Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 04:34
Behavioral task
behavioral1
Sample
2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 14.0MB
- Sample260905-e7ey9awhnc
- SHA256 b41ca8ab08de3bae964279fba2fa011522ff949e04018d96d75f63faac68a5a9
- MD5 87895620c488ed685db8ac0ac6d1a40e
- SHA1 f151997ccea1182fcf127c2fec1fa195e3321c35
- SHA512 2bafa9f286a79886cb48adfcc2ef2cd32ece0b54950367308dd09152be5c8ccfd04a88b2c66565c77c778a0578388b73693fb83dc24f6e614d4f9a0aeed6308a
- SSDEEP 196608:vDO2S9+ULdNPtbuPZOOmnqogHh/kgTH2qBpu1QfLIqsufMCo4:i2SlLdNPt6ROOmqZxTHNBpu1Qfc0W4
- TLSH T1BAE68C15A6D58FECC05F9074CD4666A1AA23BC418F209FDF1680BF297E362E25E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\raserver.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\print.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\clip.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dialer.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mmc.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\logagent.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\calc.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\convert.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\getmac.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\relog.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\win32calc.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winver.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\certutil.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fc.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral2/memory/4836-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000e00000001c562-5.dat upx behavioral2/memory/4836-404-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4836-2909-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\r\ctfmon.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\r\mofcomp.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.15912.0_none_447f4612d8b724d2\AddInProcess32.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.27000.360_none_eb22a7e4bb95e7f1\aspnet_regsql.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_47a47970066d8602\r\msdt.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.26100.1150_none_a875b50b457475fd\r\bootsect.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.26100.1591_none_5d054cd1bd51eff3\DeviceEnroller.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\mode.com- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\tpmvscmgr.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\r\UNPUXHost.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\r\LaunchTM.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_7b25a93731217002\r\sdbinst.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.26100.1_none_db738856a624fee8\help.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Speech\Common\sapisvr.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.26100.1591_none_d5752f789b3d8f3a\r\dmcertinst.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\print.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmpshare.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\typeperf.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_d64c3d514f37d908\r\IMEPADSV.EXE- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mschedexe_31bf3856ad364e35_10.0.26100.1_none_dc91fd1f1af84c4d\MSchedExe.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.26100.1150_none_713524eb211332eb\ReAgentc.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\EaseOfAccessDialog.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\wbengine.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1591_none_ad4f10ed27892462\TabTip.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.26100.1_none_4db4eeca2cb94664\IEExec.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.26100.1_none_2d8ad328b5479b73\AddInProcess.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDlpService.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dstore-schema-shell_31bf3856ad364e35_10.0.26100.1150_none_2fc55246563e15a2\readCloudDataSettings.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.26100.1150_none_d519484bd1dd0a29\inetinfo.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\WebExperienceHostApp.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.26100.1150_none_22d7b78874fa20b2\AppHostRegistrationVerifier.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1_none_0c53e49062af0dd7\SystemUWPLauncher.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_773b7b96c37cb0e9\DpiScaling.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\wuauclt.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\DlpUserAgent.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-expand_31bf3856ad364e35_10.0.26100.1_none_5fbacf2ef4cdcd88\expand.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_e1bbfdf0b2054cc5\iscsicli.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_4fd441a3f30753ec\find.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\SpatialAudioLicenseSrv.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.26100.1_none_60a5ff2e85104e26\SystemPropertiesProtection.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.26100.1150_none_aed4fccd3d3ea792\r\rrinstaller.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.712_none_1b914f4a8d4789f2\notepad.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1_none_d1adc81249f528d5\winrm.cmd- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1_none_50f771e4b4a3c0ee\win32calc.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.26100.1591_none_052b2ae1ad719889\FileExplorer.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\tracerpt.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiFileFetcher.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\unsecapp.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\SearchHost.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_5b99ad6617c42c0b\certutil.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.26100.1_none_73dcd67238fcc679\InfDefaultInstall.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.26100.1591_none_461a2040b9fd2031\FaceFodUninstaller.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-sk-helper.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\splwow64.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe- 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_87895620c488ed685db8ac0ac6d1a40e_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4836
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 14.9MB
- SHA256 7c8ea777bcdc5268bf09e5bedb76feb0de5d6eb80b873bbd187033bc0a91d64a
- MD5 9aef16df9574525c368fbe14b4ab4ff0
- SHA1 132a0bc80cda3066975aed339cdf4223133107c5
- SHA512 391579a5ef75bd02c5bef3d01533c68df31a2389a70dd7ffb754313a67da82b2e8624c50411bf8edf97e28d451677449b440367350e1e7f0be661eeaccd75462
- SSDEEP 196608:vDO2S9+ULdNPtbuPZOOmnqogHh/kgTH2qBpu1QfLIqsufMCo+g:i2SlLdNPt6ROOmqZxTHNBpu1Qfc0WL
- TLSH T18BF66C15A6D98FA9C05FD074CD4666A1EA33BC418F209FDB0684BF283E366E15E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH