Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 15:32
Behavioral task
behavioral1
Sample
2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe
- Size 11.1MB
- Sample260415-sy1fgset41
- SHA256 0b79b5af1e4beef76b109fddae8d61900b4a2ece6318535c749710a7ce7690bd
- MD5 6bdfdffa6631af8ae4daeefa43a0efe0
- SHA1 e74e6b0bc2db602e16037fb582770200f744de31
- SHA512 963a775be06137ce80ddf3d6df308d3e1b2b94463f558f006a94819d831dbcd2aa07687a16cd64123d35a05b910a7d92b50701b6d1e3c10e7146ee62437f2fe8
- SSDEEP 98304:L+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWM:KmA0QIG8R6m8yVHOAoXvvO6
- TLSH T1ECC6F519EB4C8C62D47995714C7FCA15A1F07C187B23768BA2C037DFAA7F29259F9220
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cttunesvr.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\printui.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\write.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wscript.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\regedit.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\expand.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\format.com 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mode.com- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\user.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\print.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\curl.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sort.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sort.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sfc.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\at.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe -
resource yara_rule behavioral2/memory/5188-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x0005000000014297-5.dat upx behavioral2/memory/5188-619-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/5188-3182-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.318_none_2da4853532607174\f\AuditShD.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\f\TextInputHost.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_20c655d14680f9cf\f\SearchFilterHost.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.22000.1_none_38378aefc68a365f\autochk.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.22000.282_none_e0bcdfd0611d6514\WindowsSandbox.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.22000.1_none_f318e861ad1b476f\convert.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\chgusr.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\rdpinit.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.469_none_5704c6175ad01b79\f\Microsoft.AAD.BrokerPlugin.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.22000.1_none_049039c25c6cceaa\sxstrace.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\MiniSearchHost.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_c58bc93032642398\f\winrm.cmd- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_890a915053a73623\HOSTNAME.EXE- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.100_none_f82676266a17f522\f\ApplySettingsTemplateCatalog.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.22000.120_none_e2284b7d90c8a180\f\iexplore.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.22000.65_none_64161fe87cb55cea\r\pcaui.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\r\SpatialAudioLicenseSrv.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.282_none_3891f56e17aabe62\lsass.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.22000.65_none_9f7612893c144c09\f\smartscreen.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.22000.1_none_463e74ea2321487a\cttunesvr.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\mode.com- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.22000.1_none_6bfe7242c3d10570\runonce.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.282_none_d171f6f246e51c59\spoolsv.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-locator_31bf3856ad364e35_10.0.22000.1_none_257830d2f16108b0\Locator.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\TiFileFetcher.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.282_none_81f8a77609cf735a\r\MoUsoCoreWorker.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.22000.282_none_aa0f0c4e1a1cb43f\UsoClient.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\TextInputHost.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.22000.1_none_58ed4d9536066242\Utilman.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.22000.1_none_2a76084a7899eecf\Pester.bat- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_9b4fcb543bd21a13\f\Taskmgr.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_c58bc93032642398\f\WSManHTTPConfig.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_c87c050022130145\f\userinit.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.318_none_f32072a930d121b3\r\vmcompute.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\Taskmgr.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.22000.1_none_d7fdc61a4a1da73a\PrintBrm.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.22000.1_none_ff7542ad94a3dbc5\PATHPING.EXE- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.22000.1_none_81e69386fbb62c17\AuthHost.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\r\cmdiag.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.22000.1_none_fddec9b335fe82b5\dxgiadaptercache.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.22000.1_none_2ba66e4a445cef6c\eventcreate.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_dd24c7cd1fc6d4b1\f\PeopleExperienceHost.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_9c5aa041b6a59db2\f\RMActivate.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.22000.1_none_45c23e6afd43f4ce\sysprep.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.22000.282_none_6ae954e75a4dd338\r\winlogon.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.22000.1_none_12ea1a72b4886bec\ssh-add.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.22000.434_none_79ca17dba25cd0c9\curl.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.22000.318_none_4b63ad41811cb76d\f\winload.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.22000.1_none_d6935f7d69086fe5\DiskSnapshot.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.22000.1_none_b903dc9f79e461c1\sethc.exe- 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_6bdfdffa6631af8ae4daeefa43a0efe0_akira_amadey_cloudeye_cobalt-strike_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5188
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.6MB
- SHA256 357f58b0b7f2327f7702733d18e4dc9a1d3c5fb2648334d37aa725f036940ed4
- MD5 c13f7378b1af8e632f6888783453a37f
- SHA1 4caddba02155394714b89292be7033a41a9729ee
- SHA512 1d38ae6d6bdaac201b5f8d4147e8afa7626e8ff68604404fef23529d97e7a5b7875dbf46f5b1d8ae9c1490bfccb78ffbe256838bd08e2fed9b105f2db4636d9d
- SSDEEP 98304:L+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWp:KmA0QIG8R6m8yVHOAoXvvOQoL
- TLSH T10AC60619EB4C8C62D47995754CBFC619A1F07C08772276CBA2C037DFAA7F29259F9220
- MD5 SHA1 SHA512 SSDEEP TLSH