Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 01:44
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 16.4MB
- Sample260602-b5248act7l
- SHA256 2c26a1d250faeffa1791a26fc442d5cd890c06cc9215b49acdb6d20c71ecdc1e
- MD5 875e8ab26ed2d938d8b02ce1c45f2cfc
- SHA1 cf38ff7629eae457706ead713039ec8b2805764f
- SHA512 581b843be79f5ee444a6a341ed81e518657c527d64b16df30bff19a31eef6f0465f5e6a0d0a30099a7ec0e161a150fd6f36b98491deb1758775f4ea336467067
- SSDEEP 196608:8pAnjOyny6f18UZosouHOAoXvvOyd2gTH2qBpu1QfLIqsufvov:OAn99ijkOTtTHNBpu1Qfc0Qv
- TLSH T13B075B1AA2988BA9C06FD074CD466695E6337C414F309BCF1680BF293E776E15E3931B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureUPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000600000000d41b-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\explorer.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\label.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\calc.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\svchost.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fontview.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mode.com 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mshta.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\psr.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\attrib.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\find.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cacls.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\at.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\format.com 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\compact.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{62B9A573-FEDC-4CA0-88A8-BCFC9656AA28}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\7-Zip\7zG.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{62B9A573-FEDC-4CA0-88A8-BCFC9656AA28}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.22000.1_none_0f7f7612eae8630f\SecEdit.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\SysResetErr.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.22000.41_none_506d5972b4817c83\f\Magnify.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.469_none_40856ba085a100c4\f\BioIso.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.22000.1_none_d195a44751806b34\RdpSa.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.469_none_560fc7f19d1d3ed7\f\VSSVC.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_hyperv-vmsp_31bf3856ad364e35_10.0.22000.318_none_7f5bff6941991869\vmsp.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.22000.1_none_b8730bce9cba86d4\wpr.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.22000.1_none_bb5ad6287475565d\gpscript.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.282_none_04af1ce80d4a389a\f\ie4ushowIE.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.1_none_161d4fe56c866837\certutil.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.469_none_574c4adf3362fbca\r\explorer.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_987098e149e09f68\msinfo32.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchFilterHost.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_2b1b00237ae1bbca\f\SearchFilterHost.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.22000.41_none_6fef9dc502cda133\IcsEntitlementHost.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_28babea403fb06cb\r\CallingShellApp.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.22000.469_none_aa2bb1f81a06280c\UsoClient.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\f\SearchIndexer.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15806.0_none_de9c072f19e4a666\vbc.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15806.0_none_ae81a34e9485c0b6\EdmGen.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.22000.282_none_e0bcdfd0611d6514\r\WindowsSandboxClient.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.22000.1_none_a7a700c8f53b4106\mount.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.22000.1_none_71c134a2fff387d0\WPDShextAutoplay.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.22000.318_none_1e08617dd1895eb7\f\UtcDecoderHost.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.22000.1_none_087395c681a80760\IMJPSET.EXE- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\SenseCE.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sort_31bf3856ad364e35_10.0.22000.1_none_0c566b4b52acbfd1\sort.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.22000.100_none_b998a9a728d6401f\f\Narrator.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..platform-media-base_31bf3856ad364e35_10.0.22000.376_none_d0bc762eaa58a5f0\f\SetupPlatform.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\TextInputHost.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.22000.71_none_cd21d839939807f0\f\securekernella57.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.22000.51_none_8fdc96dca7b0b006\SpeechRuntime.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.22000.1_none_b60008c7dd9ead92\CompPkgSrv.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\hh.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_f6a11a34378fa70f\r\StartMenuExperienceHost.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..vercommandlinetools_31bf3856ad364e35_10.0.22000.1_none_10872c88a98c0f77\tsprof.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_wpf-presentationhostexe_31bf3856ad364e35_10.0.22000.1_none_6a1935736c898073\PresentationHost.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\WebExperienceHostApp.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.22000.469_none_265cec8f409ba4eb\f\HealthAttestationClientAgent.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.469_none_160103e31c4d8d88\f\SystemSettings.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.22000.1_none_ff7542ad94a3dbc5\PATHPING.EXE- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.1_none_c99cb41b228d2f61\SpeechModelDownload.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.22000.1_none_76cebe5f6ad1251a\winrshost.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.22000.282_none_3d368ddb21bde8c7\f\rdpshell.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.22000.348_none_e639e7a3fcfcf06b\securekernella57.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.22000.1_none_6180ec8e85a3740e\imjpuexc.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.22000.71_none_152ef1c98c20fad4\fodhelper.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_cc9ed34da60ac9c4\Robocopy.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_10.0.22000.1_none_35b3f196fa600d12\NETFXSBS10.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.282_none_e2966659594e32a5\LockApp.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-upprinterinstaller_31bf3856ad364e35_10.0.22000.1_none_094f49d32c4abf9f\UPPrinterInstaller.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.22000.282_none_31bc5b70e4490cff\f\vmms.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.22000.1_none_b9334c2faa2133a2\agentactivationruntimestarter.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\r\quickassist.exe- 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_875e8ab26ed2d938d8b02ce1c45f2cfc_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2580
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 16.9MB
- SHA256 1e9f468a3790097901b884354d5ba7d61751e30564590f95c74a9004560d6a85
- MD5 1d31acae1d64293042eb2a85625486e0
- SHA1 458a11172b72e3a1ee874fb1e96246e2d2ce37dc
- SHA512 4989b60b3f5103dc5fd55f13534064c2dacb3fe5a979c942855e3e866f835db1fa7bdf4c03a1508fbc357130dba6b6e524ce45d3afcde2aa4c6d5ab1e21361e5
- SSDEEP 196608:8pAnjOyny6f18UZosouHOAoXvvOyd2gTH2qBpu1QfLIqsufvoroC:OAn99ijkOTtTHNBpu1Qfc0QUC
- TLSH T186075C1AA2988BA9C06FD074C9466695E6337C414F309BCF1680BF293E777E15E3931B
- MD5 SHA1 SHA512 SSDEEP TLSH