Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 17:01
Behavioral task
behavioral1
Sample
2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 15.0MB
- Sample260802-vjh9rss1hs
- SHA256 ca58a9ec851fc6315963a040559090edea058d0efbf7438d05b57e94579a6cab
- MD5 bdb5a351fc862551d2d876e3fad6a999
- SHA1 e4f8ee81d66179ce0fd20087d6382916f6dde3a4
- SHA512 b9edb3a0a16cdc48d50923229f80fe1ad7149f813a68065f66c8d2c2b1513ef9d391081d5868d99352834fa54675d1156e43e47a27d36677878ba14744ffe9e5
- SSDEEP 196608:ZaHxXMZ6466HtIto0AndMdFeGZF6bUpMBF1p/kjRm4OWi2bg:ERXMoB6YoIIbUwF1VERmj2bg
- TLSH T196F68D95F263786EC34B94348019CE3369203BAC57B34D7BF88CF5B4E92A567351AE21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fontview.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\autofstx.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\calc.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dialer.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\expand.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\user.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\net.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\clip.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sort.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/4400-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000c000000011371-5.dat upx behavioral2/memory/4400-374-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4400-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.26100.1742_none_07d5a4b5643ebc7c\r\ntoskrnl.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.26100.1591_none_d68a8e522d36701f\r\PinEnrollmentBroker.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_10714fc4b84d2612\r\stordiag.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_e1bbfdf0b2054cc5\iscsicli.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-timeout_31bf3856ad364e35_10.0.26100.1_none_93acbf7363320dcd\timeout.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1_none_a8f2281169c44e9b\WMIC.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.26100.1150_none_e9952a81b2d9169d\r\dmclient.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.26100.1150_none_830db7779a4e1286\r\openfiles.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\r\adaminstall.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.26100.1591_none_9c7590519bc81879\vfpctrl.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.26100.1150_none_2e4aac6427dee1fd\ApproveChildRequest.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.26100.1_none_8c35e9ae895560fc\wkspbroker.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.26100.1150_none_ced6ba8820394f22\r\fodhelper.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.26100.1_none_e3264f8001c7dc21\isoburn.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15912.355_none_7944a4ca9ef8c9af\aspnet_regiis.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.26100.1_none_1a35ff092a421b8f\rrinstaller.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_47a47970066d8602\r\msdt.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\tracerpt.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.26100.1150_none_51a2aa17b537a668\r\svchost.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\r\winrs.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1_none_b45ed20d4205ffbb\cipher.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\uwfux.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\IMTCPROP.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.26100.1150_none_7de38ebb78ccb039\r\tcmsetup.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-label_31bf3856ad364e35_10.0.26100.1_none_5e775e7a6735dc2c\label.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1_none_f6992c40f1427a7d\mobsync.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.26100.1_none_543fb8ac1ab3e68b\appidcertstorecheck.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_6b60aaf7ce5c0f38\r\AtBroker.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\r\diskusage.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\SysResetErr.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_55245726ccbb616f\autofstx.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\WerFault.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-resume_31bf3856ad364e35_10.0.26100.1742_none_091721c8d0a92082\winresume.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskraid_31bf3856ad364e35_10.0.26100.1_none_627d4c710086cc28\diskraid.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_470d3c75c9c68669\fixmapi.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\mqtgsvc.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-upprinterinstaller_31bf3856ad364e35_10.0.26100.1150_none_4ef2fca3d76b94b2\UPPrinterInstaller.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.26100.1_none_b0f749e1a65b338a\lpr.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.26100.1591_none_685b4f9deb1e8307\dstokenclean.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\SecurityHealthHost.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.26100.1150_none_d9f89d43802b0109\bootim.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.26100.1591_none_386f0e150ea90546\r\PrintIsolationHost.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.26100.1150_none_17cfd41bb43a934d\r\WmsSelfHealingSvc.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_d6930f2587043445\vbc.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\FESearchHost.exe 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_c8bf902cd831831a\CasPol.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\adaminstall.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.100_none_f29d806b561540f6\ngen.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1150_none_092b86d80d75b9b6\r\cleanmgr.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.26100.1591_none_356e88b34c16567d\MDMAppInstaller.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\r\mqtgsvc.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\r\EaseOfAccessDialog.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmplayer.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15912.355_none_c0f1dba1b374f2b5\aspnet_regiis.exe- 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_bdb5a351fc862551d2d876e3fad6a999_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 16.0MB
- SHA256 da381e25f618a39e0314035e414727f3c5bb0adcc6c1afc05f355e3f511b0349
- MD5 1bdc54b87141bd6c8cd9859876a03ffd
- SHA1 20d230efd19f880bb55dcb9c4f21d3e5a1011ea1
- SHA512 ee3de48318fe2bd019d9b0e61a0ec21728dc28597612513aebb2983dbc617d2f6e1214f8ce47c9c4fbaceaf8803dcd53d3f301c9f84ed0e5110abfd33913e270
- SSDEEP 196608:ZaHxXMZ6466HtIto0AndMdFeGZF6bUpMBF1p/kjRm4OWi2bmN:ERXMoB6YoIIbUwF1VERmj2bC
- TLSH T1C5F68D55F223A86EC34794348019CE33B9203B6D47B34D7BB88CF6B4ED2A5676529E31
- MD5 SHA1 SHA512 SSDEEP TLSH