Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 16:22
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe
- Size 3.5MB
- Sample260822-tvalbs1vb1
- SHA256 4422f7c08f255a8eefbb8c5fd48fc88fc234dfaf0bfcd6bdce49217e8a8f60ce
- MD5 3d06c2f7f40a4123d3658bfaffcda1b9
- SHA1 9226c68260998441fd0a73020147fc130560f0ca
- SHA512 594cbc0e6340000d7825335242fdc2d4a4a2593d72addebcecfc3289746d74d9885fd020379af35781336e4cadb8cb906dcbb03f77bc8e40c4017dc2b1e3c9ee
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9WT3S9tsgX8zEC8ULgCSA/Bkj09:7fkZWTIOSAH
- TLSH T1ADF56B1673E84537F0BEA23FC071193D9375793B9B36C68F7500A99E49A6B828527323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000a00000001b89b-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000a00000001b89b-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cipher.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sudo.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\msdt.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\runas.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\setup16.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\logman.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\at.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\doskey.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mmc.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\psr.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tree.com 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tar.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dccw.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.26100.1_none_b9a1cc1fee60a882\mountvol.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.26100.1150_none_f9988b77e1b9cb1d\vmplatformca.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.26100.1_none_f43c30384cd30669\SystemPropertiesAdvanced.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.26100.1150_none_99eb378dda259f30\r\SensorDataService.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.26100.1150_none_f2155cb81beac176\tar.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.1150_none_0b01ddf21fe9a3f6\r\notepad.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.26100.1150_none_5404854ee1749b61\shrpubw.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_e06d5ce38536ffdd\r\colorcpl.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.26100.1_none_e9bc7515e52e45ce\hdwwiz.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\r\pcaui.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.26100.1_none_a9d07790da9b357f\grpconv.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.26100.1150_none_dad1c69b80d09caa\r\CloudExperienceHostBroker.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1150_none_f57fd51c6f680fbc\r\eudcedit.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.26100.1591_none_386f0e150ea90546\PrintIsolationHost.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\sdchange.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.26100.1_none_2e6b5339c0dc1a38\TSWbPrxy.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_4f25f9e0db03aa60\net.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\rpcinfo.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.26100.1150_none_d6b9ea087315f389\sessionmsg.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_b56d38775a1eaac9\r\mmc.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\NETSTAT.EXE- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\ApplyTrustOffline.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1591_none_86770ed0df6bb53c\r\refsutil.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\rdpshell.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\r\EaseOfAccessDialog.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1591_none_6c3d16dfebe198e3\r\SndVol.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_421e63a4855b894f\resmon.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_321363d9581bd94b\r\RuntimeBroker.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\r\Microsoft.AAD.BrokerPlugin.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_29b9b764bd0322b9\r\UserAccountControlSettings.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1150_none_1763b5dd5aadd1af\r\dpnsvr.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.26100.1150_none_db82af066c7c007e\r\bash.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.26100.1_none_2152e7eb342c1e53\TsWpfWrp.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SnapLauncherProtocol.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.26100.1150_none_8b65f13ba864c9e1\r\sysprep.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.26100.1150_none_21762269bb195f5b\r\WindowsUpdateElevatedInstaller.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.0_none_b4e0bc75d19eec35\ngen.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.26100.1150_none_f1b736c7de0a2b05\r\CExecSvc.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\r\adaminstall.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_6c3a7829113ddd25\rasphone.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_a661f954ca482f71\r\Win32WebViewHost.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_49f1b033747ffae2\wab.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\r\Taskmgr.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\WmsUserAgent.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.26100.1150_none_7f2121a6ad7592a8\PackagedCWALauncher.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\r\cmdiag.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1150_none_c316dbd9099e9007\r\findstr.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\WDAGNetDiag.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.26100.1_none_c7e625e41024bd30\wmprph.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\CompMgmtLauncher.exe- 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_3d06c2f7f40a4123d3658bfaffcda1b9_elex_glassworm_hijackloader_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4828
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 4.4MB
- SHA256 b3cfed8042e3865b564e109d64dc3aeb0fc1e32d9a2b6779418cd409a84e09d5
- MD5 0b6b4ad827fc195c870861fd9efbc0b8
- SHA1 4d036826c9299070b133f40a5f3713738ba4d9cd
- SHA512 79d4ba6961805bd065f6975a45818dbd2b8bc9fe85a1c66ae1a457159bf9b522c1f97256e3373c1e522c36c15cb6309e711352418af8ef17fa1caadaeaa671dc
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9WT3S9tsgX8zEC8ULgCSA/Bkj02/ezSC6vUzPvMHjyP:7fkZWTIOSA0ezSC6v2XMHC
- TLSH T1D6266B16B2F84237E0BA927EC0B15A3DE771342B9B32C6CF3505AA5D1D667828536733
- MD5 SHA1 SHA512 SSDEEP TLSH