Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/05/2026, 15:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe
- Size 2.6MB
- Sample260523-tegppsft8y
- SHA256 9c74428e439935908046e17d6bbed20e98e650d2a275cc14396ef1d63b6cc8b3
- MD5 9e010b144b0558bec5c34e61d740517c
- SHA1 65b679c799d1bfaf0b1b01b23950b3c509f8285a
- SHA512 ea03c1912f74754acf27b84dfd16fa30355dab43d8447528b6b3ca60192e3b9d57d74ef7a2109f43a89f8f213c0bc35eafac3aa9c413dbe2a2d78769314611cd
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbqOUopWClKzgpYqb:7fkZcqbDO6k
- TLSH T1C0C54A45B6B48732D0B78175C5F2A649FA3274425B309BCB6289933D2E27BD1CA37336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\expand.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\logagent.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\subst.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\clip.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\doskey.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\charmap.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\at.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\comp.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\choice.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\comp.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\setup16.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\efsui.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\getmac.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\whoami.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\cookie_exporter.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\identity_helper.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.746_none_11e04cec24452336\dwm.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_c5675ea732c2eaa0\r\LockApp.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.19041.906_none_65f82ba919c64b11\InetMgr.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\r\MusNotifyIcon.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\f\MoUsoCoreWorker.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..pdate-oob-component_31bf3856ad364e35_10.0.19041.84_none_e539abe3d27f675f\f\rdvgm.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1151_none_71aa7fdbb41824a0\r\ShellExperienceHost.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1_none_ef1691668a233417\appidtel.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\tracerpt.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1_none_f79dcf01d5a416bd\msra.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\f\BitLockerWizard.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1_none_20dbe0239a0c22b4\vds.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\relog.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\usocoreworker.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_9e094af3987dca57\f\svchost.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.264_none_5b8f61a9b1063622\SpeechModelDownload.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.19041.1_none_8f9e4094cc5ab626\ApplicationFrameHost.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.844_none_c0d0cb934c1c1f17\DTUHandler.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\ssh-add.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.19041.1_none_7da5a59f860f2406\DmNotificationBroker.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\f\AppVClient.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\DeviceEnroller.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2136afef5fadeaa4\f\prevhost.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\r\iisreset.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\user.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.746_none_e540b68b09558f5a\LockScreenContentServer.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_c3054a007d804943\ChsIME.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\r\fontdrvhost.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\SecureAssessmentBrowser.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-makecab_31bf3856ad364e35_10.0.19041.207_none_d949ad80fc4d976e\makecab.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_cdf422107d2779cf\r\cttunesvr.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_dc8146375466099a\DWWIN.EXE- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.19041.1_none_f7adca24b5f66134\EhStorAuthn.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\FsIso.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\r\sdclt.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.84_none_ee550b91ec0a7e82\r\MBR2GPT.EXE- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.1288_none_23aa03725ec9354a\r\wuauclt.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\wmpshare.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.19041.746_none_a5986eca8fd4063b\f\CastSrv.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.19041.746_none_b7a67ddd8bcc7470\f\ApplicationFrameHost.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\WmiApSrv.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_f0e6f722ec2403d4\f\rrinstaller.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\f\ssh.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_10.0.19041.746_none_cc5cbb9556301da3\WMPDMC.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2b8b5a41940eac9f\prevhost.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1266_none_41843efc8f66bc7c\r\uwfmgr.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.19041.1_none_833d086e8f306c45\dfsvc.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.1_none_b0b2b0b01128fbbb\ThumbnailExtractionHost.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\r\AppVClient.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_f15a0c837b51c5fc\gpupdate.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\r\wslconfig.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.19041.1_none_71d70fbd497cca66\Windows.Media.BackgroundPlayback.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.19041.1266_none_23ae8c0349f1b325\UsoClient.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1_none_d1bc032a24676029\newdev.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\diskperf.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_4c95cf26b3aa5907\r\CredentialUIBroker.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\FileExplorer.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.19041.1_none_6037ee587a56d834\dasHost.exe- 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_9e010b144b0558bec5c34e61d740517c_amadey_elex_glassworm_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1804
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 3.1MB
- SHA256 c7dee77d461923aeb27bc73be4677b83b7f4e4c1f6547f7eac628686ae3f5c15
- MD5 20d7eff4045ee3ad797604dfd1adeae0
- SHA1 7f7257da55feeceeb8732bff34bd9d300722b9f1
- SHA512 d6b2656d3921fc8120cc932d504558501b6773e70b0fa6b44c7c065a168e394599d3a2427d5ddc4ad790d4956bca16094bf83e6a4d5ed6bec5e44278826dfb56
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbqOUopWClKzgpYqrPji0Aju:7fkZcqbDO6kjoq
- TLSH T1F3E54A55F6B48732D0B7C175C5E2A649FA3270425B308ACB6289937D2E27BD1CA37336
- MD5 SHA1 SHA512 SSDEEP TLSH