Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 01:59
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe
- Size 4.4MB
- Sample260816-ced55sxelf
- SHA256 0ae5af092bddfe5104d8298c842a08c3132b1e93d5c2f5dcab6feb528a08066f
- MD5 a7cbceb30bec402ebbd0e98dab3a8082
- SHA1 6b179e6c2b797dba7731c9e99d449dea5fae9f10
- SHA512 2e9cbadebbea578060c9628516622d37ad4ad80ee18543ae75f355e38a0082f5782fbc9983750892f9c6bf3d9b6929fd82e05b04448ec1e1c96b89577de2c837
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbJT3S9tsgX8zEC8ULgCSA/Bkj0fqJtb2IT:7fkZcJTIOSA9i
- TLSH T1DB266D16B3F88727E0BA927EC0B1597DE771342B9B32C68F3104AA5D5D677828527323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000200000001b313-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000200000001b313-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\choice.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\setup16.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tar.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wextract.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\instnm.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\win32calc.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\net1.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\reg.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\setx.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\at.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\psr.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.0_none_78ce8a6e35a89ad2\csc.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.26100.1150_none_dda40d17c682c33c\r\EhStorAuthn.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.26100.1150_none_3d0419d754916346\r\wslconfig.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\showmount.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseCE.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.26100.1_none_fdbd1ab52483d881\efsui.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.26100.1150_none_830db7779a4e1286\openfiles.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.26100.1150_none_74a667b087b1ac17\r\PerceptionSimulationService.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\vds.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1150_none_a0f2e25475ab99da\SystemUWPLauncher.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\diskperf.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.26100.1_none_5fe953095cd8da00\xcopy.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browserexport.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1150_none_0d9d250a9ce416ba\r\ExtExport.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_37c9b95250fac754\perfmon.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\r\splwow64.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\tpmvscmgrsvr.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_userexperience-oobe_31bf3856ad364e35_10.0.26100.1591_none_54983d2d7a4908c4\r\OOBE\OobeHostApp.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.26100.1_none_f151d0f42c5c742e\comrepl.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\AppInstallerBackgroundUpdate.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.26100.1591_none_9c7590519bc81879\r\vfpctrl.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.26100.1_none_829a5953e9a4b444\RdpSa.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2177acc33f68854a\r\IMESEARCH.EXE- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_fae82cdc22c5f652\MdmDiagnosticsTool.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\win32calc.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_75b5554a02bcd133\AtBroker.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_080ef735d249ae9a\comp.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\containerworker.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ls-adschemaanalyzer_31bf3856ad364e35_10.0.26100.1_none_d0ec8cfb9f5f4c00\ADSchemaAnalyzer.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_4f25f9e0db03aa60\net.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_10.0.26100.1_none_98735c9942cd7928\AddInProcess.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15912.0_none_1d944b447accc0c6\ngentask.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_71da000f2a392039\r\IMCCPHR.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1_none_1d7ec919ce94ac2f\winrs.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\r\mobsync.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.26100.1591_none_d68a8e522d36701f\r\PinEnrollmentBroker.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-keyscan.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1150_none_e59c5dab3c0f4ed2\Fondue.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.26100.1591_none_6237f51eb608e6f4\r\WSReset.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\SecurityHealthService.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\r\windeploy.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.26100.1150_none_fb8846b4a7c2bad5\r\netsh.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1_none_f288deea5ef6349f\logagent.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.26100.1591_none_3f2e181ddb9e8c83\r\WpcUapApp.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.26100.1591_none_4f9c89c5e078e421\r\plasrv.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.26100.1591_none_9d960bc9bb2901f9\r\rdpclip.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_userexperience-oobe_31bf3856ad364e35_10.0.26100.1591_none_54983d2d7a4908c4\OOBE\OobeHostApp.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_ee7cf88ee4c18aba\r\cscript.exe- 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_a7cbceb30bec402ebbd0e98dab3a8082_amadey_elex_glassworm_hijackloader_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 5.3MB
- SHA256 12c5363b4990b6dc4a7273afe53696a42b5bb4e4c330c64f753fcd9a1a04fe73
- MD5 6d5a6aa75ec40d7a8f7acec63b89f53d
- SHA1 d4ff6e7fd6dadffa61ef083aaac5591534b3e539
- SHA512 240dee9fff7c8fe0121376f90b6979f5c74ca106f98d55af97f050b15eba316da45f36457b14cecbee6084a7553083fb9a430fa6765a285d1e18e2d371aabda2
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbJT3S9tsgX8zEC8ULgCSA/Bkj0fqJtb2Is/ezSC6vUzPv8:7fkZcJTIOSA9TezSC6v2XMH/
- TLSH T1A8464B16B2F88723E0B6D17EC0F26A6DFA71342A9B31C6CF2105A65D1D677828536733
- MD5 SHA1 SHA512 SSDEEP TLSH