Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 06:42
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 19.1MB
- Sample260730-hgh5rssfkc
- SHA256 6d8afe306fe6da2ffc015a44db20f3d25b5eb911f1747179ee92ba221b0f22c1
- MD5 ece0a8d5d8ea9f85ca664639d786e552
- SHA1 44ece01795c4a7d33b81a81745e1437cc8ee005b
- SHA512 bf0b9ef3af9a374954e2286a94a3d6ea9e976c7578ada29d3c1dee10b49511b96cd64c009002b46b79130c1c7d5dfe3b5dc4f0d2e3eb79f9ecbc990c48268930
- SSDEEP 196608:8pAnjOyAdOrNTfNogKmd0JoUdGok1MdkgTH2qBpu1QfLIqsufwcIU:OAntqnqHQ/THNBpu1Qfc0dV
- TLSH T1AF177B1272D44BA9C06FD034CE52566197723C598FB19BDF2540BEA93E327E07A3A31B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c52e-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c52e-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c52e-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mmc.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msdt.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\replace.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sudo.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\doskey.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\print.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\psr.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\certreq.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\gpupdate.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1150_none_df24b599b0c88e62\r\prevhost.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_c9d83dab422b920f\r\dxdiag.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\logman.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tioncenter.appxmain_31bf3856ad364e35_10.0.26100.1150_none_9cb5d3bc417a5c42\PrintQueueActionCenter.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_8897bf42a34b1ceb\PkgMgr.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\changepk.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.26100.1_none_743122fc48bb736d\CameraSettingsUIHost.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.26100.1150_none_8e0a1d6fce8b1d12\adamsync.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.26100.1150_none_5d1d8fd6c1063afd\r\MicrosoftEdgeCP.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\r\InputSwitchToastHandler.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\tsdiscon.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\csvde.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpksetup.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_8b74ec1a688877ac\r\NcsiUwpApp.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\WmsSessionAgent.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmLpac.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.26100.1591_none_c055032b96806f80\wscadminui.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.26100.1150_none_a875b50b457475fd\bootsect.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1150_none_ad5d9bcb00930036\newdev.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.26100.1_none_9cc92cd303f82ace\wuapihost.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1591_none_19bc1d299dc8c2e1\LaunchWinApp.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.26100.1150_none_139d0992bdcc4113\DsmUserTask.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.26100.1150_none_d519484bd1dd0a29\inetinfo.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_7fa09276a9a8ba6c\esentutl.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\r\SearchProtocolHost.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.26100.1150_none_dad1c69b80d09caa\r\CloudExperienceHostBroker.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1150_none_f57fd51c6f680fbc\eudcedit.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.26100.1591_none_239398876b1e5306\r\InetMgr.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\umount.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.26100.1_none_7b547ea3515807e4\smss.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\r\dtdump.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.26100.1150_none_6064a5e6e18d90dc\r\vssadmin.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_41fcc82854bc2b0c\credwiz.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.26100.1301_none_0b8f997b84f03748\r\winlogon.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.26100.1591_none_2bf6278ffa2525b6\r\vmconnect.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.26100.1150_none_f2155cb81beac176\tar.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_f1eb80676c3fbe87\eventvwr.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\wbengine.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.26100.1591_none_f83c41b7a549ff24\CCG.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.26100.1150_none_26313857ae07f88d\Eap3Host.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.26100.1_none_af4d21cdb9ffe687\mountvol.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\msinfo32.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.26100.1150_none_4231ada90cb553fb\r\consent.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.26100.1_none_9aadb670a9451e5d\RpcPing.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\MiniSearchHost.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseCM.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.26100.1_none_d5026185bf17c56a\Windows.WARP.JITService.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..acyinkingcomponents_31bf3856ad364e35_10.0.26100.1_none_493a1e7e2682a5b1\pipanel.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.26100.1150_none_32bd5b6fcfab5b78\r\psp.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1150_none_88f06bccebd86289\r\w32tm.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_75b5554a02bcd133\r\AtBroker.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_530ca0a73ce97b04\r\ftp.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\Mystify.scr- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.26100.1150_none_4b5f1683145608dd\r\TieringEngineService.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_a661f954ca482f71\Win32WebViewHost.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.26100.1150_none_da9d1a28d73a79cb\r\GamePanel.exe- 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_ece0a8d5d8ea9f85ca664639d786e552_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5336
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 20.1MB
- SHA256 6a327af1a31f0f289a7956abad32e58508b2e482974d5522441e99d8bb670c61
- MD5 c0b367b4a3141eaf3124bad7bd2adbec
- SHA1 8d514ffe3cebecfff39d4ccebe56c9a2e3801435
- SHA512 f748f52542279d359430a81c0fb53ca14001caf2e1127a9610938ee55186cc111d40589084e2d2cc319fa928cc1def2f9a44caa12b5cd8a7301dbf27eff8960a
- SSDEEP 196608:8pAnjOyAdOrNTfNogKmd0JoUdGok1MdkgTH2qBpu1QfLIqsufwcIKQ:OAntqnqHQ/THNBpu1Qfc0d+
- TLSH T12D277C1272E44BA9C06FD034CE525665A7723C594FB18BDF2540BEA93E327E07A3931B
- MD5 SHA1 SHA512 SSDEEP TLSH