Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/07/2026, 04:31
Behavioral task
behavioral1
Sample
2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 16.2MB
- Sample260701-e5dy6set3q
- SHA256 a4b223f5c74e57daf75b770c2c5fefea3440ae474715cbced6e702e7c6ea5832
- MD5 6b57a03569a4a8ddacc7bb25ac5d95fb
- SHA1 42cd7203a20b8474b29cb9548d77ac5e34b9037a
- SHA512 9302c35351fa5eaf2efc9f5ccf25c665b9aa9d6c4b2b50dcaa3071266d6bcdbc5ee996cf56468702f3743245e623f6b70f4146cf3fc322ea97700afc7f2618bf
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2Ig8/d6YoGIbUwF1VERmj2bk:ERXMzdlT/d6YVIY092bk
- TLSH T10C07AE55F273317CC227957481699E33B9303C551B208DBB9588F6742E37AB8A93EB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\chkntfs.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\psr.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winrs.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\attrib.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\logagent.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\net.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winver.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\hh.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\more.com 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\bootcfg.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\calc.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\runas.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\autofmt.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\expand.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral1/memory/1672-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0032000000023aa5-5.dat upx behavioral1/memory/1672-480-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1672-3220-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.19041.1_none_e688384bec188769\AddInProcess.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.867_none_b4e9fc09cfcbdd7c\f\AxInstUI.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\r\PrintBrmUi.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\f\wkspbroker.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_813ba58adb6e7f68\f\GameBarPresenceWriter.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1_none_5d1b02917c107c75\convert.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.1_none_d1d4cd9c4b409594\TabTip32.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\sxstrace.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.19041.1_none_c319cf869bb64064\shutdown.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1202_none_958d6588f50ca146\f\edpnotify.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.19041.906_none_066336a1b904a848\taskhostw.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\r\MusNotifyIcon.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\f\ssh-keyscan.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_aa218bebc7c352ef\upnpcont.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.1_none_37f2e74a0020dc93\pcaui.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_f786fa028426f858\fltMC.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.19041.1_none_d6d84e47a8300235\ldifde.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_e95531bdadf3df5c\wmpshare.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.19041.1_none_1939c8a90c4232f6\xwizard.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.928_none_0f531ea0d233243b\r\DiagnosticsHub.StandardCollector.Service.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde\f\fontdrvhost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.19041.1_none_705ce89b3c18ecc5\verifiergui.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_e867a49a6e97813d\LaunchWinApp.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\r\powershell.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\r\user.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.19041.1_none_c9157ddc38b83b1b\aspnet_regsql.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\f\lpremove.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\msil_jsc_b03f5f7f11d50a3a_10.0.19041.1_none_68bc95ae68779efe\jsc.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ls-adschemaanalyzer_31bf3856ad364e35_10.0.19041.1_none_89e9f21ed63037f6\ADSchemaAnalyzer.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_51facbaf4051768b\resmon.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.1_none_03831cf8d49cee55\prevhost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\f\CredentialEnrollmentManager.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.19041.746_none_b7a67ddd8bcc7470\r\ApplicationFrameHost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_956906931b26e27a\winrs.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_hyperv-vmsp_31bf3856ad364e35_10.0.19041.1_none_39d506065bd87607\vmsp.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\msil_comsvcconfig_b03f5f7f11d50a3a_10.0.19041.1_none_ac711518659a66a5\ComSvcConfig.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_76d2900542f0226c\f\BackgroundTransferHost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.117_none_975feef459c69d6b\CheckNetIsolation.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\f\WerFault.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_38869341091832be\r\mofcomp.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_425d54d86cc1f3e2\ttdinject.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\finger.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.264_none_08acfd4a9926561a\r\wermgr.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\diskperf.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\f\WerFault.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.1_none_8b3ee1f81086d0e3\ReAgentc.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_cc2783ead104d62a\winrshost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\Taskmgr.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\r\AxInstUI.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\WindowsSandboxClient.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.19041.1_none_df1a7ee54b62a4fd\qwinsta.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_ae5ec9e59abc05e6\r\SndVol.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.117_none_9be21f0ef860b570\r\wslhost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.1288_none_e0f8082a6952ce81\r\ntoskrnl.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_10.0.19041.1_none_c9c647e748814b31\WsatConfig.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-notify_31bf3856ad364e35_10.0.19041.1_none_d2e378e1475d4847\fvenotify.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.19041.1_none_be7f82b3c03af8b8\TpmTool.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\r\EaseOfAccessDialog.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.1151_none_f0b5afbf42eaff75\Spectrum.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.19041.1288_none_91a5fb477b6af5a0\f\SIHClient.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1672
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 16.7MB
- SHA256 9d3d8c6eff5dc76372df1fb6e649eeee633825f73a990d04cb6fcdf38f9b4f3b
- MD5 90eb2b070d9f071afc30680d1c8b6d05
- SHA1 f39f6de626d356a1f397548f6bb7e45014db90f0
- SHA512 e3826d4cf621ccbf9e2a458abba54e3b3101d20d8d261b24791e431dda3756d86a07f65cfd5532b1ab6e285df55e4d57e64e74a3a6b0da1061afa67234b8439d
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2Ig8/d6YoGIbUwF1VERmj2bJ+:ERXMzdlT/d6YVIY092bJ+
- TLSH T10D07AE55F2B3217CC227957481699E73F9303C511B308DBB9189F6742E37AA8993EB32
- MD5 SHA1 SHA512 SSDEEP TLSH