
PID 1252 wrote to memory of 768	1252	GlassWireSetup.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\GlassWireSetup.exe
"C:\Users\Admin\AppData\Local\Temp\GlassWireSetup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1252

C:\Users\Admin\AppData\Local\Temp\nsd2898.tmp\vc_redist.x86.exe
"C:\Users\Admin\AppData\Local\Temp\nsd2898.tmp\vc_redist.x86.exe" /install /quiet /norestart
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\Temp\{214ABFD3-7EC6-4A91-8F70-B58023411F9D}\.cr\vc_redist.x86.exe
"C:\Windows\Temp\{214ABFD3-7EC6-4A91-8F70-B58023411F9D}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsd2898.tmp\vc_redist.x86.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /install /quiet /norestart
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532

C:\Users\Admin\AppData\Local\Temp\nsd2898.tmp\GWInstSt.exe
"C:\Users\Admin\AppData\Local\Temp\nsd2898.tmp\GWInstSt.exe" "https://www.glasswire.com/stat/install.php?v=2.3.449&build_type=full&os=Seven&platform=x64&update=0&install_id=EFB5103512EFE4699F85AACF962A1DB70E7A43002782D8D1351CB160507F5432" "nsis$$.tmp"
2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1792

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\nsd2898.tmp\GWDrvIns.cmd" -i "C:\Program Files (x86)\GlassWire\driver\x64""
2⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\System32\rundll32.exe
C:\Windows\System32\RunDLL32.Exe syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Windows\System32\Drivers\gwdrv.inf
3⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
4⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
5⤵
PID:524

C:\Windows\System32\net.exe
C:\Windows\System32\net.exe start gwdrv
3⤵
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start gwdrv
4⤵
PID:1044

C:\Windows\system32\net.exe
"C:\Windows\system32\net.exe" start gwdrv
2⤵
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start gwdrv
3⤵
PID:980

C:\Windows\SysWOW64\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" im "C:\Users\Admin\AppData\Local\Temp\nsd2898.tmp\eventlog.man" /rf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /mf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\System32\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" im "C:\Users\Admin\AppData\Local\Temp\nsd2898.tmp\eventlog.man" /rf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /mf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /fromwow64
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
"C:\Program Files (x86)\GlassWire\GWCtlSrv.exe" "-i"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1176

C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
"C:\Program Files (x86)\GlassWire\GWCtlSrv.exe" "-s"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:772

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" "C:\Program Files (x86)\GlassWire\glasswire.exe"
2⤵
PID:768

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:544

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1120

C:\Program Files (x86)\GlassWire\GlassWire.exe
"C:\Program Files (x86)\GlassWire\GlassWire.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:764

C:\Program Files (x86)\GlassWire\GlassWire.exe
"C:\Program Files (x86)\GlassWire\GlassWire.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1288

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
Filesize
6.6MB

MD5
c6d8866bc3d4b3791fb99db7d63343dd

SHA1
6b10e1747662a04267ce55bfaaa21c5181c83b61

SHA256
e5a80698c3ec6cc9421f11b9954b0bf962795f664172b926d5a04f014b2a78cc

SHA512
a4c7796e0e15926bae961b7a6fa617590f344c1d10790b3d1788a73ff53534ba00a16da9e20acdbc39114f4c78f61a52791abd1a5ef58c4c4c65e579ce9b6b76

Download Submit
C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
Filesize
6.6MB

MD5
c6d8866bc3d4b3791fb99db7d63343dd

SHA1
6b10e1747662a04267ce55bfaaa21c5181c83b61

SHA256
e5a80698c3ec6cc9421f11b9954b0bf962795f664172b926d5a04f014b2a78cc

SHA512
a4c7796e0e15926bae961b7a6fa617590f344c1d10790b3d1788a73ff53534ba00a16da9e20acdbc39114f4c78f61a52791abd1a5ef58c4c4c65e579ce9b6b76

Download Submit
C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
Filesize
6.6MB

MD5
c6d8866bc3d4b3791fb99db7d63343dd

SHA1
6b10e1747662a04267ce55bfaaa21c5181c83b61

SHA256
e5a80698c3ec6cc9421f11b9954b0bf962795f664172b926d5a04f014b2a78cc

SHA512
a4c7796e0e15926bae961b7a6fa617590f344c1d10790b3d1788a73ff53534ba00a16da9e20acdbc39114f4c78f61a52791abd1a5ef58c4c4c65e579ce9b6b76

Download Submit
C:\Program Files (x86)\GlassWire\GWEventLog.dll
Filesize
3.7MB

MD5
fab7713ae3022c17d5b585a68c5a7790

SHA1
b818f6f59332e61451ed05ef3549556bd00282ae

SHA256
4ff10a45588805166af7c6c413de3b419bf3ec6ff682bc23fe4157ada1e26cca

SHA512
85097e9cb8926e3fbb4ce2b41d4b108d2f885514e98a07bd0bd7abcd208ff79d29bb7d703149c5cbda630016f9af1b70a1c4ac7fe1d63464bfbdb8ff9a5a2939

Download Submit
C:\Program Files (x86)\GlassWire\GlassWire.exe
Filesize
9.2MB

MD5
c9cda8e511bf9aa37a1d3a62cd319079

SHA1
0d3ba654ad5b05c0c8136b49158b6adf7d5f79ac

SHA256
c4e21bb911e46c50d4843bd93fc4b756bad36041aa82b592f7e37a8d73e38864

SHA512
8c0e8812e6eab18766c4cf52be7344121babd2a05ac16ff9a1f0e36c6f4c88839942c53009033691a85ad1184d41831e599cc83c035c35781104059598322706

Download Submit
C:\Program Files (x86)\GlassWire\GlassWire.exe
Filesize
9.2MB

MD5
c9cda8e511bf9aa37a1d3a62cd319079

SHA1
0d3ba654ad5b05c0c8136b49158b6adf7d5f79ac

SHA256
c4e21bb911e46c50d4843bd93fc4b756bad36041aa82b592f7e37a8d73e38864

SHA512
8c0e8812e6eab18766c4cf52be7344121babd2a05ac16ff9a1f0e36c6f4c88839942c53009033691a85ad1184d41831e599cc83c035c35781104059598322706

Download Submit
C:\Program Files (x86)\GlassWire\GlassWire.exe
Filesize
9.2MB

MD5
c9cda8e511bf9aa37a1d3a62cd319079

SHA1
0d3ba654ad5b05c0c8136b49158b6adf7d5f79ac

SHA256
c4e21bb911e46c50d4843bd93fc4b756bad36041aa82b592f7e37a8d73e38864

SHA512
8c0e8812e6eab18766c4cf52be7344121babd2a05ac16ff9a1f0e36c6f4c88839942c53009033691a85ad1184d41831e599cc83c035c35781104059598322706

Download Submit
C:\Program Files (x86)\GlassWire\Qt5Core.dll
Filesize
5.1MB

MD5
b20a6fb343339a3a2eecaa007e0a9c2f

SHA1
c678c781b86c3561ac49c9a93603ea875b53cc51

SHA256
9fe6e29344c047c37091dc2e20aad8ad57213c05e219e5a4c454f7b81bd5ccbf

SHA512
eb768423f01b8638bddbed492146c4c195ee14a16203822b0a0aafdeb4c3af24b12ae18d3398282e74dbc95aaba6205c6e681d87be6442d4d85c330a52446d2f

Download Submit
C:\Program Files (x86)\GlassWire\Qt5Gui.dll
Filesize
5.6MB

MD5
cacb8f799f55fe611faef0f7caa3df79

SHA1
3c2193a2f91473138bbde2848e49123dc201f973

SHA256
0c47fa154b4ddfb38cfb01eef193c618f64e544d8baa04a340d3a74ace4d5d59

SHA512
7a4ce3bd22b7aa17a834e15ef0fa12006a01bf142f2fbc2a1587ac1f45fbca0a7a3549f86e0263ae24580b69e3d63ecf0da11d1f3cb4ab8fbfea2bff2bdbc191

Download Submit
C:\Program Files (x86)\GlassWire\Qt5Svg.dll
Filesize
259KB

MD5
527717828eb2ab0a18e92655adcaed20

SHA1
b44fa4bc368bd35ef8982fbdebc35989f9c1c502

SHA256
2ed7843fdb9835ed39757cf6076e91b1b5f31f8edd1704cf694b277b6723b436

SHA512
cf99134cf091dbeb85c5379e8b5b8d17f28aad490ff254764778d35162f2ceb15148e697997c5ebb88988b61c6acd9ac5b659bdaa2bf53e5ae7400335c3a01aa

Download Submit
C:\Program Files (x86)\GlassWire\Qt5Widgets.dll
Filesize
4.3MB

MD5
26563c035f8c40b53a9ea653f2ef0457

SHA1
99e044a3406cf6f1baa2ff25d267913d181d1021

SHA256
3689981ce691ce81b4e135454d2b08ff7c2bd00c08edf2751ded2d369d047260

SHA512
871061c4ae818cf4181ea626dc595b75546e3d4597c1dbbddb3f94c3acfe1fa7b0b704daa3aee96aa9b5aa9fff70c12663b9053f292f2c3435eea5412c798c5c

Download Submit
C:\Program Files (x86)\GlassWire\Qt5WinExtras.dll
Filesize
199KB

MD5
8bd1306e6993b0c04cd268117bc0d86a

SHA1
f567c2b9e92dfd61af26dff8d17284be90682fb8

SHA256
b6551327ff429afedb38b408dac35d6116d75f71378916b79daf06e6900ade84

SHA512
6ef762186e9293f025b5b69b9d3aa11f4c9d0f7b41d38a6e6c6dd3553f34ee916ebb280a20f186097918ebbfc02035806327e5d895a964427a872c216ef2ce54

Download Submit
C:\Program Files (x86)\GlassWire\driver\x64\gwdrv.cat
Filesize
8KB

MD5
22c7579bb03241829184d21ef69668ab

SHA1
09e4b25cbd482356679f95085005d0303bab8d90

SHA256
50c22d5b327966ee3288f7781e896e6e38b375006b67a409edbd2712d3db90a7

SHA512
706a3d83b916ae17f602cacf41ad3d691bda68e3d19ac6b66ad6fa6024fdf5a5b989d656c0827b18a0d404ad2b8fdee1c5cc5e6aaf8f89be28232ff74d34ab67

Download Submit
C:\Program Files (x86)\GlassWire\driver\x64\gwdrv.inf
Filesize
3KB

MD5
61f60c794f0b40a68bac6b61a5145311

SHA1
3e04a3bc01bdd4c8a02901e7f3fe1652234f26e3

SHA256
90d0ddb705594ac621d316cb6213f310d99893da5dc3f0fcb1bc26b2ed9affee

SHA512
605660c74864b2cbb309850000290eb42c542a2ff597e48e1a4a26170967d040283ebf184f2b9665c59eafbae9210e529deb2c0c675c28d1afbda26be084f78f

Download Submit
C:\Program Files (x86)\GlassWire\driver\x64\gwdrv.sys
Filesize
32KB

MD5
3cf2c2f026b06d3f6b9a402dd50d5c9b

SHA1
4f451c061bd21941803b995939f1660e5617d080

SHA256
eec63c73d54bc6f9aa53f6a248a041e3a0f1ce39386da6243b42d1c14a322b2b

SHA512
396ad45beb8b55f93b506b4ef268800e39391080f2e5254adc020d7409ab12e4361ec5a1f40c185ba935a3000d909c4c26aca8c0a0cbff0ce3bc51bc8945fe30

Download Submit
C:\Program Files (x86)\GlassWire\platforms\qwindows.dll
Filesize
1.2MB

MD5
a2f5be96ba49a3d377b5fcec56f4aef8

SHA1
47fddd74923b5675fff932c119ffb848170e0f33

SHA256
b0955a055ee627eda2d432d3b823d8dc238f230a88466bb3cc7028cf3653e227

SHA512
836cbb29b8d517a452ba53d29dc4cc99c9db1c7449f0ff7ec50b2badf0fd86ae03ad65595ab58c3d8097334570eb2cf633e32f683e62ba972874bd17342db0d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd2898.tmp\GWDrvIns.cmd
Filesize
1KB

MD5
2c2dbd5ea0edb588cb86c034f9a2655f

SHA1
d5f533b2de9edd9eeb8e2d74f892f37217c96d62

SHA256
37a1cc07dea0aa1367f5ee44aa41c80ad6c6b82069e6c89ffa18c215059dd4c5

SHA512
987fae7be030cdebdf16e41eaf48f0198cf1d25cf3b0eb346c2d2d111b2b166d5693fb903cb0da6c539f28241d653b982d3b882a38069c3345cc545c00ca0d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd2898.tmp\GWInstSt.exe
Filesize
12KB

MD5
235f6357e4e16912fc0f40c70adbf6a8

SHA1
7a7b6fcd7ba0a22105c4f95e238279b329aa7861

SHA256
34661a68b584b83599f089ce571a02a41a62b82a5fddd193211803649f870a39

SHA512
54de9c99e008633049a81f5d40230e7c15bdd99083ab2db43a9b685b38d8abc598c87e05437cb9d67134775f07ad32f3e88db9acf439ffa2884b4d59d28d1010

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd2898.tmp\eventlog.man
Filesize
20KB

MD5
690ff28d524728616f1ada1b5071bf13

SHA1
2fdf5fe9f8d1bf7a40c88aa6728a5735715ac994

SHA256
909d481f3fbfdfbcc18b9c9743f8c9c00d822671013a8bb521d9f3e7e949fc6d

SHA512
dcc1dec2af9b198b1a101c8d47be0f43693090d9cdb3638b9b68825a158eb514156c4aa033c1b7a5b480dc38181741c5379c99a2b661d4cb8906cf68e8451bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd2898.tmp\vc_redist.x86.exe
Filesize
13.1MB

MD5
dd0232ee751164eaad2fe0de7158d77d

SHA1
7391663f07cba7c99f3503929fcd3561f1f6a552

SHA256
4c6c420cf4cbf2c9c9ed476e96580ae92a97b2822c21329a2e49e8439ac5ad30

SHA512
cc82a7a8ead3c036559109d4daee623622edd4b4b5241545efa0e36d906c1af10d4056ad003f8849475f4e1e625eb9f27de7a9e13b28ac7ab88da99d5f926c2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd2898.tmp\vc_redist.x86.exe
Filesize
13.1MB

MD5
dd0232ee751164eaad2fe0de7158d77d

SHA1
7391663f07cba7c99f3503929fcd3561f1f6a552

SHA256
4c6c420cf4cbf2c9c9ed476e96580ae92a97b2822c21329a2e49e8439ac5ad30

SHA512
cc82a7a8ead3c036559109d4daee623622edd4b4b5241545efa0e36d906c1af10d4056ad003f8849475f4e1e625eb9f27de7a9e13b28ac7ab88da99d5f926c2e

Download Submit
C:\Windows\System32\Drivers\gwdrv.inf
Filesize
3KB

MD5
61f60c794f0b40a68bac6b61a5145311

SHA1
3e04a3bc01bdd4c8a02901e7f3fe1652234f26e3

SHA256
90d0ddb705594ac621d316cb6213f310d99893da5dc3f0fcb1bc26b2ed9affee

SHA512
605660c74864b2cbb309850000290eb42c542a2ff597e48e1a4a26170967d040283ebf184f2b9665c59eafbae9210e529deb2c0c675c28d1afbda26be084f78f

Download Submit
C:\Windows\Temp\{214ABFD3-7EC6-4A91-8F70-B58023411F9D}\.cr\vc_redist.x86.exe
Filesize
632KB

MD5
29c7a21bae42889b08137c25aae8e55c

SHA1
d5cd79ca094c60f64ef7d9069e24270cee24b4ea

SHA256
82612a2fa05d62929833052ce76788b98701f0c19dca313923452afec44edec5

SHA512
484ecdda526b95d0fd062a2b24be537dd6c5a5945441de250cbe2419b98041625505fa51202735cb6054db444dc1f4bbf0b0e51588500ab89d54d7addca5e2d6

Download Submit
C:\Windows\Temp\{214ABFD3-7EC6-4A91-8F70-B58023411F9D}\.cr\vc_redist.x86.exe
Filesize
632KB

MD5
29c7a21bae42889b08137c25aae8e55c

SHA1
d5cd79ca094c60f64ef7d9069e24270cee24b4ea

SHA256
82612a2fa05d62929833052ce76788b98701f0c19dca313923452afec44edec5

SHA512
484ecdda526b95d0fd062a2b24be537dd6c5a5945441de250cbe2419b98041625505fa51202735cb6054db444dc1f4bbf0b0e51588500ab89d54d7addca5e2d6

Download Submit
C:\Windows\system32\DRIVERS\gwdrv.sys
Filesize
32KB

MD5
3cf2c2f026b06d3f6b9a402dd50d5c9b

SHA1
4f451c061bd21941803b995939f1660e5617d080

SHA256
eec63c73d54bc6f9aa53f6a248a041e3a0f1ce39386da6243b42d1c14a322b2b

SHA512
396ad45beb8b55f93b506b4ef268800e39391080f2e5254adc020d7409ab12e4361ec5a1f40c185ba935a3000d909c4c26aca8c0a0cbff0ce3bc51bc8945fe30

Download Submit
\Program Files (x86)\GlassWire\GWCtlSrv.exe
Filesize
6.6MB

MD5
c6d8866bc3d4b3791fb99db7d63343dd

SHA1
6b10e1747662a04267ce55bfaaa21c5181c83b61

SHA256
e5a80698c3ec6cc9421f11b9954b0bf962795f664172b926d5a04f014b2a78cc

SHA512
a4c7796e0e15926bae961b7a6fa617590f344c1d10790b3d1788a73ff53534ba00a16da9e20acdbc39114f4c78f61a52791abd1a5ef58c4c4c65e579ce9b6b76

Download Submit
\Program Files (x86)\GlassWire\GWEventLog.dll
Filesize
3.7MB

MD5
fab7713ae3022c17d5b585a68c5a7790

SHA1
b818f6f59332e61451ed05ef3549556bd00282ae

SHA256
4ff10a45588805166af7c6c413de3b419bf3ec6ff682bc23fe4157ada1e26cca

SHA512
85097e9cb8926e3fbb4ce2b41d4b108d2f885514e98a07bd0bd7abcd208ff79d29bb7d703149c5cbda630016f9af1b70a1c4ac7fe1d63464bfbdb8ff9a5a2939

Download Submit
\Program Files (x86)\GlassWire\GWEventLog.dll
Filesize
3.7MB

MD5
fab7713ae3022c17d5b585a68c5a7790

SHA1
b818f6f59332e61451ed05ef3549556bd00282ae

SHA256
4ff10a45588805166af7c6c413de3b419bf3ec6ff682bc23fe4157ada1e26cca

SHA512
85097e9cb8926e3fbb4ce2b41d4b108d2f885514e98a07bd0bd7abcd208ff79d29bb7d703149c5cbda630016f9af1b70a1c4ac7fe1d63464bfbdb8ff9a5a2939

Download Submit
\Program Files (x86)\GlassWire\GlassWire.exe
Filesize
9.2MB

MD5
c9cda8e511bf9aa37a1d3a62cd319079

SHA1
0d3ba654ad5b05c0c8136b49158b6adf7d5f79ac

SHA256
c4e21bb911e46c50d4843bd93fc4b756bad36041aa82b592f7e37a8d73e38864

SHA512
8c0e8812e6eab18766c4cf52be7344121babd2a05ac16ff9a1f0e36c6f4c88839942c53009033691a85ad1184d41831e599cc83c035c35781104059598322706

Download Submit
\Program Files (x86)\GlassWire\GlassWire.exe
Filesize
9.2MB

MD5
c9cda8e511bf9aa37a1d3a62cd319079

SHA1
0d3ba654ad5b05c0c8136b49158b6adf7d5f79ac

SHA256
c4e21bb911e46c50d4843bd93fc4b756bad36041aa82b592f7e37a8d73e38864

SHA512
8c0e8812e6eab18766c4cf52be7344121babd2a05ac16ff9a1f0e36c6f4c88839942c53009033691a85ad1184d41831e599cc83c035c35781104059598322706

Download Submit
\Program Files (x86)\GlassWire\GlassWire.exe
Filesize
9.2MB

MD5
c9cda8e511bf9aa37a1d3a62cd319079

SHA1
0d3ba654ad5b05c0c8136b49158b6adf7d5f79ac

SHA256
c4e21bb911e46c50d4843bd93fc4b756bad36041aa82b592f7e37a8d73e38864

SHA512
8c0e8812e6eab18766c4cf52be7344121babd2a05ac16ff9a1f0e36c6f4c88839942c53009033691a85ad1184d41831e599cc83c035c35781104059598322706

Download Submit
\Program Files (x86)\GlassWire\Qt5Core.dll
Filesize
5.1MB

MD5
b20a6fb343339a3a2eecaa007e0a9c2f

SHA1
c678c781b86c3561ac49c9a93603ea875b53cc51

SHA256
9fe6e29344c047c37091dc2e20aad8ad57213c05e219e5a4c454f7b81bd5ccbf

SHA512
eb768423f01b8638bddbed492146c4c195ee14a16203822b0a0aafdeb4c3af24b12ae18d3398282e74dbc95aaba6205c6e681d87be6442d4d85c330a52446d2f

Download Submit
\Program Files (x86)\GlassWire\Qt5Core.dll
Filesize
5.1MB

MD5
b20a6fb343339a3a2eecaa007e0a9c2f

SHA1
c678c781b86c3561ac49c9a93603ea875b53cc51

SHA256
9fe6e29344c047c37091dc2e20aad8ad57213c05e219e5a4c454f7b81bd5ccbf

SHA512
eb768423f01b8638bddbed492146c4c195ee14a16203822b0a0aafdeb4c3af24b12ae18d3398282e74dbc95aaba6205c6e681d87be6442d4d85c330a52446d2f

Download Submit
\Program Files (x86)\GlassWire\Qt5Gui.dll
Filesize
5.6MB

MD5
cacb8f799f55fe611faef0f7caa3df79

SHA1
3c2193a2f91473138bbde2848e49123dc201f973

SHA256
0c47fa154b4ddfb38cfb01eef193c618f64e544d8baa04a340d3a74ace4d5d59

SHA512
7a4ce3bd22b7aa17a834e15ef0fa12006a01bf142f2fbc2a1587ac1f45fbca0a7a3549f86e0263ae24580b69e3d63ecf0da11d1f3cb4ab8fbfea2bff2bdbc191

Download Submit
\Program Files (x86)\GlassWire\Qt5Gui.dll
Filesize
5.6MB

MD5
cacb8f799f55fe611faef0f7caa3df79

SHA1
3c2193a2f91473138bbde2848e49123dc201f973

SHA256
0c47fa154b4ddfb38cfb01eef193c618f64e544d8baa04a340d3a74ace4d5d59

SHA512
7a4ce3bd22b7aa17a834e15ef0fa12006a01bf142f2fbc2a1587ac1f45fbca0a7a3549f86e0263ae24580b69e3d63ecf0da11d1f3cb4ab8fbfea2bff2bdbc191

Download Submit
\Program Files (x86)\GlassWire\Qt5Svg.dll
Filesize
259KB

MD5
527717828eb2ab0a18e92655adcaed20

SHA1
b44fa4bc368bd35ef8982fbdebc35989f9c1c502

SHA256
2ed7843fdb9835ed39757cf6076e91b1b5f31f8edd1704cf694b277b6723b436

SHA512
cf99134cf091dbeb85c5379e8b5b8d17f28aad490ff254764778d35162f2ceb15148e697997c5ebb88988b61c6acd9ac5b659bdaa2bf53e5ae7400335c3a01aa

Download Submit
\Program Files (x86)\GlassWire\Qt5Svg.dll
Filesize
259KB

MD5
527717828eb2ab0a18e92655adcaed20

SHA1
b44fa4bc368bd35ef8982fbdebc35989f9c1c502

SHA256
2ed7843fdb9835ed39757cf6076e91b1b5f31f8edd1704cf694b277b6723b436

SHA512
cf99134cf091dbeb85c5379e8b5b8d17f28aad490ff254764778d35162f2ceb15148e697997c5ebb88988b61c6acd9ac5b659bdaa2bf53e5ae7400335c3a01aa

Download Submit
\Program Files (x86)\GlassWire\Qt5Widgets.dll
Filesize
4.3MB

MD5
26563c035f8c40b53a9ea653f2ef0457

SHA1
99e044a3406cf6f1baa2ff25d267913d181d1021

SHA256
3689981ce691ce81b4e135454d2b08ff7c2bd00c08edf2751ded2d369d047260

SHA512
871061c4ae818cf4181ea626dc595b75546e3d4597c1dbbddb3f94c3acfe1fa7b0b704daa3aee96aa9b5aa9fff70c12663b9053f292f2c3435eea5412c798c5c

Download Submit
\Program Files (x86)\GlassWire\Qt5Widgets.dll
Filesize
4.3MB

MD5
26563c035f8c40b53a9ea653f2ef0457

SHA1
99e044a3406cf6f1baa2ff25d267913d181d1021

SHA256
3689981ce691ce81b4e135454d2b08ff7c2bd00c08edf2751ded2d369d047260

SHA512
871061c4ae818cf4181ea626dc595b75546e3d4597c1dbbddb3f94c3acfe1fa7b0b704daa3aee96aa9b5aa9fff70c12663b9053f292f2c3435eea5412c798c5c

Download Submit
\Program Files (x86)\GlassWire\Qt5WinExtras.dll
Filesize
199KB

MD5
8bd1306e6993b0c04cd268117bc0d86a

SHA1
f567c2b9e92dfd61af26dff8d17284be90682fb8

SHA256
b6551327ff429afedb38b408dac35d6116d75f71378916b79daf06e6900ade84

SHA512
6ef762186e9293f025b5b69b9d3aa11f4c9d0f7b41d38a6e6c6dd3553f34ee916ebb280a20f186097918ebbfc02035806327e5d895a964427a872c216ef2ce54

Download Submit
\Program Files (x86)\GlassWire\Qt5WinExtras.dll
Filesize
199KB

MD5
8bd1306e6993b0c04cd268117bc0d86a

SHA1
f567c2b9e92dfd61af26dff8d17284be90682fb8

SHA256
b6551327ff429afedb38b408dac35d6116d75f71378916b79daf06e6900ade84

SHA512
6ef762186e9293f025b5b69b9d3aa11f4c9d0f7b41d38a6e6c6dd3553f34ee916ebb280a20f186097918ebbfc02035806327e5d895a964427a872c216ef2ce54

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\GWInstSt.exe
Filesize
12KB

MD5
235f6357e4e16912fc0f40c70adbf6a8

SHA1
7a7b6fcd7ba0a22105c4f95e238279b329aa7861

SHA256
34661a68b584b83599f089ce571a02a41a62b82a5fddd193211803649f870a39

SHA512
54de9c99e008633049a81f5d40230e7c15bdd99083ab2db43a9b685b38d8abc598c87e05437cb9d67134775f07ad32f3e88db9acf439ffa2884b4d59d28d1010

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\GWInstSt.exe
Filesize
12KB

MD5
235f6357e4e16912fc0f40c70adbf6a8

SHA1
7a7b6fcd7ba0a22105c4f95e238279b329aa7861

SHA256
34661a68b584b83599f089ce571a02a41a62b82a5fddd193211803649f870a39

SHA512
54de9c99e008633049a81f5d40230e7c15bdd99083ab2db43a9b685b38d8abc598c87e05437cb9d67134775f07ad32f3e88db9acf439ffa2884b4d59d28d1010

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\StartMenu.dll
Filesize
7KB

MD5
d070f3275df715bf3708beff2c6c307d

SHA1
93d3725801e07303e9727c4369e19fd139e69023

SHA256
42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7

SHA512
fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\System.dll
Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\nsDialogs.dll
Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\nsExec.dll
Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\nsExec.dll
Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\nsExec.dll
Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\nsExec.dll
Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\nsExec.dll
Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\nsihelper.dll
Filesize
4.6MB

MD5
af3014521035887c994e3a4ecaba8993

SHA1
b1d811f1575fd829de79c5f50c6842a003430bb5

SHA256
58af17b511a39a1b6fae3a4d7502e7560fec376ba11005c106d061cb317bdfb4

SHA512
6eb78bc59aff57d78706e92132d1445b734cb22e1de147c0cba77a51af50665607c08f55b9067cd8d33da23f02e568f58393c818848427da62562b325e05f547

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\nsihelper.dll
Filesize
4.6MB

MD5
af3014521035887c994e3a4ecaba8993

SHA1
b1d811f1575fd829de79c5f50c6842a003430bb5

SHA256
58af17b511a39a1b6fae3a4d7502e7560fec376ba11005c106d061cb317bdfb4

SHA512
6eb78bc59aff57d78706e92132d1445b734cb22e1de147c0cba77a51af50665607c08f55b9067cd8d33da23f02e568f58393c818848427da62562b325e05f547

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\nsihelper.dll
Filesize
4.6MB

MD5
af3014521035887c994e3a4ecaba8993

SHA1
b1d811f1575fd829de79c5f50c6842a003430bb5

SHA256
58af17b511a39a1b6fae3a4d7502e7560fec376ba11005c106d061cb317bdfb4

SHA512
6eb78bc59aff57d78706e92132d1445b734cb22e1de147c0cba77a51af50665607c08f55b9067cd8d33da23f02e568f58393c818848427da62562b325e05f547

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\nsihelper.dll
Filesize
4.6MB

MD5
af3014521035887c994e3a4ecaba8993

SHA1
b1d811f1575fd829de79c5f50c6842a003430bb5

SHA256
58af17b511a39a1b6fae3a4d7502e7560fec376ba11005c106d061cb317bdfb4

SHA512
6eb78bc59aff57d78706e92132d1445b734cb22e1de147c0cba77a51af50665607c08f55b9067cd8d33da23f02e568f58393c818848427da62562b325e05f547

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\nsihelper.dll
Filesize
4.6MB

MD5
af3014521035887c994e3a4ecaba8993

SHA1
b1d811f1575fd829de79c5f50c6842a003430bb5

SHA256
58af17b511a39a1b6fae3a4d7502e7560fec376ba11005c106d061cb317bdfb4

SHA512
6eb78bc59aff57d78706e92132d1445b734cb22e1de147c0cba77a51af50665607c08f55b9067cd8d33da23f02e568f58393c818848427da62562b325e05f547

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\nsihelper.dll
Filesize
4.6MB

MD5
af3014521035887c994e3a4ecaba8993

SHA1
b1d811f1575fd829de79c5f50c6842a003430bb5

SHA256
58af17b511a39a1b6fae3a4d7502e7560fec376ba11005c106d061cb317bdfb4

SHA512
6eb78bc59aff57d78706e92132d1445b734cb22e1de147c0cba77a51af50665607c08f55b9067cd8d33da23f02e568f58393c818848427da62562b325e05f547

Download Submit
\Users\Admin\AppData\Local\Temp\nsd2898.tmp\vc_redist.x86.exe
Filesize
13.1MB

MD5
dd0232ee751164eaad2fe0de7158d77d

SHA1
7391663f07cba7c99f3503929fcd3561f1f6a552

SHA256
4c6c420cf4cbf2c9c9ed476e96580ae92a97b2822c21329a2e49e8439ac5ad30

SHA512
cc82a7a8ead3c036559109d4daee623622edd4b4b5241545efa0e36d906c1af10d4056ad003f8849475f4e1e625eb9f27de7a9e13b28ac7ab88da99d5f926c2e

Download Submit
\Windows\System32\drivers\SET6D73.tmp
Filesize
32KB

MD5
3cf2c2f026b06d3f6b9a402dd50d5c9b

SHA1
4f451c061bd21941803b995939f1660e5617d080

SHA256
eec63c73d54bc6f9aa53f6a248a041e3a0f1ce39386da6243b42d1c14a322b2b

SHA512
396ad45beb8b55f93b506b4ef268800e39391080f2e5254adc020d7409ab12e4361ec5a1f40c185ba935a3000d909c4c26aca8c0a0cbff0ce3bc51bc8945fe30

Download Submit
\Windows\System32\drivers\SET6D73.tmp
Filesize
32KB

MD5
3cf2c2f026b06d3f6b9a402dd50d5c9b

SHA1
4f451c061bd21941803b995939f1660e5617d080

SHA256
eec63c73d54bc6f9aa53f6a248a041e3a0f1ce39386da6243b42d1c14a322b2b

SHA512
396ad45beb8b55f93b506b4ef268800e39391080f2e5254adc020d7409ab12e4361ec5a1f40c185ba935a3000d909c4c26aca8c0a0cbff0ce3bc51bc8945fe30

Download Submit
\Windows\System32\drivers\gwdrv.sys
Filesize
32KB

MD5
3cf2c2f026b06d3f6b9a402dd50d5c9b

SHA1
4f451c061bd21941803b995939f1660e5617d080

SHA256
eec63c73d54bc6f9aa53f6a248a041e3a0f1ce39386da6243b42d1c14a322b2b

SHA512
396ad45beb8b55f93b506b4ef268800e39391080f2e5254adc020d7409ab12e4361ec5a1f40c185ba935a3000d909c4c26aca8c0a0cbff0ce3bc51bc8945fe30

Download Submit
\Windows\System32\drivers\gwdrv.sys
Filesize
32KB

MD5
3cf2c2f026b06d3f6b9a402dd50d5c9b

SHA1
4f451c061bd21941803b995939f1660e5617d080

SHA256
eec63c73d54bc6f9aa53f6a248a041e3a0f1ce39386da6243b42d1c14a322b2b

SHA512
396ad45beb8b55f93b506b4ef268800e39391080f2e5254adc020d7409ab12e4361ec5a1f40c185ba935a3000d909c4c26aca8c0a0cbff0ce3bc51bc8945fe30

Download Submit
\Windows\Temp\{214ABFD3-7EC6-4A91-8F70-B58023411F9D}\.cr\vc_redist.x86.exe
Filesize
632KB

MD5
29c7a21bae42889b08137c25aae8e55c

SHA1
d5cd79ca094c60f64ef7d9069e24270cee24b4ea

SHA256
82612a2fa05d62929833052ce76788b98701f0c19dca313923452afec44edec5

SHA512
484ecdda526b95d0fd062a2b24be537dd6c5a5945441de250cbe2419b98041625505fa51202735cb6054db444dc1f4bbf0b0e51588500ab89d54d7addca5e2d6

Download Submit
\Windows\Temp\{3B9D4E2F-990C-4D67-B523-04BFD3A052B1}\.ba\wixstdba.dll
Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/524-152-0x0000000000000000-mapping.dmp

Download
memory/544-67-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download
memory/668-150-0x0000000000000000-mapping.dmp

Download
memory/764-223-0x0000000000000000-mapping.dmp

Download
memory/764-269-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/764-270-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/768-70-0x0000000000000000-mapping.dmp

Download
memory/768-218-0x0000000000000000-mapping.dmp

Download
memory/772-191-0x0000000000000000-mapping.dmp

Download
memory/772-213-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/772-204-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/772-203-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/840-154-0x0000000000000000-mapping.dmp

Download
memory/980-158-0x0000000000000000-mapping.dmp

Download
memory/1044-155-0x0000000000000000-mapping.dmp

Download
memory/1176-189-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/1176-166-0x0000000000000000-mapping.dmp

Download
memory/1176-174-0x0000000071650000-0x0000000072045000-memory.dmp

Filesize
10.0MB

Download
memory/1176-181-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/1176-175-0x0000000071650000-0x0000000072045000-memory.dmp

Filesize
10.0MB

Download
memory/1176-173-0x0000000071650000-0x0000000072045000-memory.dmp

Filesize
10.0MB

Download
memory/1176-172-0x0000000071650000-0x0000000072045000-memory.dmp

Filesize
10.0MB

Download
memory/1176-171-0x0000000071650000-0x0000000072045000-memory.dmp

Filesize
10.0MB

Download
memory/1252-83-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/1252-113-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-116-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-127-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-114-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-128-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-112-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-125-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-126-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-110-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-57-0x00000000739F0000-0x00000000746CD000-memory.dmp

Filesize
12.9MB

Download
memory/1252-58-0x00000000739F0000-0x00000000746CD000-memory.dmp

Filesize
12.9MB

Download
memory/1252-109-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-59-0x00000000739F0000-0x00000000746CD000-memory.dmp

Filesize
12.9MB

Download
memory/1252-60-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/1252-108-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-107-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-118-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-106-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-104-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-105-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/1252-103-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-120-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-99-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-119-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-100-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-122-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/1252-102-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-123-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-130-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-115-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-61-0x00000000739F0000-0x00000000746CD000-memory.dmp

Filesize
12.9MB

Download
memory/1252-124-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-98-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1252-129-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-117-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/1252-97-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-96-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-95-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-94-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-219-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/1252-93-0x0000000071D70000-0x0000000072A4D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-92-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/1252-90-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-89-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-88-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-87-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-86-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-85-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-62-0x00000000739F0000-0x00000000746CD000-memory.dmp

Filesize
12.9MB

Download
memory/1252-84-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-82-0x0000000072A50000-0x000000007372D000-memory.dmp

Filesize
12.9MB

Download
memory/1252-63-0x00000000739F0000-0x00000000746CD000-memory.dmp

Filesize
12.9MB

Download
memory/1252-64-0x00000000739F0000-0x00000000746CD000-memory.dmp

Filesize
12.9MB

Download
memory/1252-65-0x00000000739F0000-0x00000000746CD000-memory.dmp

Filesize
12.9MB

Download
memory/1288-271-0x0000000000290000-0x00000000002A0000-memory.dmp

Filesize
64KB

Download
memory/1288-244-0x0000000077320000-0x00000000774A0000-memory.dmp

Filesize
1.5MB

Download
memory/1288-276-0x0000000001D00000-0x0000000001D0A000-memory.dmp

Filesize
40KB

Download
memory/1288-275-0x0000000001D00000-0x0000000001D0A000-memory.dmp

Filesize
40KB

Download
memory/1288-274-0x0000000000290000-0x00000000002A0000-memory.dmp

Filesize
64KB

Download
memory/1288-273-0x0000000001D00000-0x0000000001D0A000-memory.dmp

Filesize
40KB

Download
memory/1288-272-0x0000000001D00000-0x0000000001D0A000-memory.dmp

Filesize
40KB

Download
memory/1352-161-0x0000000000000000-mapping.dmp

Download
memory/1364-142-0x0000000000000000-mapping.dmp

Download
memory/1532-80-0x0000000073DD1000-0x0000000073DD3000-memory.dmp

Filesize
8KB

Download
memory/1532-75-0x0000000000000000-mapping.dmp

Download
memory/1636-137-0x0000000000000000-mapping.dmp

Download
memory/1792-133-0x0000000000000000-mapping.dmp

Download
memory/1880-157-0x0000000000000000-mapping.dmp

Download
memory/1984-160-0x0000000000000000-mapping.dmp

Download