Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 14:55
Behavioral task
behavioral1
Sample
2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
- Size 11.7MB
- Sample260809-salmestsc1
- SHA256 96ce31ee2f913b792edd180d599a7c8ff410a6b9313518fa8e038bc4363ca311
- MD5 1055eaa879ffbe09b4c97113c8f77b55
- SHA1 412f4e7724ed0e270e489e78b646ccfe7a220dd1
- SHA512 f41c99c863d119e3f41340c52c28c9a89a471accc0aab4a7f5f1b53a760ce1bf1c9a42792dacec5ec0351d80a9ee972ea0543c3951030858202d949d623bd355
- SSDEEP 98304:OfkcsrRokEmZgxK8mzNKUgTH2M2m9UMpu1QfLczqssnKSs:Sk2w5vgTH2qBpu1QfLIqsufs
- TLSH T134C6081265B9DE99E16FB4F0CD45A5A01D2B3C454E627BEB35ACBE293B321A05F3010F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\tree.com 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\autoconv.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\chcp.com- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mshta.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\msra.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\printui.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wextract.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\choice.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\findstr.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\bootcfg.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe -
resource yara_rule behavioral1/memory/4576-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0005000000021bf7-5.dat upx behavioral1/memory/4576-460-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4576-3216-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\7-Zip\7z.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\f\logman.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\f\InputApp\TextInputHost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1_none_f03957c94950f5c5\raserver.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\r\licensingdiag.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\AxInstUI.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systray_31bf3856ad364e35_10.0.19041.1_none_a9428a56956799d8\systray.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_multimedia-windows-..n-playready-desktop_31bf3856ad364e35_10.0.19041.1_none_ef166e795b249cbd\prproc.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1081_none_e34aea343fc255b7\_isdel.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.1202_none_42d3a7d52bcb0f8d\r\WorkFolders.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_f0e6f722ec2403d4\f\rrinstaller.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\x86_netfx35linq-csharp_31bf3856ad364e35_10.0.19041.1_none_70fe2109fb29ee11\csc.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\lpremove.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\r\SpeechModelDownload.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\ApplyTrustOffline.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.19041.746_none_428efbd28b482d1c\f\bdeunlock.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\e374984536e5d701109b00001815341f.iisrstas.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.153_none_dbdeec75cdd2a4d1\r\DataUsageLiveTileTask.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\explorer.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\bfsvc.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\r\autoconv.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.1288_none_e25de9f9d964cdad\r\conhost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\r\directxdatabaseupdater.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.1_none_37f2e74a0020dc93\pcaui.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.19041.1_none_70aae5f3051c8851\RdpSaUacHelper.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasdial.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_30274b64fe158ec9\sxstrace.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\winhlp32.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.1_none_c8deb9da2cb2458a\rrinstaller.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\r\wpr.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.423_none_c3eac275ecdf7e0a\f\NgcIso.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\rwinsta.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVDllSurrogate.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\f\dmcertinst.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_1d38815769c81e5a\r\dllhost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\powershell.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_94cfabd8a89f0b96\runonce.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\securekernel.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.19041.1_none_0220120c9d66a59c\dcdiag.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\gpresult.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\icsunattend.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\SearchFilterHost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevAppMonitor.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\r\wpnpinst.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.1202_none_e17f082b30dd9027\r\wifitask.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\f\Taskmgr.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\r\Microsoft.AsyncTextService.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_e2f3aaf24de135ec\f\Magnify.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\r\Magnify.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-write_31bf3856ad364e35_10.0.19041.1_none_1573dfb37c7563ca\write.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_b4441130315b5f1f\r\mmgaserver.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.1_none_f0c3a71562899181\sessionmsg.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\r\XblGameSaveTask.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.19041.1_none_fce141858c5d7f03\IMEWDBLD.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\r\msinfo32.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-slidetoshutdown_31bf3856ad364e35_10.0.19041.1_none_4a1699e73b1ad297\SlideToShutDown.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.19041.1_none_e341aee7030e39c4\MigRegDB.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\f\UpdateNotificationMgr.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_4621ad58d5f654dd\f\Robocopy.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\f\SpeechRuntime.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.153_none_dbdeec75cdd2a4d1\DataUsageLiveTileTask.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.84_none_f9792ddb393f9467\rdpclip.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\windeploy.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4576
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 12.2MB
- SHA256 ebd3551703d5112b718611a307f5109a4c567e46585b2b2b48db364204a31c34
- MD5 4e41ace482aad86520f69578e4f032c7
- SHA1 dfe8fa3d390b5173a61b0e2b28db2241c48cbd7d
- SHA512 39509019a7b834098cba2da0e4478199a04dbfb67c041af7dfbdb704423bb8bf2541018ae028a01ce1f64b388a25d50efae5cdbac1c27a58810147abcd6523bd
- SSDEEP 98304:OfkcsrRokEmZgxK8mzNKUgTH2M2m9UMpu1QfLczqssnKSMjot:Sk2w5vgTH2qBpu1QfLIqsufGot
- TLSH T13ED6081265B5DEA9E16FB4F0CD45A5A01D2B3C454F627BEB35ACBE293B321A05E3010F
- MD5 SHA1 SHA512 SSDEEP TLSH