Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 09:46
Behavioral task
behavioral1
Sample
2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 14.1MB
- Sample260415-lrmsgsd17t
- SHA256 754c3cfdf0c5e39a02b20c2080f84178193a8674086c23d4c9169175da9f4da9
- MD5 ea8f163fb5db0dd50ad7e9f51acf1e1a
- SHA1 ece2a2581859d158a7994341743fe06300d3f9b9
- SHA512 05bd2584427554eb5100d6216761c8b02d0234a7a39f1c9c75ba6dc8eae5a5fcb759d6a408d16c5df0d69eb6a2f4616b6577b32218b81252467714b1f0817836
- SSDEEP 98304:OfkchgAOSJdTjfkZcg/PvOAjcXvvOOc5yTIOSAU:Sk0JdHP2HOAoXvvO6TfI
- TLSH T197E6F50F6A7CDD22F17E3DB9C850C6A89A287C944622745738F4BF5EDA732C16E19231
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x001300000001efa2-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x001300000001efa2-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\autoconv.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\whoami.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\explorer.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mode.com- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\regini.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wusa.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\expand.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\user.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sort.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dialer.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral1/memory/1344-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x001300000001efa2-5.dat upx behavioral1/memory/1344-536-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1344-3204-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVDllSurrogate.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1266_none_110072d23cfc00d3\UwfServicingMasterScript.cmd- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1_none_a0a8212dcec26473\refsutil.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-add.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_9972edde9b98690c\f\wscadminui.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.19041.1_none_6e5126083c2c0ea6\NDKPing.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.1_none_90e29eafea574969\psr.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.19041.423_none_12ca604b48f8d3fb\r\CapturePicker.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\r\ImeBroker.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ls-adschemaanalyzer_31bf3856ad364e35_10.0.19041.1_none_89e9f21ed63037f6\ADSchemaAnalyzer.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\audit.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\wkspbroker.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1237_none_7578510aa0f564fa\vfpctrl.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.19041.746_none_cabafbc5834ab93f\r\DisplaySwitch.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.19041.1_none_e7854180ca0cff60\reg.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.1202_none_fdbbcf53ca14e151\f\wimserv.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_9972edde9b98690c\r\wscadminui.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.746_none_4028b8f4f6c0b829\wpr.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.19041.1_none_2318682da2c7a3ea\PresentationSettings.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.19041.1_none_65c819c8f144c1f4\msdt.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.1_none_2ace380757b108f3\provlaunch.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\r\diskpart.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1081_none_e3f87355251e8c43\notepad.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.19041.1_none_602068813f9366fe\credwiz.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.19041.1_none_911aa822a342ea29\extrac32.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\FsIso.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\mstsc.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1288_none_f26bd0dcdf662cc9\f\AgentService.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\f\cmproxyd.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\f\rdpinit.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4ecd10b107da65f7\f\AtBroker.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.19041.1_none_09c72ca259d82b1b\msiexec.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.19041.1_none_ad4ed32c0facc27c\w32tm.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.19041.1_none_a347c249afbf6f97\Netplwiz.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.19041.746_none_cd77eb91574a2623\r\sysprep.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_220320d2c4216035\TiFileFetcher.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\explorer.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\f\explorer.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_b84e385529c68af9\unlodctr.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.19041.746_none_45062eb997366a7f\f\RemoteAppLifetimeManager.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_fefa067e67e7af8b\r\UserAccountBroker.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_abd26b7610cb738e\AddSuggestedFoldersToLibraryDialog.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\ApplyTrustOffline.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\relog.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.746_none_7aa85dbabd7172c7\f\PrintIsolationHost.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.928_none_31fd477afc7b8278\r\PktMon.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_610e6b21ab533b13\r\autochk.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.19041.1_none_ad9c6c9be4203192\Netplwiz.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\relog.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\poqexec.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_556ba5d1df8130ac\printui.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.19041.1_none_6f2ce5f0857cd61a\SecEdit.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\r\HvsiSettingsWorker.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_8636783e05df6f4e\f\newdev.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.19041.746_none_c82b4b805b9ae361\r\SystemSettingsBroker.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\r\BrowserCore.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.1266_none_d92abf553d8a282c\MusNotification.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1_none_0990e3dd20dd5732\omadmclient.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.1_none_8bd71d601a2cdd3f\TSTheme.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\f\UNPUXHost.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15805.0_none_9d9ad2580504a573\aspnet_compiler.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1344
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 14.7MB
- SHA256 01ca8bf61e2c4054687a0cf4d099612d18805f926cfe6620bb2d3aa7b4120217
- MD5 cd7d91a71613e32bbaf12556fd11e87b
- SHA1 ca4abfb8163823169e20379df7e6df6a6e8de00f
- SHA512 e0c9846ba2cefc277f0ad73cb39f19e75f8495c15977c34af29a8811c8d676855719e885d95926b78e2df294354b1a557d6c027d6a58b4c04f3afa2e631243cd
- SSDEEP 98304:OfkchgAOSJdTjfkZcg/PvOAjcXvvOOc5yTIOSA0joJ:Sk0JdHP2HOAoXvvO6TfyoJ
- TLSH T1EFF6060F6A7CDD22F13E3DB9C890C6A89A287C544622745739F4BF5EDA732C16E19231
- MD5 SHA1 SHA512 SSDEEP TLSH