Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 12:08
Behavioral task
behavioral1
Sample
2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
- Size 1.1MB
- Sample260731-pbbl3asygw
- SHA256 94ee35854e2f2e8daf09d7c0a09eeafda8a4d0cf29ccbfdfb3dbcddac1831a22
- MD5 3608106ac8be02f5344a69114e11ea89
- SHA1 845d1ce7ad1f5e6f69f6a00e60eedde9a409bb17
- SHA512 79823b36f384f216dfeb475323e6fcc0f76567c3e3ff992f5e379832325ee0f56b3003e03bab40c2d148b7229ff7853ebacce1678cc0ff6b33f155cb5c9243c8
- SSDEEP 12288:jxX2H+3RngPDPdMWuatuPtXmMfJP6ppgg2HFZlx6EAwSfxL/2Dc3jDLLmt0LDQeg:jxb3BGdx5tul2Mf5qmT6ZaewsAjj
- TLSH T1DF45BE32BAA0C032D27709714EB6E336697DBE710F214AC7E3D86A4D1E706D16A36717
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\attrib.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\charmap.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\psr.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\ftp.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\subst.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\finger.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\wscript.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\Dism.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\getmac.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\help.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\net1.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\userinit.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\tree.com- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe -
resource yara_rule behavioral2/memory/992-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000e00000001c4d6-5.dat upx behavioral2/memory/992-1034-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/992-2921-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Windows Defender\mpextms.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\7-Zip\7zG.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1150_none_04bfb5d145d6cf47\r\diskpart.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\mofcomp.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_wsatconfig_b03f5f7f11d50a3a_4.0.15912.0_none_65c6ab619fd35783\WsatConfig.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\r\sethc.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\HelpPane.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.26100.1591_none_fdef694f47f84aa8\r\wpr.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1150_none_0bdb83c7d007c6bc\PresentationHost.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiWorker.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.26100.1_none_22beb1f66a9bdcd9\ComSvcConfig.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\HelpPane.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.26100.1591_none_d92b9cc442553e63\lsass.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1150_none_3d9125d57cc0da9e\r\WMIC.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_6d1bd4f9d0cbd5f8\Robocopy.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.26100.1_none_012c60dec828ce67\ssText3d.scr- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1150_none_664cc5d65cf1b4d8\WSManHTTPConfig.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\r\Core\ScreenClippingHost.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_783b330506082901\backgroundTaskHost.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.26100.1150_none_20634ae8638b2e34\recdisc.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.26100.1150_none_d11fa90f43730842\rdpsign.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\WebExperienceHostApp.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.26100.1_none_dd9c925292d9a76c\printui.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\r\IMJPUEX.EXE- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.26100.1_none_5d5870c25fd0c1ea\netbtugc.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_10.0.26100.1_none_cc7ea73da7f4750d\snmptrap.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timeout_31bf3856ad364e35_10.0.26100.1_none_895815212ed14bd2\timeout.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.27000.360_none_a4b0965e18742ee0\aspnet_regbrowsers.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.26100.1591_none_052b2ae1ad719889\r\FileExplorer.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.26100.1591_none_cdec79755d491fdb\r\Setup.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\r\XblGameSaveTask.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.712_none_3a9448740bd98799\r\mspaint.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.26100.1_none_5da5aa85f914f74d\srdelayed.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\explorer.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\r\AppInstallerBackgroundUpdate.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.26100.1150_none_56532b8e4ca54ecd\verifiergui.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.26100.1150_none_a51a55a6faf616d3\lpkinstall.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.26100.1_none_b21add2e107e23b6\w3wp.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\r\ChtIME.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\WUDFCompanionHost.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.26100.1150_none_249c3478d7e5d3ca\r\Ribbons.scr- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.26100.1_none_d5026185bf17c56a\Windows.WARP.JITService.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6e6a9c2b69241453\hh.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audit-component_31bf3856ad364e35_10.0.26100.1_none_a3abe7a4df6b292a\audit.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.26100.1_none_d11ede0471c43ced\help.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\r\WUDFCompanionHost.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6415f1d934c35258\r\hh.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\r\bridgeunattend.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.26100.1591_none_245703c14f08d5aa\r\CustomShellHost.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\r\winrshost.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.26100.1_none_851b25ae6a5e3057\dpapimig.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1150_none_092b86d80d75b9b6\r\cleanmgr.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmproxyd.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.26100.1_none_a7c632dbdc1d61bb\w3wp.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-sk-helper.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\show_third_party_software_licenses.bat- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.26100.1591_none_f467d2d98b46d418\r\mighost.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\ssh-agent.exe- 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_3608106ac8be02f5344a69114e11ea89_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:992
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 2.1MB
- SHA256 f3f2b47ced2deb4f67434812069684b8c5beaaec19e320787ee206f7da4f4850
- MD5 557980819b25095488fa2c17a22c157d
- SHA1 3b6ee0d0687c0b79cbd6d8f4aeb37d98be84e268
- SHA512 9af47c805332829f8be33089744374b465f39046fbea35e774d4dfb6df771d16c6f708c2289998df3dac03cdfa3a7eacd2b48913143659c2dc347be0617f18e9
- SSDEEP 24576:jxb3BGdx5tul2Mf5qmT6ZaewsAjVa7/ezSC6vUyD/aqgrvWx6q8wyuG:jxDB2E2Mf5qCzljc/ezSC6vUzPvMHjyd
- TLSH T18EA54B21F678C233D0B3C0B6C9E6A769F97634424B3089CB5349976C2E376D1963673A
- MD5 SHA1 SHA512 SSDEEP TLSH