Analysis
- max time kernel
149s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 12:19
Behavioral task
behavioral1
Sample
2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
- Size 11.5MB
- Sample260506-phktbaas9t
- SHA256 b20c03845c0ae0794419bcf55b838ca6101e700237847e7e4d8d684fd6d41c38
- MD5 f5e587c5f8b751766a160c825509524f
- SHA1 04466f76d3b7671b7a0781c09758a40ba162850c
- SHA512 cf880ffb415a22da3eb567fa7796428214df9a37409fa8daefbb840243c0c5df4615f3631c6ebe36186262bea9b39c891d232dcdde31956a8ab3b092fdbebf88
- SSDEEP 98304:p9pwNaHKUgTH2M2m9UMpu1QfLczqssnKSN/PvOAjcXvvOOc5d:pz1gTH2qBpu1QfLIqsufxHOAoXvvOV
- TLSH T1D6C6281962D98ED8D06FD474CE06A5A1E633BC418F209BDF19807F293E766E05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\timeout.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cipher.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\printui.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\attrib.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\tree.com- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\control.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\subst.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\clip.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\find.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe -
resource yara_rule behavioral2/memory/1676-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000c00000002ad68-5.dat upx behavioral2/memory/1676-583-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1676-3186-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.22000.1_none_43d2192836b57f90\PackagedCWALauncher.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.493_none_157ddf72a65679bf\f\sppsvc.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\Setup.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\f\SearchFilterHost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.22000.65_none_4f258ec343f09686\r\windeploy.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\MpCmdRun.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.22000.493_none_674ce99b39869941\f\ntoskrnl.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.22000.1_none_8ff8d1f7efffcb66\dmcertinst.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\qprocess.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.258_none_dfe62f4e03f8472a\LsaIso.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.22000.1_none_010c2089229afa0b\fsavailux.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\mode.com- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.22000.1_none_45984ec0fd57e0f5\systeminfo.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.22000.1_none_2b91721a75f25dd8\ReAgentc.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.22000.1_none_4fecf91331b8a2f0\systeminfo.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\tscon.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deploymentcsps_31bf3856ad364e35_10.0.22000.1_none_c453beb1033d669e\deploymentcsphelper.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_6f399112972db672\r\MusNotificationUx.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.22000.1_none_428c3541faeaf85a\autochk.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.22000.1_none_72275dbeb0ac2289\TabTip32.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_263e6ac68ff6695d\MpCmdRun.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.120_none_68fb744ea962915c\r\conhost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.22000.434_none_823a5b3dd9c522d8\f\net1.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.22000.1_none_73c734e8920ab338\LegacyNetUXHost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.469_none_5704c6175ad01b79\Microsoft.AAD.BrokerPlugin.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.22000.1_none_b9334c2faa2133a2\agentactivationruntimestarter.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.348_none_790557e9d75b5a9c\f\SpeechModelDownload.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.22000.469_none_4b2e9fd5814459a0\r\winload.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mschedexe_31bf3856ad364e35_10.0.22000.1_none_35e1f264b734c538\MSchedExe.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-oneoffs-em_31bf3856ad364e35_10.0.22000.318_none_ed2b4c25cc173a5f\n\EM.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\SenseSampleUploader.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.22000.120_none_e2284b7d90c8a180\iexplore.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.22000.100_none_b998a9a728d6401f\f\Narrator.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\r\lpremove.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_da8c01e10676f001\sdbinst.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\PrintDialog\PrintDialog.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.282_none_55f322479d33cb0a\r\VSSVC.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\SearchFilterHost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.22000.1_none_c387d4076254e4a3\cleanmgr.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.22000.37_none_7461fc8593f740b9\f\ApproveChildRequest.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_c24a28fb71aa07c9\Robocopy.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.22000.1_none_2e3f0787886879d3\wbemtest.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.22000.1_none_e0cdafc35d48718b\RmClient.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.22000.376_none_836023902a7c3e20\f\bcdedit.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.22000.1_none_2a83098f66602d2f\wsqmcons.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.348_none_7c4c059b9e36fe85\f\SpatialAudioLicenseSrv.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\SearchFilterHost.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.434_none_b4a3a74a80427a96\f\CheckNetIsolation.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.22000.1_none_404d1be794382b1e\comrepl.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.22000.65_none_99e34b544b7754a7\f\provtool.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\SysResetErr.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.22000.1_none_693149fc921dd27f\rrinstaller.exe- 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_f5e587c5f8b751766a160c825509524f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1676
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 12.0MB
- SHA256 7711f02a53c4c0413ad9228aa6d160a09f4e5dd25313778cbae9a052944bb7f0
- MD5 071ef363c9d2a1e7dda385edd5c831e2
- SHA1 68256fd923c70824dc15e41610baf413711f3ccb
- SHA512 eb04a1e1db08fe8488afd751293fab115a5bb5735f187e5f0e0baea115d25c85da4c4b044107ae93b30725d01378b085221e28762f2aec4f3dbf403bce6ef6ec
- SSDEEP 98304:p9pwNaHKUgTH2M2m9UMpu1QfLczqssnKSN/PvOAjcXvvOOc5Zjoe:pz1gTH2qBpu1QfLIqsufxHOAoXvvO1oe
- TLSH T128D6281962D98F98C06FD474CE46A5A1E633BC418F209BDF1580BF293E766E05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH