Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 03:58
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 18.1MB
- Sample260811-ejvd2avhmh
- SHA256 88926b13df526c12fa6cca09c0fb56e5eea26ffbf0b0f256d190ed14b8b53657
- MD5 05d2222b582d8bd949d4f1e3fd60fcff
- SHA1 4bc7e0b2185c1ce07d8e7b04f53407fca345e3c9
- SHA512 07330f0961095c4fdcc19d111e47f666cfa9d05e707c47cea37db732c43bcfc4cb57bda428c4e08398647ace0f2a9b442b2edfcea934cd77475cbb707bb1fa25
- SSDEEP 196608:8pAnjOyAdOrNTfNogKmd0JoUdGok1MdkgTH2qBpu1QfLIqsufX5:OAntqnqHQ/THNBpu1Qfc0p
- TLSH T1BA177C1272D48FA9C06FD038C95266659A333C564F719BDF2580BE693E327E06E3931B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c689-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c689-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c689-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\replace.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\find.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\user.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\runas.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\where.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\win32calc.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\label.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msdt.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\timeout.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\efsui.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\label.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\7-Zip\7z.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\r\cmproxyd.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1150_none_9d9573a1c9f40852\r\dvdplay.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.26100.1150_none_713524eb211332eb\ReAgentc.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15912.0_none_833013222f03235e\aspnet_regiis.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.26100.1591_none_19642579da3d47f4\AgentService.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.SyncController.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\changepk.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.26100.1_none_2f836f38379760e2\WWAHost.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.26100.1591_none_b89e4fe4764210cb\SIHClient.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MsMpEng.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3\r\CredDialogHost.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.26100.1150_none_67ed785bf55a7a21\r\DeviceCredentialDeployment.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upfc_31bf3856ad364e35_10.0.26100.1150_none_430cd619cc4d0de3\upfc.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.26100.1_none_554fc0a594820cda\WFServicesReg.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\ssh-keygen.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.26100.1_none_b7f01667e525edde\dcomcnfg.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_080ef735d249ae9a\fc.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\LogonWebHostProduct.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.26100.1150_none_21762269bb195f5b\r\WindowsUpdateElevatedInstaller.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_819025e8f7dd72e4\DpiScaling.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15912.0_none_75b001d640e3113b\aspnet_compiler.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.26100.1150_none_37adcb75a8302256\WindowsActionDialog.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\r\PrintDialog.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\unsecapp.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1150_none_9e0e1ec5a1c14e55\GameBarPresenceWriter.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\r\cmdiag.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.26100.1_none_8c35e9ae895560fc\wkspbroker.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.0_none_7f1c6fee223c55e3\mscorsvw.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.712_none_231685f601e78e59\SpatialAudioLicenseSrv.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.26100.1150_none_5dcdaa573c9a6613\r\chkdsk.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\subst.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_wcf-servicemodelreg_b03f5f7f11d50a3a_10.0.26100.1_none_10dfbabc1234526e\ServiceModelReg.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\r\hnsdiag.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\r\EDPCleanup.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\omadmclient.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.26100.1150_none_648c8216bc35a3e5\MicrosoftEdgeSH.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.26100.1591_none_756d2e37dd0406ef\r\ApplicationFrameHost.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1_none_0c53e49062af0dd7\SystemUWPLauncher.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.26100.1301_none_9624bcf361cbb3f2\ntprint.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_2dc797084143cfaf\CloudNotifications.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.26100.1150_none_4d28a605d2d4d62b\EduPrintProv.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SnapLauncherProtocol.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.26100.1150_none_a51a55a6faf616d3\lpkinstall.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.26100.1150_none_48c9cd2bf27dfea7\r\nfsclnt.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.26100.1591_none_bc6c19c8cde9cb50\r\SystemSettingsAdminFlows.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.26100.1150_none_99eb378dda259f30\r\SensorDataService.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.100_none_752bfd0c9236819e\mscorsvw.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.712_none_b1d1fad188ff9ad7\r\PhotoScreensaver.scr- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\AppInstallerBackgroundUpdate.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.26100.1150_none_ced6ba8820394f22\r\fodhelper.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.26100.1_none_a07bad500e90d9fe\ucsvc.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_d0b554d77644b199\wowreg32.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1591_none_19bc1d299dc8c2e1\LaunchWinApp.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.712_none_b1d1fad188ff9ad7\PhotoScreensaver.scr- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\r\SecurityHealthHost.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.26100.1_none_db738856a624fee8\help.exe- 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_05d2222b582d8bd949d4f1e3fd60fcff_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:240
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 19.0MB
- SHA256 7b34ac87ab400e595f6d25d0e4b3254f73d72ef9c234d483d2fdefe1994b076b
- MD5 d4f461749b239c215acddd64b1586962
- SHA1 9d8bcb136540196766cc5f73e7626b3f8a11c089
- SHA512 58c318466faace5b8b380caffdf76fb138ef5291e56cbd7dba3a494b263da7383ef0a95c76017c8678a30c3f5ee59cca3815357b52ecbb4f1a43dbc6f7d4eb3d
- SSDEEP 196608:8pAnjOyAdOrNTfNogKmd0JoUdGok1MdkgTH2qBpu1QfLIqsufXVF:OAntqnqHQ/THNBpu1Qfc0b
- TLSH T13B177C12B2E44BA9D06FD078C9526665EA333C454F719BCF2540BE693E337E06A3532B
- MD5 SHA1 SHA512 SSDEEP TLSH