Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 01:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 15.0MB
- Sample260802-bswfxabl6s
- SHA256 f007de2b145b2d0d121dff33034e608dea8a787af7802dc73d62cd2dea6c03ae
- MD5 072fd96411d81c766130ddfcc19a1de7
- SHA1 326f5fa98c64f6743b0e53ab33b0d999b374b19e
- SHA512 3fddd29b52832de7893f1d3601a979c924ea1d8ff47ff2841f175f453944f8ade1c71484132b85f52a170f297228e89fbb5ed7d771cc9afc5aa78f108afb4ffa
- SSDEEP 196608:PdEPt2S9+ULdNPtbuPZOOmnqogHh/OoieGZF6bUpMBF1p/kjRm4OWi2ba:k2SlLdNPt6ROOmqZ3aIbUwF1VERmj2ba
- TLSH T10CF6011EFBA44272D0778176C8A6A756E971F01597308BCB1388972DBF326C35E36362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\srdelayed.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\chcp.com 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\doskey.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\expand.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\tar.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\label.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\reg.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sudo.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\netsh.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sc.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sethc.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-user-choice-protection_31bf3856ad364e35_10.0.26100.1591_none_40b544c10dfa1d6f\UCPDMgr.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.26100.1150_none_dad1c69b80d09caa\r\CloudExperienceHostBroker.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.26100.1591_none_02ccdf13e86dfcfe\r\RemoteAppLifetimeManager.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2177acc33f68854a\IMESEARCH.EXE- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\uwfservicingscr.scr- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-bootexp_31bf3856ad364e35_10.0.26100.1150_none_6548a7f0b3a3e4e1\BootExpCfg.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_bc36ad3cb5eb132d\r\wermgr.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevAppMonitor.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audit-component_31bf3856ad364e35_10.0.26100.1_none_a3abe7a4df6b292a\audit.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.26100.1301_none_6b46da31a1bd9a38\r\DmOmaCpMo.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\spoolsvworker.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.26100.1_none_ffc7c01130849273\shutdown.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.26100.1591_none_9d960bc9bb2901f9\r\rdpclip.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.26100.1150_none_2cf483fafd109e7e\TrustedInstaller.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\show_third_party_software_licenses.bat- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\ie4uinit.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.1150_none_723216da827602dd\mmgaserver.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_b56d38775a1eaac9\r\mmc.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-more_31bf3856ad364e35_10.0.26100.1_none_b3a2a31db5fc0bbd\more.com- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.26100.1_none_6a91f0bc88e36d4b\Register-CimProvider.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_ee7cf88ee4c18aba\cscript.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\WUDFHost.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ne-plugins-wireless_31bf3856ad364e35_10.0.26100.1591_none_b99784523fc95a77\BypassNRO.cmd- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_dea5c51b861cb734\powershell_ise.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\SyncAppvPublishingServer.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\ImagingDevices.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.26100.1_none_9f7bcd3ea63a7384\grpconv.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.1150_none_723216da827602dd\r\mmgaserver.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\r\pnputil.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.26100.1150_none_8d8407dd0453280e\bdechangepin.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\r\RdpSaProxy.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.26100.1150_none_5418e1dbd4f45309\r\telnet.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.146_none_57dbe416963fa154\ilasm.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_783b330506082901\backgroundTaskHost.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_667b1b04bd3f5cbc\r\CredentialUIBroker.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.26100.1591_none_300773bc06dfa2f0\r\NarratorQuickStart.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_c6fec8639b4d0909\r\sfc.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winhstb_31bf3856ad364e35_10.0.26100.1_none_304e610ba6542e51\winhlp32.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\audiodg.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.26100.1591_none_9c7590519bc81879\r\vfpctrl.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.26100.1591_none_a93e455bb3388085\msoobe.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..agespaces-spaceutil_31bf3856ad364e35_10.0.26100.1591_none_782468f07f32b467\r\spaceutil.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.26100.1_none_8c35e9ae895560fc\wkspbroker.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\r\hvc.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.26100.1591_none_269260d4786a1186\wpnpinst.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\SnapLauncherProtocol.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.26100.1591_none_d4e57f099acc84e0\appidtel.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\mode.com- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-format_31bf3856ad364e35_10.0.26100.1_none_237c8b12f2862d5e\format.com- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\Mystify.scr- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_7da6e7654a833d6c\r\PeopleExperienceHost.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_6c3a7829113ddd25\rasdial.exe- 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_072fd96411d81c766130ddfcc19a1de7_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 16.0MB
- SHA256 b3af02daad8a89fb3e453e5e46f65a77369e71480f6b8c05209a42f662a709f2
- MD5 d35c9c470114c08dd268fc7d9ea78ceb
- SHA1 6d06c936a592663fe3af1d1856529d847cb6f275
- SHA512 c20498d5567c913bc5ced386842eb979f7edb3913d78e2c9dafbb3824cb41ff0cf4f6cb1714861885e3fdc9e14153c5cc7a414cbb03551f6a0dd2b2b332a4b32
- SSDEEP 196608:PdEPt2S9+ULdNPtbuPZOOmnqogHh/OoieGZF6bUpMBF1p/kjRm4OWi2bYv:k2SlLdNPt6ROOmqZ3aIbUwF1VERmj2bS
- TLSH T1F9F6E01EF7688272D077C076C4A6A656F972F04597308ACB0389972C7F326D39E36366
- MD5 SHA1 SHA512 SSDEEP TLSH