Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 23:48
Behavioral task
behavioral1
Sample
2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 20.1MB
- Sample260706-3tkvcaaw5k
- SHA256 45282f9c90d5e87774c25ff343812802b40080c8a6a43d0c81aac5147a8fc272
- MD5 f946db20e91f8a1f0460203c7ba983b1
- SHA1 83ab6eadc0da32e0655df7b63c6d9f9ea05dacef
- SHA512 b9c977699b7137c394a2aaffbac1982a1c95c19fb7601000fca2f1c1b923e0853bb31376d807c69f3206c41f8763708176363b700fabfbe42935c68c0949b618
- SSDEEP 393216:ERXMo5UkIbUwF1VERmj2bxTHNBpu1Qfc0/u:ERXMo5UkIY092b9HNBpu1Qfc0/u
- TLSH T19F278D02F2978F9AD15FD034C911957196223F698F738BDF78487D58FA362A36A3420B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x00170000000115ef-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x00170000000115ef-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\autochk.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fc.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dccw.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sudo.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logman.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\finger.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hh.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\runas.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrs.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\net.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netsh.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\relog.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/4384-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x00170000000115ef-5.dat upx behavioral2/memory/4384-281-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4384-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{67FE4B20-14A9-4D58-AD2B-A2631C9F5302}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\NisSrv.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-recover_31bf3856ad364e35_10.0.26100.1_none_8d5ba08151885bf2\recover.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Windows.PrintDialog_cw5n1h2txyewy\PrintDialog.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.26100.1591_none_fdef694f47f84aa8\r\wpr.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_823d5f8eb617914a\userinit.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevTemplateConfigItemGenerator.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1150_none_b5f3ecb264c23d6b\r\mcbuilder.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.26100.1591_none_be5055bdfc720d1e\r\UtcDecoderHost.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.26100.1_none_5ac6e18046b72d8c\where.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.26100.1742_none_32a8c94cc5f2eef2\r\ClipUp.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\UUS\amd64\wuaucltcore.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\ScriptRunner.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_41fcc82854bc2b0c\r\credwiz.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\msiexec.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\scp.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.26100.1_none_c842a966f62dd0c5\FirstLogonAnim.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1150_none_e59c5dab3c0f4ed2\r\Fondue.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regini_31bf3856ad364e35_10.0.26100.1_none_0949e4cf225d7e03\regini.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.26100.1_none_ada7adeacc9ba8d6\aspnet_regbrowsers.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_4.0.15912.0_none_fcd20f3bc43afbcc\AddInProcess32.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.26100.1591_none_80585f5752dd6955\r\EoAExperiences.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_4acfacd4985a9f74\autofstx.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_3f9d05e1401f38e7\wab.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_54e0c846cffbbd55\LaunchTM.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\r\CHXSmartScreen.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_31216c35fec422ae\cmd.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\MRINFO.EXE- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.26100.1_none_6286baeedbc54537\LogonUI.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_bf8393590dcad014\dxdiag.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_90ebc90aafaeeb97\r\pcwrun.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\FESearchHost.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_4deff3472ce5cb34\IMJPSET.EXE- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1150_none_bcce913ab8bc643d\r\ldifde.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-livecaptionsstub_31bf3856ad364e35_10.0.26100.1150_none_09962246afa36462\r\LiveCaptions.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\msinfo32.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.26100.1150_none_2cf483fafd109e7e\TrustedInstaller.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\SearchHost.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\hnsdiag.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.26100.1150_none_c83b3d886b00dded\ieinstal.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_10.0.26100.1150_none_f64f3a9ea7a6b9a1\WMSvc.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.26100.1591_none_2bf6278ffa2525b6\vmconnect.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.26100.1150_none_f9988b77e1b9cb1d\r\vmplatformca.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\r\IMTCPROP.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\rmttpmvscmgrsvr.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1150_none_3d9125d57cc0da9e\WMIC.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.26100.1591_none_087ed6682bae0fd0\r\wifitask.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61e02e661eddd7ec\aspnet_state.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1_none_4bac5ff253646284\fontview.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3\r\CredDialogHost.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1150_none_48fdcfd155028bbe\cipher.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\mofcomp.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_10.0.26100.1_none_7ec569a17c2e80a6\TpmInit.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1150_none_00fe88f91f962b70\gpscript.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\r\HvsiSettingsWorker.exe- 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_f946db20e91f8a1f0460203c7ba983b1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4384
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 21.0MB
- SHA256 3bd5f4d50b69f05b9fca37a6ed9059520d696cf523b0da8d40091718fe9d362a
- MD5 9850f9d62e9fa33b774166db1fc1742a
- SHA1 8f39be17a50b8eef1dc960d63e9e0e01e9456f32
- SHA512 8df9b15a158fcf9dedc483881762c6bd0f3839d6eb63d5e43a3bea4802581c0d8fc516f5415a18da273cd03d5dd85aebad18b8ec151530af743aad0a47aacd70
- SSDEEP 393216:ERXMo5UkIbUwF1VERmj2bxTHNBpu1Qfc0/J:ERXMo5UkIY092b9HNBpu1Qfc0/J
- TLSH T1FA278D02F2978F9AD05FD034C912957196223F598F738BDF7848BD18FA362A35A3461B
- MD5 SHA1 SHA512 SSDEEP TLSH