Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 17:32
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 10.1MB
- Sample260803-v4knbsda29
- SHA256 c6f303421b6f653adcdaeb39cee68f88b5aa15b1ca7d49a36400188fcc470b80
- MD5 8c3cc733091b9823d48a878ec2348777
- SHA1 63256835f36fb27872277721ba8f5cb15f6c571f
- SHA512 4809caa092403521e6e7bb43aa9312a8807b7a461c3958f2e4fb89109aa416d941e750cfdb2b22c1686c64e6a82233678adb515be548bbabe51ba440a62b07b8
- SSDEEP 98304:yevoirV0t/iLwHft8vAjTIOSA2RTKUgTHb:BjrOOwH+vgTfCDgTHb
- TLSH T180B6181222D99FACC05FD478CA5668B55A237C8A8F31AFDF1940BE253A756B05F3420F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000a00000001b1c8-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000a00000001b1c8-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\resmon.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cscript.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logman.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wscript.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\label.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tree.com 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\more.com- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sethc.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\choice.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.26100.1_none_d3f029e4b58d022b\iexplore.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.26100.1_none_a2b84bade0a375ce\csc.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\TrustedInstaller.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..agespaces-spaceutil_31bf3856ad364e35_10.0.26100.1591_none_782468f07f32b467\r\spaceutil.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\XblGameSaveTask.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\logman.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.1591_none_f3f0f30e057f293d\r\mstsc.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.26100.1_none_8b784347184cb631\BackgroundTransferHost.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1150_none_abc14f2d153d07e6\r\rasautou.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_4.0.15912.0_none_73fd08cefdd719a5\RegAsm.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_49f1b033747ffae2\wab.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\r\ClipDLS.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\r\hnsdiag.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\r\pcaui.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\find.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\services.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\poqexec.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\qwinsta.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1150_none_bcce913ab8bc643d\r\ldifde.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_10.0.26100.1150_none_39f7d4e8ce48dadd\r\nbtstat.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.26100.1591_none_756d2e37dd0406ef\ApplicationFrameHost.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensors-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_4483428c4f7fb3a1\SensorRuntimeBroker.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\HOSTNAME.EXE- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_10.0.26100.1_none_98735c9942cd7928\AddInProcess.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\IMTCPROP.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.26100.1150_none_20634ae8638b2e34\r\recdisc.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\WerFaultSecure.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\NETSTAT.EXE- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiFileFetcher.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver_31bf3856ad364e35_10.0.26100.1_none_b345269d05057414\winver.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_acf5850f76c86db8\r\WPDShextAutoplay.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.26100.1150_none_e08d5281f8c7a395\OfflineScannerShell.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_comsvcconfig_b03f5f7f11d50a3a_10.0.26100.1_none_8fc81fd68823646b\ComSvcConfig.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_67fcd9ee18eb970e\upnpcont.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\NETSTAT.EXE- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\wuauclt.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_971a4fc44ce4ae24\XGpuEjectDialog.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_70acf1931a9fbc01\r\InputSwitchToastHandler.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.0_none_6650e9df0164e801\aspnet_regbrowsers.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.26100.1150_none_ac162c2f01636f98\netcfg.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.26100.1591_none_467cce9309f588c5\r\osk.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\r\spoolsvworker.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\r\Microsoft.AAD.BrokerPlugin.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_823d5f8eb617914a\userinit.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\wmpconfig.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\nfsadmin.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\r\WmsUserAgent.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmdl32.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVStreamingUX.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1150_none_765afbb4c501d8c8\iscsicli.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\tpmvscmgrsvr.exe- 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_8c3cc733091b9823d48a878ec2348777_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3324
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 11.0MB
- SHA256 fc97a1b6ea2943919bd475b2989f8bc8f03d2b7cf7f03be68936fbf295ea8c5d
- MD5 68e9d2f36ab53bd80dfed77d65441273
- SHA1 4c5f6e0d335b12cb14aa90cc5a8b250a96bec9fb
- SHA512 d7a25f9ec8b2bcc493e690b6dd4701ed9016003f432c669fa97ef0cf96845bf3fafeb920bc8432d8764aa5bc2daca5bbb8785950237bde935be14aaf827d8d0c
- SSDEEP 98304:yevoirV0t/iLwHft8vAjTIOSA2RTKUgTHAezSC6v2XMHU:BjrOOwH+vgTfCDgTHHv
- TLSH T1A7C6281222D98FADC05FD078CA5668B55A237C8A8F319FDF1940BE293E756B05E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH