Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
07/05/2026, 01:59
Behavioral task
behavioral1
Sample
2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 2.8MB
- Sample260507-cepxmsdw7s
- SHA256 468469c8ea994aef377d2b925edef96e2b13240a3b7042b8ac618e8c19ac59b1
- MD5 9cddf6ee4a0ac094248b049beff093fa
- SHA1 ac59957a124b59725e49c4c66a04746917aa6ad8
- SHA512 3be29b37fa0ce6167a8ffa937d37bac70c7e2eac895443c8d94755a023544eae4acfeb49a5a48f58c41960a8fb8c6c00108840a8d9199e36ad468abd26f0a197
- SSDEEP 49152:esQfgDtoZ/0g7mM+M6RkMkIM7I067csDOPqJtb2I6VBXdcG:esQ/cM+M6RkMkIM73sDOPNd9
- TLSH T11BD59D12F7E496B1E0B78574CAB29655EA327C614B30C68F2298A35D1E337C19D36B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ARP.EXE- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\hh.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\icacls.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\systray.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\notepad.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sc.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\where.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\winver.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cttune.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\format.com- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mshta.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\more.com- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\write.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\proquota.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\choice.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe -
resource yara_rule behavioral2/memory/4960-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000600000002a7e0-5.dat upx behavioral2/memory/4960-1004-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4960-3174-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.22000.1_none_2837defe14ce56f5\repair-bde.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.348_none_8c1cd5f65f938380\r\DataStoreCacheDumpTool.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\tsdiscon.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.22000.41_none_6fef9dc502cda133\IcsEntitlementHost.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.22000.469_none_647b90a512106929\winresume.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dusm_31bf3856ad364e35_10.0.22000.65_none_8e80131135014fd5\r\dusmtask.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.22000.348_none_a83a13d7c7ca92d4\r\nfsclnt.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.22000.1_none_b9b90ea0c63699c2\RdpSaProxy.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timezone-sync_31bf3856ad364e35_10.0.22000.1_none_e5748d8a251de85f\tzsync.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.469_none_560fc7f19d1d3ed7\f\VSSVC.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.22000.120_none_05dfd9bc9f8bc6b6\f\Win32WebViewHost.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.22000.1_none_2302091cdefe79c3\uwfmgr.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.318_none_5cc755143bc62566\r\ApplyTrustOffline.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.22000.41_none_87f7650fac06c0f2\r\CredentialEnrollmentManager.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.22000.1_none_3fc7d56a6d567d99\DataExchangeHost.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.22000.1_none_418429ddc6d1eb8f\logagent.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-upprinterinstaller_31bf3856ad364e35_10.0.22000.1_none_094f49d32c4abf9f\UPPrinterInstaller.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.22000.1_none_6cbbdad227c57e28\sihost.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.194_none_a9ffdf7b2efc21ec\wuauclt.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.469_none_8c502cfed26c810b\f\TrustedInstaller.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.434_none_2ca09768f8a7e2e6\f\DiagnosticsHub.StandardCollector.Service.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_e83cf4fa7871c56f\r\PkgMgr.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_37833ea9df2deb57\scrnsave.scr- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.22000.282_none_6ae954e75a4dd338\winlogon.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.22000.1_none_0f97a0bb2461b363\WmiApSrv.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.22000.1_none_2e3f0787886879d3\wbemtest.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.22000.469_none_647b90a512106929\r\winresume.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\audit.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_555ad0e288836a51\SearchIndexer.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_da8c01e10676f001\sdbinst.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.22000.1_none_44d220827fc06fc2\dialer.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_bc172f1a0215d298\f\wevtutil.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.282_none_8beb92a45fb95e13\r\DataStoreCacheDumpTool.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.22000.1_none_463f193e37cf0011\IEExec.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.22000.1_none_8165809779001f16\edpnotify.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.22000.1_none_58a0c8778f3217ee\lodctr.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.22000.1_none_57e0cfd01d70414f\SystemPropertiesAdvanced.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winver_31bf3856ad364e35_10.0.22000.1_none_16e9c634d5a2aefa\winver.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.22000.1_none_902756b93bcc4aa2\vbc.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\AuditShD.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.22000.282_none_d1df129ba9a9b56f\f\fsutil.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.22000.282_none_30a5190270148358\r\directxdatabaseupdater.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.318_none_15d95e5ea6111bc3\r\sppsvc.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.22000.1_none_724d8db15095b32c\SpeechUXWiz.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_wpf-xamlviewer_31bf3856ad364e35_10.0.22000.1_none_50334ea3c95884c9\XamlViewer_v0300.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.22000.41_none_1d0a15319901359b\f\PinEnrollmentBroker.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.22000.1_none_8a2a9fc5ca3ef1e1\dwm.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_c24a28fb71aa07c9\Robocopy.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4385d5a885bc9a36\cscript.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.120_none_7c599f579e2e019d\SpatialAudioLicenseSrv.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.22000.1_none_ba30cc9df8a7fca4\eudcedit.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.22000.1_none_0367376385127fe1\FXSSVC.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-more_31bf3856ad364e35_10.0.22000.1_none_0cf29863523884a8\more.com- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_cc9ed34da60ac9c4\f\Robocopy.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_cfe0738266c4e593\wsmprovhost.exe- 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_9cddf6ee4a0ac094248b049beff093fa_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 3.3MB
- SHA256 171ad62817628b3b3624988b1cbfc4c897bd2e68542a3ca7f66305a70726dbd0
- MD5 492d07cdf8f131be0be472f619172637
- SHA1 fffd0b29974802a43dab52510b0c93397c0e8ba5
- SHA512 fd097fac8c2a1e1c62d5078de197dabf055994440dab3715f3a9cff8dae25b9d52ef77b28652f3b06e2ede62061bdb2777eb2031184f9a2ec37d8450f83d7d91
- SSDEEP 49152:esQfgDtoZ/0g7mM+M6RkMkIM7I067csDOPqJtb2I6VBXdcsPji0Ajx:esQ/cM+M6RkMkIM73sDOPNd5jot
- TLSH T17EF57C12F7B486B1E0B3C574C9E29655EA3238514B30C6CF5299A36D2E337D29D36B32
- MD5 SHA1 SHA512 SSDEEP TLSH