Analysis
- max time kernel
149s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/05/2026, 12:19
Behavioral task
behavioral1
Sample
2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
- Size 11.5MB
- Sample260506-phktbaas9t
- SHA256 b20c03845c0ae0794419bcf55b838ca6101e700237847e7e4d8d684fd6d41c38
- MD5 f5e587c5f8b751766a160c825509524f
- SHA1 04466f76d3b7671b7a0781c09758a40ba162850c
- SHA512 cf880ffb415a22da3eb567fa7796428214df9a37409fa8daefbb840243c0c5df4615f3631c6ebe36186262bea9b39c891d232dcdde31956a8ab3b092fdbebf88
- SSDEEP 98304:p9pwNaHKUgTH2M2m9UMpu1QfLczqssnKSN/PvOAjcXvvOOc5d:pz1gTH2qBpu1QfLIqsufxHOAoXvvOV
- TLSH T1D6C6281962D98ED8D06FD474CE06A5A1E633BC418F209BDF19807F293E766E05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\chkdsk.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\more.com 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\replace.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\fc.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\notepad.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\autofmt.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\print.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\psr.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\sort.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\expand.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe -
resource yara_rule behavioral1/memory/1552-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000f000000024189-5.dat upx behavioral1/memory/1552-508-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1552-3196-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\7-Zip\7z.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_c47fb20821633815\f\imecfmui.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.19041.1_none_af9a68f0cc4d15fb\systeminfo.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_9613f8b833f2e8f1\ByteCodeGenerator.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.19041.844_none_93c03ca99a47dc8f\f\omadmprc.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\tpmvscmgrsvr.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\ScriptRunner.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\WMIADAP.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_30274b64fe158ec9\f\sxstrace.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.423_none_0b0196a3d38fda4e\r\OOBENetworkConnectionFlow.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\r\ofdeploy.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_38869341091832be\WMIADAP.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_64cb20c6329bf2bd\ntprint.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\r\Microsoft.AAD.BrokerPlugin.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1_none_6df323382219b604\PickerHost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_cdf422107d2779cf\f\cttunesvr.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.19041.1_none_05325e2f9f9e6b0a\ldp.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.19041.1_none_e8e077950faced1a\fodhelper.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\f\hvsimgr.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.1_none_37f2e74a0020dc93\pcaui.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_4eec2752c7ea16f8\f\backgroundTaskHost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_cdf422107d2779cf\r\cttunesvr.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_8fc08423f52c1606\wmlaunch.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.19041.1_none_ffa61ab82b82ecca\Fondue.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\ProximityUxHost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regini_31bf3856ad364e35_10.0.19041.1_none_c24749f2592e69f9\regini.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_edd345b6c42269da\f\rasautou.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\f\BitLockerWizardElev.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\TSTheme.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..vercommandlinetools_31bf3856ad364e35_10.0.19041.1_none_70349c6644208282\flattemp.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\f\SearchProtocolHost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\f2329d4736e5d7010ba200001815341f.iissetup.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_f786fa028426f858\r\fltMC.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.19041.746_none_e7acb2599054dc72\WSCollect.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.19041.1_none_13c446a37d881982\where.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmcreate_31bf3856ad364e35_10.0.19041.1_none_8d387dde0a6c6d14\VMCreate.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_650ebab5a8c02ffc\autofmt.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.746_none_48b2bd808a742e25\f\netbtugc.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_2cd9cc4237e09b91\r\PickerHost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\r\TSTheme.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_8a469514405342ff\f\PasswordOnWakeSettingFlyout.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15805.0_none_ae80a3049486a75f\EdmGen.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.1_none_eadb9d8875f59863\dllhost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_8fc08423f52c1606\r\wmlaunch.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\typeperf.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\r\AuditShD.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_e20a2c618eea3856\agentactivationruntimestarter.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_dbe4ac1121d6e6d7\f\CertEnrollCtrl.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.1_none_8b021141ec175d3e\sdbinst.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\r\winload.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_228521f0037fd996\PickerHost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\r\ResetEngine.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_b93dce693a9c6db9\WinRTNetMUAHostServer.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.19041.423_none_61b0f600375d52e3\UserAccountControlSettings.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\r\upnpcont.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_10.0.19041.1_none_7c4b8c980a524548\ilasm.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.19041.1_none_da504d0e6afd0a49\TsWpfWrp.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_5aba1063745f6e01\f\autofmt.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.867_none_b4e9fc09cfcbdd7c\AxInstUI.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1552
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 12.0MB
- SHA256 7711f02a53c4c0413ad9228aa6d160a09f4e5dd25313778cbae9a052944bb7f0
- MD5 071ef363c9d2a1e7dda385edd5c831e2
- SHA1 68256fd923c70824dc15e41610baf413711f3ccb
- SHA512 eb04a1e1db08fe8488afd751293fab115a5bb5735f187e5f0e0baea115d25c85da4c4b044107ae93b30725d01378b085221e28762f2aec4f3dbf403bce6ef6ec
- SSDEEP 98304:p9pwNaHKUgTH2M2m9UMpu1QfLczqssnKSN/PvOAjcXvvOOc5Zjoe:pz1gTH2qBpu1QfLIqsufxHOAoXvvO1oe
- TLSH T128D6281962D98F98C06FD474CE46A5A1E633BC418F209BDF1580BF293E766E05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH