Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 15:12
Behavioral task
behavioral1
Sample
2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
- Size 14.0MB
- Sample260423-sllfssf16q
- SHA256 36024b56feec4f54480e3a0146a6a91ac1dd54f430eed2f7460cbdac8287514a
- MD5 8db0feafa40fcc23b4eb2063613717a3
- SHA1 1ffc01d0f350ee526711aae327451108c6515615
- SHA512 4a3a5c07cb57401fb6fa6cbbd7db7aece9d07909525d05452f02da772d84200b292f3598e3eeb7d32eac649b2f117255bf93ded2182e7189d0ffebdb27c9ef78
- SSDEEP 196608:qBnvjeApaAvkttpKHKplRnLjGuVt8rUNExHOAoXvvOD:qNvjtIAvkcHKp5VUU+OTK
- TLSH T10EE6BF1FF3A440A1C16282348A4AA326E771FD154B30978F67949B5E2FB77E29E3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\WWAHost.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mode.com- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\more.com- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\proquota.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\psr.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\write.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\sc.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\user.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\sort.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wscript.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\msdt.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe -
resource yara_rule behavioral2/memory/1040-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001e00000002b18c-5.dat upx behavioral2/memory/1040-538-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1040-3178-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\7-Zip\7z.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.22000.71_none_c9fbc04eb075be36\r\securekernel.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.493_none_6ec3ffab3ec4b07b\f\LaunchWinApp.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_037bca9e287fff5c\r\quickassist.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systray_31bf3856ad364e35_10.0.22000.1_none_53e9c4cb2f33e8c8\systray.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.15806.0_none_429ccfc4db8d3d44\AddInProcess32.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.493_none_157ddf72a65679bf\f\sppsvc.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\systemreset.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\f\SyncAppvPublishingServer.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_334ea48b976d3bd3\CHXSmartScreen.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.22000.1_none_c0a088f7530491ea\browser_broker.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.22000.1_none_c387d4076254e4a3\cleanmgr.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.22000.434_none_fc228ebcd84d69db\r\repadmin.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_f8757a3e115338fd\f\Microsoft.ECApp.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.1_none_779cfeaf71418a8c\lpksetup.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.282_none_3891f56e17aabe62\lsass.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.22000.318_none_47eee9eaf8f3237f\ntkrla57.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.22000.120_none_f090fec284d5941b\pcwrun.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_5b46b110e29f5b31\r\runas.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_10.0.22000.1_none_25ce9c834430edf8\snmptrap.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.348_none_8c1cd5f65f938380\DataStoreCacheDumpTool.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_b61f094deaec819e\f\RdpSaUacHelper.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.22000.71_none_c26272ecb066f6ab\r\ByteCodeGenerator.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.22000.318_none_fbf48b4fce07c440\tcblaunch.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.22000.1_none_3b4f9cda237a17ee\ChsIME.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.469_none_160103e31c4d8d88\r\SystemSettings.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.434_none_38ca096a17805fa9\r\lsass.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.22000.1_none_7f6d0f07b0ce31f2\quser.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.22000.120_none_0b04aa9dcb2db938\r\CredDialogHost.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.22000.1_none_91ac9ca5e0bd52f1\gpupdate.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.22000.1_none_81f1372fe02ff0d7\printfilterpipelinesvc.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.22000.1_none_f159656ce5b94cb8\rmttpmvscmgrsvr.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.22000.282_none_6ae954e75a4dd338\winlogon.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.22000.1_none_af37ae793d4cfdf0\xwizard.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.22000.282_none_85f8b97e4dbf9185\f\wpnpinst.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.22000.1_none_2ba66e4a445cef6c\eventcreate.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.22000.1_none_91ac9ca5e0bd52f1\gpresult.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_688486d306b27285\msinfo32.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.22000.120_none_842c9d9e843cf6c7\r\ISM.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.22000.434_none_e6157b76b496d682\r\refsutil.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.22000.1_none_6744583bcc1cfbb4\aspnet_regiis.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.22000.1_none_5640d9ef21678ad0\ssh-keyscan.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_f9601eae71d90785\f\TpmTool.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.434_none_986ff8587a758e7c\r\WUDFCompanionHost.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\lpremove.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.22000.1_none_b8e76ca03e65a2b6\cacls.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_349d8ac96fe3d679\appidtel.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.22000.469_none_ddccf236be43e7c9\r\memtest.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\msra.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_a883bf3f9432d43e\TiFileFetcher.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.100_none_f82676266a17f522\ApplySettingsTemplateCatalog.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.348_none_e2c7a9ab59285812\f\LockApp.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.22000.100_none_b998a9a728d6401f\r\Narrator.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.22000.1_none_58ed24a5c85940dc\sapisvr.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\MiniSearchHost.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.318_none_aa689c124bcde8ee\CheckNetIsolation.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.22000.1_none_aa19bcc4bf43b810\msiexec.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe- 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_8db0feafa40fcc23b4eb2063613717a3_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1040
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 14.6MB
- SHA256 bc1c37fb52d23bd3fdb70ff1fd2d43d48d44ad58a8649ba4e83dc188f822e8ca
- MD5 c73e32966088a8cfde36f87e2572101f
- SHA1 8deecc55f838c08b1838174b8c50d0d2e05fc55c
- SHA512 f3815829dbbfd60abd40fb38ec6330f42fb1182411b826d74954cea42dbe86efcdb7a1a3fee4356c50a144bc998e55c41d0863982737429a32b03f300264d1cf
- SSDEEP 196608:qBnvjeApaAvkttpKHKplRnLjGuVt8rUNExHOAoXvvOvoG:qNvjtIAvkcHKp5VUU+OT/G
- TLSH T17AF6AE1FF3A440A1C162C234CA86A326E771BD554B30978F62949B5E2F777E29E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH