GLASSWORM PowerShell Download Cradle

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•9

Identifies execution of the Windows PowerShell cradle used by GLASSWORM's WASM loader. It looks for 'irm' fetching a URL containing the specific '/win32/i/_' path structure, piped to 'iex'.