Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 11:46
Behavioral task
behavioral1
Sample
2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
- Size 16.7MB
- Sample260506-nxd4msg17z
- SHA256 ea3ff1a3d123107d90607c226674c6bf4aea3d8dd9b685ddd03be4b59e359a6d
- MD5 ab699549d2d4067ce3ed455f3cef0f3b
- SHA1 7ddbf052ec9601c9e3d1312ae50a939972946d0b
- SHA512 0e12f7773d2977f8db714213ac4b38232d665e23d0bc2b8685aeb50396e0fcfe1ed9836b509bbcfdeb3235a7e45a0234965675a09724ba4947a48a43b3b05513
- SSDEEP 196608:qBnvjeApaAvkttpKHKplRnLjGuVt8rUNEGjrOOwH+vQoJ:qNvjtIAvkcHKp5VUUHjrOB+XJ
- TLSH T178076C12B2D48BE5C05FC130CE4662B69A337C554F209FCB5A847F293E766A19A3931F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\iscsicli.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\calc.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\runas.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\format.com 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\printui.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\finger.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wextract.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\where.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cttune.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\doskey.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\curl.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe -
resource yara_rule behavioral2/memory/460-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001300000002ad60-5.dat upx behavioral2/memory/460-424-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/460-3178-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E2505FBD-4E5B-4F5E-BD9E-BA50A6579E34}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.22000.51_none_2158495b1874d95c\f\services.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\SyncAppvPublishingServer.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.120_none_4d19d7f0fee9ee87\f\explorer.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.22000.1_none_da2a87582afb2453\UserOOBEBroker.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\audit.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.22000.1_none_9e1105ca4c207d1b\pacjsworker.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.22000.100_none_bac6834bfb16b20d\SecurityHealthSystray.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.22000.1_none_3038f7c9577f0d5f\AtBroker.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.469_none_82154d2009b8e727\f\MoUsoCoreWorker.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.22000.1_none_22c39620f56d14c6\wiawow64.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_10.0.22000.1_none_44a70e6efc29ec4e\WMPDMC.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.22000.1_none_227ea1d8c5da52fb\chkdsk.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.22000.1_none_cfdf17c0e1db180b\rasphone.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.22000.1_none_90cfdfd0a3fa1534\IMEPADSV.EXE- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_e83cf4fa7871c56f\PkgMgr.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.22000.1_none_53a76037c15099de\pnputil.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.318_none_15d95e5ea6111bc3\f\sppsvc.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_9ed8cb052ff869e6\f\TokenBrokerCookies.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.22000.1_none_0290e7ede64d11aa\PasswordOnWakeSettingFlyout.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\r\MsSense.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.22000.434_none_a003f3391feff8a5\f\repadmin.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.120_none_4d19d7f0fee9ee87\r\explorer.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.22000.1_none_c5b187e40e57e8e5\fsquirt.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.22000.1_none_5ba5eadfaddccaf4\wecutil.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_10.0.22000.1_none_d094352fcb43807d\InstallUtil.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.22000.1_none_adc9f4fa8fe1731e\BitLockerWizard.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.1_none_161d4fe56c866837\certutil.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.22000.1_none_c35886f1ae4523bc\EaseOfAccessDialog.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_935f3ba28807f81e\ARP.EXE- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.22000.1_none_8289edcdf2ad65a4\cvtres.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4dda7ffaba1d5c31\f\cscript.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.22000.1_none_bd5081933d30392a\RemoteAppLifetimeManager.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.22000.120_none_05dfd9bc9f8bc6b6\f\Win32WebViewHost.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.22000.434_none_79ca17dba25cd0c9\f\curl.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.22000.71_none_eba5201bcfa1aa33\f\licensingdiag.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.22000.1_none_b5447a0b77a5213f\MdmDiagnosticsTool.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.22000.1_none_544784bd2f04ca1d\SensorDataService.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.22000.1_none_273376f0ac357a69\WinRTNetMUAHostServer.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.22000.1_none_b2bfe436fa0c3b50\CCG.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.22000.1_none_f159656ce5b94cb8\tpmvscmgrsvr.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_4902a165a673e741\mstsc.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.22000.434_none_ae734c6bf20696b6\f\djoin.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\f\ScreenClippingHost.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.318_none_7fdfd2b2e06a7af9\r\nvspinfo.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.22000.1_none_ffcf293574d7aaf5\iissetup.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_b7671877039e31c8\logman.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\sdchange.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.132_none_e66ce03b0132db6b\r\systemreset.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.22000.1_none_0f97a0bb2461b363\unsecapp.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.22000.282_none_f57e785f37294fe2\f\ntprint.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.22000.348_none_53ff6ed560767984\r\mighost.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.22000.1_none_66a65c31902e1d37\WmiPrvSE.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_fca20623da1dc57b\resmon.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.22000.1_none_389d9987e414684f\rundll32.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\f\SearchIndexer.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.22000.282_none_eb29ce0d02c88de7\ntprint.exe- 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_ab699549d2d4067ce3ed455f3cef0f3b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 17.2MB
- SHA256 2d6a5a3ec667ff1b69e1341b3f830dac8b11d844b66ceaec6f5274d43ebacd26
- MD5 99a18a41e0e9bf4302e0840f8ca38f0e
- SHA1 0fa36f0f3e963162f4c725f718d7b25ddaf1b85c
- SHA512 186d38cc9160c59bf6d1894a40928f10746b9f491d64016ede804f0acfc25021d23da503aa8331a38541b89bb57281edb1e83982593858bd32fe6212901b962e
- SSDEEP 196608:qBnvjeApaAvkttpKHKplRnLjGuVt8rUNEGjrOOwH+vQoZoO:qNvjtIAvkcHKp5VUUHjrOB+X2O
- TLSH T177076C12B6D48BA5C05FC130C94662B69A337C454F309FCB5A84BF293E766E19A3931F
- MD5 SHA1 SHA512 SSDEEP TLSH