Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
07/05/2026, 03:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe
- Size 4.1MB
- Sample260507-eht2waax8q
- SHA256 52ea793e5dccf72b6d39f249651e010fe14cf80aa8b26f94dc3397040155511b
- MD5 8072ca91bc37da2f7cdfecfc4eb47295
- SHA1 21e0e592f655f747e42d8c540500b25fee050bfd
- SHA512 e4ee5957733a9e72533eaac07bbdb0e4df677ae7acc2e3e473cb62c01b5043688e2b9f1861d11d57160a47dea312253164c28cdcb802ee49feb907999fbf0aff
- SSDEEP 49152:BmrU3KhecEu5tzuM0S2S5mLFEuVebedv9uNBb8AftK9qrO1LS9RhSq15vTNuHv/l:BmxEuCFk/fUqrOiOc5e
- TLSH T170166C2E739881E9D266D5BD8A42C506E371F801CB3156DF22A4475E2FB7BE34E3A350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe - Executes dropped EXE 1 IoCs
pid Process 4284 wkw4D2.tmp - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Database Administration = "C:\\Windows\\system32\\systemDA.exe" 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\lzsys.sys 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Windows\SysWOW64\lesys.sys 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Windows\SysWOW64\ReadMe.2.txt 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Windows\SysWOW64\systemDA.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Windows\SysWOW64\nCalc.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\th̨vj–€†~ª€†8ãdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\cascade\WinAmp 5.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\equation\Playboy centerfold.jpeg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\windowsapps\microsoft.zunemusic_10.21012.10511.0_x64__8wekyb3d8bbwe\assets\contrast-white\Anal Pleasure 3.dvd.mpg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\windowsapps\microsoft.zunemusic_10.21012.10511.0_x64__8wekyb3d8bbwe\images\Internet Explorer 7.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\common files\microsoft shared\ink\ro-ro\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\office setup controller\office.en-us\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\vba\vba7.1\Windows XP SP3 leaked.pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\windowsapps\microsoft.zunemusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\assets\Anal Pleasure 3.dvd.mpg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\common files\microsoft shared\ink\da-dk\Jenna Jameson screensaver HOT XXX.scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\common files\microsoft shared\ink\hr-hr\Windows XP SP3 leaked.pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\common files\microsoft shared\ink\zh-cn\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\eclipse\Anal Pleasure 3.dvd.mpg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\common files\microsoft shared\ink\eu-es\Anal Pleasure 3.dvd.mpg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\WinAmp 5.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\eclipse\Windows XP SP3 leaked.pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\pl\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\it\Anal Pleasure 3.dvd.mpg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\platformcapabilities\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\1033\Visual Basic.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\windowsapps\microsoft.zunemusic_10.21012.10511.0_x64__8wekyb3d8bbwe\assets\contrast-black\Playboy centerfold.jpeg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\Jenna Jameson screensaver HOT XXX.scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\cs\Anal Pleasure 3.dvd.mpg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\th̨vj–€†~ª€†8ãdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\sonora\WinAmp 5.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\web server extensions\16\bin\WinAmp 5.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\tr-tr\Windows XP SP3 leaked.pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\common files\microsoft shared\ink\pl-pl\Anal Pleasure 3.dvd.mpg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\es\Jenna Jameson screensaver HOT XXX.scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\windows sidebar\shared gadgets\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\root\Windows XP SP3 leaked.pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\th̨vj–€†~ª€†8ãdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\evrgreen\WinAmp 5.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\vba\vba7.1\Jenna Jameson screensaver HOT XXX.scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilesx86\microsoft sql server\130\shared\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\windowsapps\microsoft.zunemusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\Jenna Jameson screensaver HOT XXX.scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\zh-hant\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\css\Windows XP SP3 leaked.pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\common files\microsoft shared\ink\ca-es\Jenna Jameson screensaver HOT XXX.scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\common files\microsoft shared\ink\sv-se\Anal Pleasure 3.dvd.mpg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\canyon\Windows XP SP3 leaked.pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\satin\Windows XP SP3 leaked.pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\common files\microsoft shared\ink\sl-si\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\WinAmp 5.rar ̨vºŸ€†Ž“€†èêdc:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\WinAmp 5.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\windowsapps\deletedalluserpackages\microsoft.zunemusic_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\Jenna Jameson screensaver HOT XXX.scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\it\How to make crystal meth.doc .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\zh-hant\Anal Pleasure 3.dvd.mpg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\pl\Windows XP SP3 leaked.pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\strtedge\Anal Pleasure 3.dvd.mpg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Detroit.zip 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe - Program crash 1 IoCs
pid pid_target Process procid_target 6064 4196 WerFault.exe 78 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe - NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\blueprnt\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ª€†ðádc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\WinRAR 4 BETA.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\kc:\program files\windowsapps\deletedalluserpackages\microsoft.zunemusic_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\contrast-black\Internet Explorer 7.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\ar-ae\Visual Basic.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\Âœ€†0ìdc:\program files\common files\microsoft shared\ink\de-de\WinRAR 4 BETA.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\Âœ€†0ìdc:\program files\common files\microsoft shared\ink\he-il\WinRAR 4 BETA.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\languagemodel\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\dw\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\images\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\office16\office setup controller\DVD Xcopy PRO crack.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\*¨«vIc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\pt-br\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\*¨«vFc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\ru\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\*¨«v<c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\*¨«vFc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\fr\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\sky\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\portal\1033\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\X×dc:\program files\microsoft office\root\vfs\programfilesx86\microsoft sql server\130\shared\Kazaa Lite 2005 Edition.zip .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\*¨«v9c:\program files\common files\microsoft shared\ink\id-id\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ have an orgy.rar .scrc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\equation\HalfLife 2 crack.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\quationc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\equation\HalfLife 2 crack.exe\Windows XP activation crack.zip .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\èc:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\css\Weed growing for dummies.ebook.pdf .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\Âœ€†0ìdc:\program files\common files\microsoft shared\ink\uk-ua\WinRAR 4 BETA.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\*¨«v5c:\program files\dotnet\shared\microsoft.netcore.app\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\euro\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\sc:\program files\common files\microsoft shared\ink\en-gb\WinAmp 5.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\`ædc:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Windows XP SP3 leaked.pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\id-id\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\tr-tr\WinAmp 5.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\compass\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\layers\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\windowsapps\microsoft.zunemusic_2019.21012.10511.0_neutral_~_8wekyb3d8bbwe\appxmetadata\Anal Pleasure 3.dvd.mpg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\ca-es\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Hot young babes have an orgy.rar .scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\*¨«vbc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\arctic\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\th̨vj–€†~ª€†8ãdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\deepblue\WinAmp 5.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\office16\1033\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\*¨«vc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\es\WinAmp 5.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\de\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\*¨«vtc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\datamodel\resources\1033\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ontrast-white\Anal Pleasure 3.dvd.mpg .pifc:\program files\windowsapps\microsoft.zunemusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\assets\Internet Explorer 7.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\en-ae\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\B €†°×dc:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\tr-tr\WinRAR 4 BETA.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\it-it\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\*¨«v3c:\program files\common files\microsoft shared\ink\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\msinfo\Anal Pleasure 3.dvd.mpg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\zh-hans\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\WinAmp 5.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\*¨«v\c:\program files\windowsapps\microsoft.zunemusic_10.21012.10511.0_x64__8wekyb3d8bbwe\images\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\Âœ€†0ìdc:\program files\common files\microsoft shared\ink\da-dk\WinRAR 4 BETA.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ºc:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\Anal Pleasure 3.dvd.mpg .pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\les\dotnet\shared\microsoft.netcore.app\8.0.15\WinAmp 5.rar .exec:\program files\dotnet\shared\microsoft.netcore.app\Windows XP SP3 leaked.pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\smart tag\lists\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\en-gb\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\Âœ€†0ìdc:\program files\common files\microsoft shared\ink\languagemodel\WinRAR 4 BETA.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\r™€†Àîdc:\program files\common files\microsoft shared\ink\WinRAR 4 BETA.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\Ìèdc:\program files\common files\microsoft shared\office16\Jenna Jameson screensaver HOT XXX.scr 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\ricepapr\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\fold.jpeg .pifc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\vba\vba7.1\Visual Basic.rar .exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\*¨«vRc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created \??\c:\program files\windows c:\program files\windowsapps\microsoft.zunemusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\Windows XP SP3 leaked.pif 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\R’€† édc:\program files\common files\microsoft shared\ink\fsdefinitions\insert\WinRAR 4 BETA.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\msinfo\uk-ua\Adobe Photoshop 7 Illegal Beta.exe 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe File created C:\Users\Admin\AppData\Local\Temp\*¨«vKc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\zh-hant\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4196 wrote to memory of 4284 4196 2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_8072ca91bc37da2f7cdfecfc4eb47295_akira_amadey_cobalt-strike_elex_glassworm_hellokitty_hij.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmpC:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp2⤵
- Executes dropped EXE
PID:4284
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 68322⤵
- Program crash
PID:6064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4196 -ip 41961⤵PID:4768
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 1.2MB
- SHA256 2d5d388e78b247108b39ddea76453635aa75b8d2125e3954769a24b5ab48987e
- MD5 22592464dba3a3ccf57b688e7cbdf926
- SHA1 206effef412f5025820225a790b6c54eefa56f0e
- SHA512 77e78c8effbbfe1ce50b5a4693588452b469e78240983a2a93466e7408829ccc28dd71d318c4fc1f16fafe8e75948aa9d610b7a768750996c871e297968ef39a
- SSDEEP 24576:XRazrU3KoUre9SWLpw6itzccs5fq10y2I2SE:BmrU3KhecEu5tzuM0S2SE
- TLSH T165459E03B2D940BAE0BAE5398755D626E675B8110B31A7CF13A4476A1F37BF02B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 3.4MB
- SHA256 2b2538d62a3d95caa1eaaf402dda55e9b0dc66e5a0b8f6c8fd3042550e48d56d
- MD5 cd53c61345139dd549495633c7195a9d
- SHA1 2f2ea5f17f724e08f2d965e591b61e0daf310487
- SHA512 006ea7fc9f7cb6b7312c4431ba631a528654bc5c111561cb884b165176dc70dccbb7d72e132b38ce599156df6ffa31476b69fe6dd095a3fef2f93b7ef5208124
- SSDEEP 49152:k5tzuM0S2S5mLFEuVebedv9uNBb8AftK9qrO1LS9RhSq15vTNuHv/QXd9CQxM4kA:kCFk/fUqrOiOc5z
- TLSH T1B5F54B2E735881D9D266D5BD8A42C506E371F801CB3166DF26A4475E2FBBBE34E3A340
- MD5 SHA1 SHA512 SSDEEP TLSH