Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/05/2026, 12:19
Behavioral task
behavioral1
Sample
2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 7.1MB
- Sample260502-phkhjsax2l
- SHA256 84ad63df325cae3904bac0e16961a9caed0ef329941309c4bda0d7c659675ee6
- MD5 fbc62b9fc3c79ef68b0fd006c4bcb15c
- SHA1 45456e165e052abee3cd77562d238fbacc8aee23
- SHA512 2024fe61d31c98c6908f2d4d87353b714f03f1f2bc73388cda345c2b9319ea88394937c759a4cef052fa5a37a1e8fea618fd6c2b9fd9aa25488ffde0ee241876
- SSDEEP 49152:fkYwCOAIR8Z+qJtb2Ir+/PivcpfQvdaKYXf3CUeyjc4t2vLemGa2pcPVx7EhI2As:fFIiZ+P/PvOAjcXvvOOc5AC
- TLSH T16676171B6E9D8760C83FBD748E55C684D130BC008762A59B2DD07F5DEAB36D9393E222
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ddodiag.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\comp.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setup16.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\resmon.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\finger.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wextract.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\makecab.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\more.com 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\print.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\convert.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winver.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/4168-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000900000002ab70-5.dat upx behavioral2/memory/4168-774-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4168-3186-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\7z.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.22000.41_none_ea5a28018e2bb582\wdagtool.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\tsdiscon.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_multimedia-windows-..n-playready-desktop_31bf3856ad364e35_10.0.22000.1_none_8f68fe9bc09029b2\prproc.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_659b5b6317001d2c\f\runas.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_c073b3a01f4d4399\f\RdpSaUacHelper.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.22000.1_none_2837defe14ce56f5\repair-bde.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.22000.1_none_0e752f0b29d37df6\telnet.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\r\SenseNdr.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_72d931253b133480\msinfo32.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.376_none_d180c9ec46d962eb\splwow64.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.469_none_160103e31c4d8d88\r\SystemSettings.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.22000.1_none_dd1f9117595c3dbe\net1.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_0f681b8c9b834caa\r\PinningConfirmationDialog.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.22000.120_none_fbcb84a27b36694e\BioEnrollmentHost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.22000.469_none_4ee2cfd406c59bc7\f\omadmclient.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.22000.1_none_087395c681a80760\IMJPSET.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.22000.282_none_59d63580ebab6c4c\WpcTok.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.22000.1_none_91ac9ca5e0bd52f1\gpresult.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_688486d306b27285\f\msinfo32.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_0483b4854ca89ef9\TiWorker.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.22000.1_none_a4e82f5676e0e198\odbcad32.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.434_none_dff7d1ca03eba43a\f\LsaIso.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\dtdump.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_2a48e0773b83147e\r\appidtel.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_b7671877039e31c8\relog.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\r\sdchange.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_2b1b00237ae1bbca\f\SearchProtocolHost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15806.0_none_fcd274061b4264d8\AddInUtil.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.22000.1_none_1ac0f316366cbbc9\vssadmin.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_a92436e98f43ccd7\tree.com- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.22000.1_none_c5e1ff5406d59ba1\DevicePairingWizard.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.22000.1_none_a3f177b107b8418a\dmclient.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.22000.1_none_7ae3697a4deac0fe\ImagingDevices.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.282_none_81f8a77609cf735a\f\MoUsoCoreWorker.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_da8c01e10676f001\r\sdbinst.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.22000.282_none_f57e785f37294fe2\r\ntprint.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.22000.41_none_705d08ab0a6355da\f\mspaint.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\SyncAppvPublishingServer.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.22000.1_none_c7367df86de3dff1\backgroundTaskHost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.22000.434_none_fc228ebcd84d69db\repadmin.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.22000.1_none_f20a18a4fd0f4d43\LocationNotificationWindows.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.22000.1_none_052acbc0b687a114\SecEdit.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_9ed8cb052ff869e6\f\TokenBrokerCookies.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\r\systemreset.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4385d5a885bc9a36\f\cscript.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.376_none_2a06005b3bb58976\f\appidtel.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.65_none_a2e87bc198c20e5a\wevtutil.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.282_none_04af1ce80d4a389a\f\ie4ushowIE.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-diagnosticsmanaged_31bf3856ad364e35_10.0.22000.1_none_bad5c5435d6a2779\stordiag.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_9ed8cb052ff869e6\TokenBrokerCookies.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.22000.1_none_d9e8af91dd649cea\UserAccountControlSettings.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.22000.65_none_2d03a3ca59967a09\f\WpcMon.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.22000.434_none_4f4ac04322f04123\f\PktMon.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.469_none_40856ba085a100c4\f\BioIso.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.22000.1_none_fddec9b335fe82b5\dxgiadaptercache.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_a6b2722d9eed2eed\fixmapi.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4168
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.6MB
- SHA256 eb5e8dbf5a858d0431d7da1c3826c818b37098be00c1157bf053a48ff54f4c48
- MD5 10271be7b3f1782c2bd6059eb544d42a
- SHA1 ddbfca18b58a7fe3c63261b09a4b182fa799daed
- SHA512 151637b9595ab94c05dd69cd7510a12c7cddcf0ec7849da3e3419a377f430314e9e870f4ad912bcb848f3e2d1b9e7fe2863f6e6f9678364aa457ac50c6a533d7
- SSDEEP 49152:fkYwCOAIR8Z+qJtb2Ir+/PivcpfQvdaKYXf3CUeyjc4t2vLemGa2pcPVx7EhI2AE:fFIiZ+P/PvOAjcXvvOOc5Aujo+
- TLSH T14986171B6E9C8761C43FBD748E55C685E1307C008761A98B2DC0BF5DEA736DA793E222
- MD5 SHA1 SHA512 SSDEEP TLSH