Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/09/2026, 04:19
Behavioral task
behavioral1
Sample
2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
- Size 8.4MB
- Sample260908-exntea1gmd
- SHA256 58ab87208c66a28e084fa52c7f6b61668ded8a4700a0edee54e089f45f6e7e72
- MD5 daa6dca4b92a97335b871b1ab1192665
- SHA1 282191f3b0a2e4c6258f6108f6f600a28cfcd285
- SHA512 ff5105285049f42179dd157fdeb1e1635d14abf8844738feca64a58854b9f5327c6296390a4a602a1500535a8cf7dc1c7b472e95c428ca267e5182fbf1facb04
- SSDEEP 98304:OfkrRokxZeTCDjoVevoirV0t/iLwHft8vAJ:ShwZoyoejrOOwH+vA
- TLSH T1E696171166D98FE8C05FD474CE8666B659237C868F209FCB4980BE293E766F05E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mountvol.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\more.com 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\net.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\clip.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Dism.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\mshta.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\regini.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\systray.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\regini.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\more.com- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\printui.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\psr.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe -
resource yara_rule behavioral1/memory/1832-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000a0000000243cc-5.dat upx behavioral1/memory/1832-682-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1832-3216-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.19041.1202_none_33e8c5dac6801a49\f\CompatTelRunner.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_d38e81565538dedf\f\logagent.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\f\ReAgentc.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.153_none_580ef30a6bb05e53\browser_broker.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\gpupdate.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\f\IcsEntitlementHost.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVDllSurrogate.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\r\uwfux.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\r\rmttpmvscmgrsvr.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.19041.746_none_8d7110d8c33b651f\r\TieringEngineService.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\MoUsoCoreWorker.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.19041.1_none_765fc5f6e37c509d\ieinstal.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1_none_522bacd027283125\UwfServicingMasterScript.cmd- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\r\SystemSettings.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.1288_none_1126d5c5c1f1669c\mfpmp.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_93b4a0a1641d085c\f\svchost.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\36f22f4236e5d701239700001815341f.nfsclnt.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\f\gpupdate.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\f\InputSwitchToastHandler.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.1_none_913591207b2aaf6f\WinRTNetMUAHostServer.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..pgrade-subscription_31bf3856ad364e35_10.0.19041.1_none_07600fc1c7993163\ClipRenew.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\r\AssignedAccessLockApp.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.844_none_77a5d9aafae08e77\MDMAppInstaller.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_4b16fb7fab206eb1\f\printui.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\f\SearchIndexer.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.84_none_8ea6a37043f4ae90\ClipUp.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.19041.1_none_2da6c69fad3fdf0b\DsmUserTask.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1_none_97e4facd611ea96a\autochk.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.746_none_3ed4d566b640ef5b\f\WmsUserAgent.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\r\msra.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_10.0.19041.1_none_dc4e5ab15169832e\etfsboot.com- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_64cb20c6329bf2bd\f\ntprint.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.746_none_9dd2fd0bc68c998c\certutil.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\f\spaceman.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.789_none_e07abbe9902a4f60\Utilman.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.153_none_3c9b504ec5293ad0\r\WpcTok.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.19041.1_none_c61fe93bf0d70d90\netcfg.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.19041.207_none_59ba79211607f58f\WinSAT.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\r\CustomInstallExec.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\wdagtool.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.19041.746_none_c82b4b805b9ae361\r\SystemSettingsBroker.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_e43cebe9807e08e3\f\setupugc.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\f\hnsdiag.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_895925637881788e\r\fixmapi.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_7999baeaf356e869\mofcomp.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.19041.1_none_6a9f2a3a3265ab31\rpcinfo.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\r\wkspbroker.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\sftp.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\hvix64.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_49c7c9a4b745444e\PhotoScreensaver.scr- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.423_none_c3eac275ecdf7e0a\NgcIso.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\smartscreen.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_2afd3bd8e33c2cf2\msinfo32.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_83b794e5516730a0\AddSuggestedFoldersToLibraryDialog.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\r\sethc.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.19041.746_none_045e85893c117e35\wksprt.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\r\WFS.exe- 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_daa6dca4b92a97335b871b1ab1192665_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hawke.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1832
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 9.0MB
- SHA256 83aab85420be854385d16934e414a5f32001ec60a53e4d92f9e7df3a4bba4294
- MD5 b5bff329bd1bd52c5a3f37f25b145bdc
- SHA1 37c9182f09c7bbdecb4cbace3ff5c6134e572332
- SHA512 1c391deecac9b5136b65061fcdd604ec00d7e06a8ae0e50f3fb898230c73b47de18110995949811478549fd5dede52dc801079cb714a97c0b73a17c6bf7798f7
- SSDEEP 98304:OfkrRokxZeTCDjoVevoirV0t/iLwHft8vAdjoO:ShwZoyoejrOOwH+v6oO
- TLSH T18A96291166D58FE8C05FD474CE8666A699237C868F309FCB4980BE293E766F05E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH