Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/07/2026, 16:06
Behavioral task
behavioral1
Sample
2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 18.0MB
- Sample260702-tkk93set9p
- SHA256 b4dde65c32c76e3cf4ef610c47c80b029d4a086a28a37cb8419e1435b0822526
- MD5 f3b89ab5226e06ea641f983a0a9f45a2
- SHA1 9415430d151211942f272eaa96f1cc8fa88627c5
- SHA512 4cbe3702c1ed35ed0b339478a4da6de84e0f9f907a6e364ceef3f3c10813571165b5739ab8b6eecd2549654e3965d188a5a8b4a58a71ab89471b0aa72f8c7d98
- SSDEEP 393216:ERXMziJIbUwF1VERmj2byIbUwF1VERmj2b/:ERXMziJIY092byIY092b/
- TLSH T1F6170103F2D40166E06A933E8072493996717C3A5B36C6CFE96CB51E997B7E14A3E313
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x00100000000217bd-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x00100000000217bd-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\write.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\clip.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\doskey.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winver.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\comp.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cipher.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\psr.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\getmac.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winver.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\label.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wextract.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wscript.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral1/memory/1060-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x00100000000217bd-5.dat upx behavioral1/memory/1060-408-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1060-3212-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Mail\wab.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{51A7B87B-57A4-493D-87A7-45DD03C49092}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1266_none_a88c5999d8585853\pcalua.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.19041.1_none_58ba966f5b8ade0b\dpnsvr.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\f\setupugc.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\DeviceCredentialDeployment.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_vmconnect6.2_31bf3856ad364e35_10.0.19041.1_none_5c4aee22bbc45ef1\vmconnect6.2.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.84_none_9d98e005fb7852ca\f\SecurityHealthService.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_680d56683fad152b\f\isoburn.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_8fc08423f52c1606\wmlaunch.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_2649f3f85f3b49b1\wscript.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1_none_db40687413b90853\wmlaunch.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1ab57d24625888e6\WWAHost.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.264_none_9b436d497f039d6d\smartscreen.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.1_none_1776a3602eb73133\netiougc.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.19041.844_none_5308232e9343b869\f\WinBioDataModelOOBE.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc\f\WinMgmt.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.19041.1_none_16a30fa92fe5e343\srdelayed.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\SyncAppvPublishingServer.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_abd26b7610cb738e\f\AddSuggestedFoldersToLibraryDialog.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.19041.1237_none_d618a074f3588a53\r\bcdboot.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.746_none_4028b8f4f6c0b829\r\wpr.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_1d907c422e447b14\r\dsdbutil.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.19041.1_none_911aa822a342ea29\extrac32.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_adf98e02f565c8fe\lodctr.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.746_none_64e9b1de23df7cf4\r\AppHostRegistrationVerifier.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1_none_d6be4622df33d026\edpnotify.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\logman.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\NETSTAT.EXE- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_vmconnect6.3_31bf3856ad364e35_10.0.19041.1_none_5c4ad75abbc47892\vmconnect6.3.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1_none_5d1b02917c107c75\autoconv.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\ARP.EXE- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.19041.1_none_7e31b18ab29f9913\TsWpfWrp.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.19041.1_none_1a96c19044750bbf\BdeUISrv.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.19041.1_none_a99795d4c367fea1\RMActivate_isv.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.264_none_fe5852f864c5941f\wermgr.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.1288_none_e0f8082a6952ce81\r\ntoskrnl.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_b5fe9c5c09b9d7a9\rundll32.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.264_none_7dd490aa65cdf624\r\runexehelper.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_a068a30a6853aaec\ByteCodeGenerator.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.19041.746_none_a39f6d9ab59bd8b7\MpCmdRun.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_e43cebe9807e08e3\f\setupugc.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\r\winload.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.1_none_544850fb795d0a4f\changepk.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\r\ssh-agent.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseIR.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_fb3ba1752084c5cf\f\rrinstaller.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.1_none_c564589414ffc535\mmc.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_309e9e4a939c0bac\wscript.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\r\SpeechModelDownload.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.19041.746_none_18520236ff9eab63\colorcpl.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.84_none_40bd4149a6d52edb\r\AppVClient.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\ShellLauncherConfig.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.19041.1_none_c991318e4b11e4cf\RMActivate_ssp.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\hh.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\r\hvsimgr.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\f\splwow64.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1_none_ed4924afa14354c2\sdchange.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1202_none_a27aa61d221bdc5c\f\wordpad.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_b84e385529c68af9\lodctr.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\Narrator.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.19041.746_none_045e85893c117e35\r\wksprt.exe- 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_f3b89ab5226e06ea641f983a0a9f45a2_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1060
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 18.5MB
- SHA256 d9b02b0d4140d7cb3efd815e2102866d6d5574345868773c449277ee75cc93e3
- MD5 a7dbe5bf39ac2d51b5131ebfbfed62cb
- SHA1 aa6e4e364ca0fecfee105e5f860e929ec600a093
- SHA512 74e5ae1ad9c83be73c14b72f1717d81c8aad406ff933ce3f647136412e6be562395bc51a8c2983e6411253d4b6d14cd81c1dc99088a154a45bbca270e06ab444
- SSDEEP 393216:ERXMziJIbUwF1VERmj2byIbUwF1VERmj2bkz:ERXMziJIY092byIY092bkz
- TLSH T11817F102F2E40166E06A933EC0625539D6717C2A5B31C6CFE96CB51D9D7B7E18A3E323
- MD5 SHA1 SHA512 SSDEEP TLSH