Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 14:55
Behavioral task
behavioral1
Sample
2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
- Size 11.7MB
- Sample260809-salmestsc1
- SHA256 96ce31ee2f913b792edd180d599a7c8ff410a6b9313518fa8e038bc4363ca311
- MD5 1055eaa879ffbe09b4c97113c8f77b55
- SHA1 412f4e7724ed0e270e489e78b646ccfe7a220dd1
- SHA512 f41c99c863d119e3f41340c52c28c9a89a471accc0aab4a7f5f1b53a760ce1bf1c9a42792dacec5ec0351d80a9ee972ea0543c3951030858202d949d623bd355
- SSDEEP 98304:OfkcsrRokEmZgxK8mzNKUgTH2M2m9UMpu1QfLczqssnKSs:Sk2w5vgTH2qBpu1QfLIqsufs
- TLSH T134C6081265B9DE99E16FB4F0CD45A5A01D2B3C454E627BEB35ACBE293B321A05F3010F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\odbcconf.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mshta.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cmd.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\net.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\tree.com 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wextract.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\recover.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\printui.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\setx.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\chcp.com 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\instnm.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\attrib.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\findstr.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe -
resource yara_rule behavioral2/memory/1404-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000e00000001c466-5.dat upx behavioral2/memory/1404-404-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1404-2909-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timezone-sync_31bf3856ad364e35_10.0.26100.1591_none_2af0eb0ad05bac33\tzsync.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15912.0_none_ed62602ac24399fc\Microsoft.Workflow.Compiler.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1_none_b53c1c347378366d\setup_wm.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\tracerpt.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\r\ClipDLS.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\r\forfiles.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.26100.1150_none_48c9cd2bf27dfea7\nfsclnt.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6e6a9c2b69241453\hh.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\DeploymentAgent.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.26100.1742_none_8907e35eb88d8d7f\convertvhd.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..auncher-cmdlinetool_31bf3856ad364e35_10.0.26100.1_none_f4339379cb9217a5\pwlauncher.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.26100.1_none_ab6fa072a46b2ede\EdmGen.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\MRINFO.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\r\uwfux.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\ARP.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1_none_d3ac672b8cd9f8b1\fsutil.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_2dc797084143cfaf\r\CloudNotifications.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_321363d9581bd94b\r\RuntimeBroker.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.26100.1150_none_c8dd030624b7f968\r\OOBENetworkConnectionFlow.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.712_none_f5f8369ba361b124\msiexec.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\winhlp32.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.26100.1150_none_dda40d17c682c33c\r\EhStorAuthn.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1150_none_b6d5fc573e6d363a\dccw.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1150_none_4a33ec93078da3bd\sxstrace.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\r\Core\ScreenClippingHost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.26100.1591_none_c6e1de18243de2ea\edpnotify.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_c68b578eea4bd528\r\wermgr.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\SearchProtocolHost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1150_none_1763b5dd5aadd1af\r\dpnsvr.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.26100.1591_none_b94392693d48770c\r\LegacyNetUXHost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.26100.1150_none_3c9a0c46a6db0711\WinMgmt.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_ab188e2525bde8ce\r\mmc.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.26100.1591_none_386f0e150ea90546\r\PrintIsolationHost.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\r\rundll32.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.1150_none_85392e759f939eae\r\RMActivate_isv.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_d0b554d77644b199\r\wowreg32.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.26100.1150_none_d11fa90f43730842\r\rdpsign.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1_none_50fd5fe72912c2cf\Fondue.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\csvde.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\r\ChtIME.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.26100.1150_none_56a128e615a8ea59\r\RdpSaUacHelper.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_13357425571b7ed9\r\OpenWith.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\ctfmon.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\PrintQueueActionCenter.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.CscUnpinTool.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2c59a493cf48778f\msinfo32.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_29b9b764bd0322b9\r\UserAccountControlSettings.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1_none_4f21a8f907d2e489\sxstrace.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.365_none_4e3bd09ff189ac9a\aspnet_wp.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\PrintDialog.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\r\WmsUserAgent.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.26100.1591_none_d4e57f099acc84e0\appidtel.exe- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\TRACERT.EXE- 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_1055eaa879ffbe09b4c97113c8f77b55_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 12.6MB
- SHA256 9da8b523e4fa99041762c5b9a258ee0c5b6ef16b0be427491416fd7a4d5606a9
- MD5 ea0296464bfe427a28c6a17501de4d30
- SHA1 4005f2165b4412b2de14a0110aab0cdc19ed334b
- SHA512 1ba4581492ce1c17aca100c3a937d03ccd23b0f2b55d77ca1fd71d7fff034400e8c3a893db2a3a99b3080e9f8a05a3e12d9d3fd455ed66b2c88c0e5a1baac8cf
- SSDEEP 98304:OfkcsrRokEmZgxK8mzNKUgTH2M2m9UMpu1QfLczqssnKSVezSC6v2XMHc:Sk2w5vgTH2qBpu1QfLIqsufC3
- TLSH T19AD6181265B5DE99E06FB4F0CD45A5A05D2B3C454F627AEB35ACBE283F321A05E3021F
- MD5 SHA1 SHA512 SSDEEP TLSH