Analysis
- max time kernel
149s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 15:12
Behavioral task
behavioral1
Sample
2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
- Size 14.0MB
- Sample260423-sllfssf16q
- SHA256 36024b56feec4f54480e3a0146a6a91ac1dd54f430eed2f7460cbdac8287514a
- MD5 8db0feafa40fcc23b4eb2063613717a3
- SHA1 1ffc01d0f350ee526711aae327451108c6515615
- SHA512 4a3a5c07cb57401fb6fa6cbbd7db7aece9d07909525d05452f02da772d84200b292f3598e3eeb7d32eac649b2f117255bf93ded2182e7189d0ffebdb27c9ef78
- SSDEEP 196608:qBnvjeApaAvkttpKHKplRnLjGuVt8rUNExHOAoXvvOD:qNvjtIAvkcHKp5VUU+OTK
- TLSH T10EE6BF1FF3A440A1C16282348A4AA326E771FD154B30978F67949B5E2FB77E29E3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\setup16.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\instnm.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wusa.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\calc.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\msdt.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\bootcfg.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\chcp.com 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\comp.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\takeown.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\control.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\convert.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mshta.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\findstr.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\help.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe -
resource yara_rule behavioral1/memory/860-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000800000002425d-5.dat upx behavioral1/memory/860-540-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/860-3200-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\dotnet\dotnet.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\f\SystemSettings.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\isoburn.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.19041.1_none_1a96c19044750bbf\BdeUISrv.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_510ebdd9292eed06\diskpart.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_4d40b8e902f83dd6\r\gpscript.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\f\hvax64.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mschedexe_31bf3856ad364e35_10.0.19041.1_none_958f624251c93843\MSchedExe.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_3d198a3dbf54d1b4\cmstp.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\tsdiscon.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver_31bf3856ad364e35_10.0.19041.1_none_6c428bc03bd6600a\winver.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\f\sethc.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_fefa067e67e7af8b\UserAccountBroker.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.1_none_aa1fc2e87b362d12\regedit.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_ffd303094ff1fe66\auditpol.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.19041.1_none_407b1fa0f7dce496\RmClient.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\r\lpksetup.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.1_none_a13199bb61665e9a\logagent.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.19041.1_none_3626754ec37c229b\RmClient.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.746_none_18cbe45e21fb4fcb\r\sessionmsg.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.19041.1_none_ba3fa9706f28b589\dplaysvr.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.867_none_099246ae3a45708c\f\printfilterpipelinesvc.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.844_none_95c651508e565d13\r\provtool.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_ccf6cb6d0aa9a822\mstsc.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.1_none_8b021141ec175d3e\sdbinst.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.867_none_b4e9fc09cfcbdd7c\r\AxInstUI.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.153_none_70cb6ca43c818606\cmdiag.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.153_none_59d1094dec9b8480\f\Spectrum.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1_none_a239a51f957f6b65\autochk.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-makecab_31bf3856ad364e35_10.0.19041.207_none_d949ad80fc4d976e\makecab.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1_none_e4c1e71455c2721c\appidtel.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1202_none_c26e06f4b82585b5\r\dmclient.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.746_none_64e9b1de23df7cf4\AppHostRegistrationVerifier.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.19041.1_none_da90d957e87f3409\ImagingDevices.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.19041.1_none_30033f434a10c03b\UIMgrBroker.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.844_none_ef8661e4d6535c5c\r\TabTip.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.19041.1_none_233b627ec80a87f1\xcopy.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.1_none_4005191f803b56e1\isoburn.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\r\icsunattend.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\a60e034236e5d701ed9600001815341f.ShellLauncherConfig.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\r\conhost.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.19041.1151_none_21b291c4f7bdb6e0\nfsclnt.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\f\tracerpt.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.19041.1_none_69f4af04dd2c1f80\lpr.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\StartMenuExperienceHost.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_4.0.15805.0_none_4534bcdd53211170\RegSvcs.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVStreamingUX.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\f\dxgiadaptercache.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\f\ShellLauncherConfig.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_f3894559140c31d7\f\imjpuexc.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.153_none_3c9b504ec5293ad0\r\WpcTok.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\lpremove.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\f\winload.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.19041.388_none_57e235d809a12c5b\r\UIMgrBroker.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_c47fb20821633815\imecfmui.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.117_none_610933d42d963a44\wsl.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.19041.1_none_bf4cc5bb201caae3\powercfg.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 14.6MB
- SHA256 bc1c37fb52d23bd3fdb70ff1fd2d43d48d44ad58a8649ba4e83dc188f822e8ca
- MD5 c73e32966088a8cfde36f87e2572101f
- SHA1 8deecc55f838c08b1838174b8c50d0d2e05fc55c
- SHA512 f3815829dbbfd60abd40fb38ec6330f42fb1182411b826d74954cea42dbe86efcdb7a1a3fee4356c50a144bc998e55c41d0863982737429a32b03f300264d1cf
- SSDEEP 196608:qBnvjeApaAvkttpKHKplRnLjGuVt8rUNExHOAoXvvOvoG:qNvjtIAvkcHKp5VUU+OT/G
- TLSH T17AF6AE1FF3A440A1C162C234CA86A326E771BD554B30978F62949B5E2F777E29E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH