Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 03:12
Behavioral task
behavioral1
Sample
2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
- Size 14.5MB
- Sample260503-dp8yyaev3j
- SHA256 c53690798a5842cbb33537b0887c1d5310cd56053f91eb954ab52fbb0d237e8c
- MD5 2de4b5a675f0e5d9756439f273ce9c09
- SHA1 f7d092ad644d2786e48a9231c4ba89d518ced999
- SHA512 9a02f9bad098bfbbb258ad57bed9024dcfe680c270a83c01b556a153f25db6324ad4138916729451e0f78685f7aacc4a8ccac02e80238a0d37473e0f52f23084
- SSDEEP 98304:f12Og6Ii7IabjKoh9WsK1PTJxjRXzWUbYZfgs0QlxfeqnevoirV0t/iLwHft8vA5:f1YX1LdzWU64sveqojrOOwH+vVoz
- TLSH T164E6282166E98FE9C46FD070CE66A5B295227C814F719BCB1580BE2D3E335E05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\typeperf.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\tree.com- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\wextract.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\takeown.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\regedit.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\cipher.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\charmap.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\tar.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\chcp.com 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\finger.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\runas.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\convert.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\find.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\format.com- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\control.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe -
resource yara_rule behavioral2/memory/5212-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000d00000002ad68-5.dat upx behavioral2/memory/5212-542-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/5212-3174-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseSampleUploader.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.22000.1_none_b6f59fcb95517038\srdelayed.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.22000.469_none_ddccf236be43e7c9\f\memtest.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.22000.1_none_0e752f0b29d37df6\telnet.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_659b5b6317001d2c\f\runas.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmpshare.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\f\SyncAppvPublishingServer.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\f\cmimageworker.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\NarratorQuickStart.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\audit.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sigverif_31bf3856ad364e35_10.0.22000.1_none_11dd22030027b61b\sigverif.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_wpf-presentationfontcache_31bf3856ad364e35_10.0.22000.1_none_5bdd347516f7252a\PresentationFontCache.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.22000.1_none_ed19a89f248a8665\psp.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\f\wmpconfig.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_935f3ba28807f81e\finger.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\x86_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15806.0_none_14b35d27c5caee09\ServiceModelReg.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\Setup.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_659b5b6317001d2c\f\runas.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.22000.1_none_1aa5e4c18d034965\nmbind.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.194_none_a9ffdf7b2efc21ec\r\wuauclt.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.22000.1_none_86dac86e5184145e\AddInProcess.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.22000.1_none_fdc8d4cbc9bb5f92\ctfmon.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.318_none_2bc95a47eaa37094\hvix64.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.22000.1_none_1de2c1a435cdd4e6\CastSrv.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.22000.1_none_45c23e6afd43f4ce\sysprep.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.22000.1_none_7512c1e2929b66b7\mscorsvw.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\Microsoft.Uev.SyncController.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.22000.318_none_de01ffa2be1c4596\f\memtest.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.22000.1_none_a4bc36ae2cabd6e1\dllhst3g.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.22000.1_none_09c9ecffc9049dc0\PING.EXE- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.22000.469_none_647b90a512106929\f\winresume.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.376_none_742ed331adb702b6\WFS.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.22000.1_none_db5642aeddf1e2bb\PrintDialog.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_0483b4854ca89ef9\TiFileFetcher.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\PrintDialog\PrintDialog.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.469_none_0defc0f5807dd5f0\f\ShellAppRuntime.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15806.0_none_8e3cbaaac5859590\aspnet_regbrowsers.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.22000.37_none_b6eb9704869b2bfc\InputSwitchToastHandler.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.22000.1_none_2c18bbe89f9c63f0\nslookup.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.22000.71_none_1c87d1fdc5c5037f\r\raserver.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.348_none_e2c7a9ab59285812\f\LockApp.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.258_none_dfe62f4e03f8472a\f\LsaIso.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15806.0_none_51adbd38d0719cb0\cvtres.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttune_31bf3856ad364e35_10.0.22000.1_none_141cd469f7aeedb6\cttune.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\r\WerFault.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.22000.1_none_c4b0a2008f6c9857\_isdel.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpksetup.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.22000.1_none_1c7f192e4c9e218b\verclsid.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_cfe0738266c4e593\r\wsmprovhost.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.22000.65_none_4f258ec343f09686\r\oobeldr.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.22000.1_none_98005a471b61ee29\EhStorAuthn.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.22000.1_none_570a42293a25658a\fc.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.22000.1_none_010c2089229afa0b\fsavailux.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.22000.1_none_38b7c0094d09fcbe\hdwwiz.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.22000.434_none_841ec22dd6bd92c4\f\curl.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-choice_31bf3856ad364e35_10.0.22000.1_none_23ff3304c4ecc196\choice.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.22000.37_none_880eed7a42b2415b\hnsdiag.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.282_none_d171f6f246e51c59\spoolsv.exe- 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_2de4b5a675f0e5d9756439f273ce9c09_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5212
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 15.0MB
- SHA256 a3057f776d6fd18bd4894872c55f82dbe067e93ce1199be9d7dc9578dce189a4
- MD5 9d4af46c831f900e1bd11fe48436e6a5
- SHA1 1189cd23ef099072cfe35d74d2c9c2196d67b9dc
- SHA512 882f50b49d734a451ea099d63f4d7080e77a949597f28fdcbf0cac32bab239f77232b406b3593ecc7749b1513ccd6df290c4d6f0ca3009c960fc484942db87f7
- SSDEEP 98304:f12Og6Ii7IabjKoh9WsK1PTJxjRXzWUbYZfgs0QlxfeqnevoirV0t/iLwHft8vAt:f1YX1LdzWU64sveqojrOOwH+vVo/oK
- TLSH T12DF6282166E98FA9C46FD070CE66A5B6D5227C814F319BCB1580BE2D3E335E05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH