0e0847c87848f7623ad3680f9266cbc14001d8702202210398ef8db7df935c36

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
Size 4.4MB
Sample261002-qjdxtszset
SHA256 0e0847c87848f7623ad3680f9266cbc14001d8702202210398ef8db7df935c36
MD5 642b7c04ed50a7a7f80687c85e7e8306
SHA1 f1a65ae0e6b411a37115a2f4e925a7b0d88a08d6
SHA512 4e4c5155a2b41f936cfeca53916367d9df49001f08d348ffe2c9e96b6cb2a834cb4ee5ebf830424918b2f5432a28e6962646a2145c3790559da606fddc772e1e
SSDEEP 49152:pxfkunx2VexkuLPLbAvwkWa86/OOsi2yzN4JjLa9OzeQ1uJfuWWNTaSG6EWo1VCM:GXWWdsimvc14O9GHhy
TLSH
T1BD2619117A9FA9EDC199C874834A5A731E21B8CB0B26B9FF41C441353EA9BB41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe

Executes dropped EXE 3 IoCs

pid	Process
3960	Logo1_.exe
2744	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
3468	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
	\??\F:\	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCX7F0.tmp	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\RCX140E.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3FF.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX12C1.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX7BE.tmp	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\RCX2E1.tmp	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
File created	C:\Windows\Logo1_.exe	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4668	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe
3960	Logo1_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 2980	716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe	90
PID 2980 wrote to memory of 5932	2980	net.exe	92
PID 716 wrote to memory of 4668	716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe	93
PID 716 wrote to memory of 3960	716	2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe	95
PID 3960 wrote to memory of 2960	3960	Logo1_.exe	96
PID 2960 wrote to memory of 1036	2960	net.exe	98
PID 4668 wrote to memory of 2744	4668	cmd.exe	99
PID 3960 wrote to memory of 3384	3960	Logo1_.exe	102
PID 3384 wrote to memory of 2124	3384	net.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74E8.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Users\Admin\AppData\Local\Temp\2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe"
    3⤵
    - Executes dropped EXE
    PID:2744
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1036
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2124

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe.Exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.Exe
Size 2.8MB
SHA256 65bd9b0a9ac1894970a4e8d78dd4d3d0b2211efe75bc9a0f30c6c4e62a113599
MD5 a69392f87cb78839f5d3692a62242285
SHA1 23749537401da581e401f214bf6309792be45feb
SHA512 2872d47b4c555e3b136e896226ed9d9eea96a950195a2dd73fd24937579d44f8083f19755746d9ef33852d92e6a6445cdd02bce9244586bcacd068db44d4474e
SSDEEP 49152:MTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJS:MTfiG/nzU90m
TLSH
T106D56F1A52C8D2EBE5A42170CC5DBBF904442DB8AB92CEE7BD447E06B5307D2953393E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX10B3.tmp

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX10B3.tmp
Size 94KB
SHA256 1ca761b29602b35cb3cb947422519a0c016946625767ba70f113e16e613a97a0
MD5 3ad7aea349708aa75f2a33d9fa64d14e
SHA1 bd2d54ba6ae1f0faaad5b298c3b028ce1e46a059
SHA512 059f6ee0202a5384432d52eb1c503b4fd981ba113cae672430e97038efaf46e5704dc59852829d876cd2acc938af82e05baa7c05e55b698f1cf2551b4bf23915
SSDEEP 1536:G7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNYHrnj/5vG4CG0Nb:XCSjGoLpWM6CB/XxAyWH//E3B
TLSH
T17B933959B28CB772D0E155BC8E0FF2E5BD297E301E1D58AFB6991F0EED7A0C10908196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX11A4.tmp

Path C:\Program Files (x86)\Google\Update\RCX11A4.tmp
Size 90KB
SHA256 d6bbcf98977003f9e747000acaa3aa55576ed6f8361583fea66d5a9dc59efc0a
MD5 e79f30e559e5978746797bd337e6c79f
SHA1 589fe3ef8ec37f85cc9f45bc3b9b30a5e6745879
SHA512 a5225ffee71b756fba90e8a5d9f3b7f1c59a383629d8afa5f025eb90f1e87efff7c3308a6d2769ccbaee2b9eacb99b0b6c6c134dc4564a0c4dbb06946f99e311
SSDEEP 1536:G7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNfHrnj/5vG4CGzNr:XCSjGoLpWM6CB/XxAydH//E0R
TLSH
T13E935A69B28CB772D0F159BC9E0DF2E57D297E301E29186FB59E1F0DDA7A1C2090C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1242.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1242.tmp
Size 118KB
SHA256 a11a8a70f4b232fc0e992702df31428053e14951c304a9daad1b22f0e10d047d
MD5 1e08537f5a4fa22e89af4ffd842b34ca
SHA1 e49411d51847680e608d26083ec40b943ae71779
SHA512 b5dab2651c45ea87f635b1cb651832eea10829ee2ebddf6ede4a89997e39360430655222768ee729e87a9518ab60f0a5f58fde7f8ad435e1be4c64249ba21978
SSDEEP 1536:X7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNDHrnj/5vG4CGx4GZjzQwK5WWb:mCSjGoLpWM6CB/XxAy9H//Eqe5BV0kv
TLSH
T189C39D65B2CCB3B6C0E159BC8E0DF2E57D29BE301E29186BB59A1F1DC97B1C2590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe.Exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe
Size 3.5MB
SHA256 4a51b309a894d1ef1dcec90cc66ddcde2155583019e6b1c9400dde05daca493e
MD5 dcddc9720fc9a47570b2dd34a9fe0064
SHA1 4a1eaad199513b896b9570b1c4c9eac9e2ae7824
SHA512 e0b5ebbf00742c1fe354e49a732f7783ecdf46991aed5b81bc3cf95c47a1ac25fb86adfb8250fad79f0106dce44726a60fe9be03460b3eb83cb6d376277bd8f1
SSDEEP 49152:iuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:io/Yhy8OnZy
TLSH
T142F54903A29D22D4D099D074CF4EA222EF627C8907F562EF3690B6D52A77ED47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX2E1.tmp

Path C:\Program Files\7-Zip\RCX2E1.tmp
Size 91KB
SHA256 ef7fb3b5272046beba2a377329c6869d5f5ee2c4b2ba4b681b2eba9e883e437b
MD5 bac17a10b124a4e79bda1ebca01652b6
SHA1 336e7ac601b6335fc5f9cca260eb1251a50f81c8
SHA512 f8a57e62f74417735531ac5c873f4a125758c9c6fcd5d88395df7d422652fa0982a6e6e82019ef11af0dbdd64209a47a0114422c55229baa52648be5ecfbeaf8
SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNgHrnj/5vG4CGQNT:3CSjGoLpWM6CB/XxAyuH//E75
TLSH
T158936B59B28DB772D0F159BC8E0DF2E57D297E301E29186FB59E2F0ED97A1C2090C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX46E.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCX46E.tmp
Size 91KB
SHA256 fad534dd5a73a238b2da29462cf908b449a3e90f1893d7593ccb7512747b9cfa
MD5 5ab7244ad01af808039ce66558978b87
SHA1 1d7c5f4551fd82d5f39d280a0d01ce63274bb90a
SHA512 7f79fd1f2d3c3a5d75c8d257db751acfed866d77afc307e9e48f1a71d3ac45dd54884e4b85aa8787639c434b95deaedb9426e5e26395bb8e26669d8c2a780423
SSDEEP 1536:+7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyN4Hrnj/5vG4CGaND:vCSjGoLpWM6CB/XxAyGH//Ehp
TLSH
T17C934B65B28CB772C0F159BC9E0DF2E57D297E301E29186BB59E3F1D9A7B1C2090C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe.Exe

Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
Size 4.3MB
SHA256 30460c1cb810d6149f240fbfa0ddf10f2628ef73900388f54f3a9a53534e8ffc
MD5 71aa0bcda7bc01d6eed93dfbee872169
SHA1 e67d6079c4af0d97d1a59cc6602cf1adfee84bd1
SHA512 08577a410915fe8c03a335a7f889a27f65c917a3bb4681bd3c757d75546414c0db66c46a33b265614340a5f6f52382942c9a25e9d26115643cb013f5ba240e88
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:ZQvGAdlCEL8c/bRNw5CO
TLSH
T1FC263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX73D.tmp

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX73D.tmp
Size 91KB
SHA256 dc17d9651b754b0d985d8ae560e2ace645f24c483f30505d54bab4231e72b40f
MD5 377ae534ea93f0d376bf45699cb94a68
SHA1 a57be69e9bbd37dbcd85c7a6c6c9825abcf55d5b
SHA512 929c27b08235668e07dcfc23e18d4e76e7fa4a032c88765c4c95f1cfb028c5d2e044390442e720d1efd279126147c0be18c13e4d393991ac0094485619a4c173
SSDEEP 1536:O7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNIHrnj/5vG4CGFND:fCSjGoLpWM6CB/XxAyWH//Emp
TLSH
T1F1935B55B28CB772C0F255BCDE0DF3E57D297E701E2918AB759E2F1E9A7A1C1090C282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7F0.tmp

Path C:\Program Files\Mozilla Firefox\uninstall\RCX7F0.tmp
Size 99KB
SHA256 f19d37bb77b2076b598b6a709095ef229a4ed7bef4f0e57d90cdbb1b6d926861
MD5 779c38fcb6f520f12215f0f1727f620d
SHA1 d42646e440558dd7827dfe6c87c9e62b9ecd3ccd
SHA512 c37ba9761704ccdd62cb3baf238aba49a2c5373f8ebdd11068e8911ec93bf4f4b753d91c8296d6507b10b8222ec1dce4d15077967aaf9d972f627f7e4fe28dd5
SSDEEP 1536:e7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNyTHrnj/5vG4CGeqkSZZZ3LN7:PCSjGoLpWM6CB/XxAyAH//EfULh
TLSH
T19BA36B55B68CB7B2D0F149B89D0DF3E17D29BE301E69186BB29D3F1E9A770C2091C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX832.tmp

Path C:\Program Files\VideoLAN\VLC\RCX832.tmp
Size 92KB
SHA256 6d7ab4b097eda87b80b2ae13f995f2769f8ea2b20898d8d9cb57065d8ade5bc4
MD5 7489503433b51e587c4938c95ba0508d
SHA1 1b36419d45f333869c9a1d0787b62f97e6ba35fe
SHA512 d14e0a8a074b317877412fa9c8278912722905115301c794cf3fe1d77df12680e5f0e5d14882a3d7431dc83b77a4ca7e63ed6192df38a032c7e3354e5f724433
SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNgHrnj/5vG4CGlNb:3CSjGoLpWM6CB/XxAyuH//EeB
TLSH
T15F935B69B28CB772D0ED59BC8E0DF2E57D297E301E29186FB59E1F0D997A0C1090C19E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1A7D.tmp

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX1A7D.tmp
Size 91KB
SHA256 f9a284c41a183a07d6a600d98d28cb39702a8155810cbc8202ad4f29401977b1
MD5 b699cc1ab2340baea32030f14316f758
SHA1 bf3e39f22c560d3a7f1e90d2c485dc7c4c044d49
SHA512 a71ba4df9c7691f6f9269f7fa72d3bcd34f37a9611ee3918d4b6d94306e66ef264c7b6710275184133578d739959ab58ef7a24a6928a0c4201b41c88743c6cd6
SSDEEP 1536:27qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyNOHrnj/5vG4CGSNj:nCSjGoLpWM6CB/XxAyAH//ElJ
TLSH
T156935B65B28CB772D0F195BC8E0DF2E57D297E301E29186BB59E1F1E9E7B0C2490C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a74E8.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a74E8.bat
Size 722B
SHA256 e060fa87f4b0403e31fce3ac049b1355c951439c0755acab15131b0d35cf981b
MD5 636eca00606deaea311d1fda45c985c2
SHA1 885300adee35294bfee319b9ae0ec05ca00fe9ba
SHA512 4bd14cceffaf20feedabe92a3ba731330cca782bc5948b2bcd34eed7e3e7d713720ad232a0cdca5797dca1a710bf622d2e695b13a28c35840fd5dba35cccd498
TLSH
T148019E02A957CDA60A88F143045139CC82312CFE776573094B20E94A5AA9D4EA8E6381
MD5 SHA1 SHA512 TLSH

Submit Download

2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_642b7c04ed50a7a7f80687c85e7e8306_akira_elex_glassworm.exe.exe
Size 4.3MB
SHA256 e27f0eabdaa7f4d26a25818b3be57a2b33cbe3d74f4bfb70d9614ead56bbb3ea
MD5 b7e58baa038ebdd8ccf3551d78acb88e
SHA1 ac4868a424f15e8be1e732cc5390ee81448b4551
SHA512 fff4668f13289246f5e0709e9fa9585e9233f69c14a9f27f3de7ee0eb0c3a0be73822c1c96562980cd4f4381ad0d9003a051a849046d73e35dca5e9b0ed6d999
SSDEEP 49152:5xfkunx2VexkuLPLbAvwkWa86/OOsi2yzN4JjLa9OzeQ1uJfuWWNTaSG6EWo1VCM:WXWWdsimvc14O9GHhy
TLSH
T1BE2608117A9B98EDC199C874834A4A731E21B4DB0B26B9FF41C446353FA9BB42F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 effe104cd56fe963bafdaf00c97e19ff23f2684e27e2a6e435e7f25f333d7eb4
MD5 72abd1608ee19ff6430a984c3818e61a
SHA1 f51dfd7db5e7453c1d3227ba5666d266b2aa92f0
SHA512 d09848a953a38ffbff756796c4a31db083806425644bc10da92beaf3b4482a5d53dd2a1f7d0bfb6003ab5394573491d6e291f79067d942d0dbdd0fb9a37acf96
SSDEEP 1536:97qnkAQtSaoGo5n4iLG0/WM6T4HSaYqey/XxAyN9Hrnj/5vG4CGYN:MCSjGoLpWM6CB/XxAyPH//E/
TLSH
T169935B69B28CB772D0F159BC9E0DF2E57D297E301E29186BB59E1F1DDA7B1C2090C182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/716-12-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3468-19-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3960-22-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3960-1188-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3960-1528-0x0000000000400000-0x000000000042A000-memory.dmp

Download