Analysis
- max time kernel
149s - max time network
103s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/04/2026, 00:34
Behavioral task
behavioral1
Sample
2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
- Size 21.0MB
- Sample260425-awsnraf17j
- SHA256 f0081876c5199058e8464c989087dcb3d11f17e4f5301f42e6b5fc3a8f529af8
- MD5 4ec22ca9c408f1b7b97c89a49e90b460
- SHA1 d1c3e67834ac45bece5f2feed8b315ae61716571
- SHA512 48c98ecf205ebfd2ec9566636d48edfec1e527af32674dcd23093962fa4a5e66b5f92b9905f15792cf1efcf04d504ecc184d200e9a01607caca089e8e20556cd
- SSDEEP 196608:3ipKD0OdjBnvjeApaAvkt1vUpTfejrOOwH+vDdU:SpyjNvjtIAvkuGjrOB+G
- TLSH T1B6277D036ADC8BA5E06FAD30CD2596B546237C458E309BDB2DC07E197A712D16E3D32B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x002000000002afee-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x002000000002afee-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\hh.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\instnm.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\clip.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\regini.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\where.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\compact.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sort.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\timeout.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\comp.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\logagent.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\print.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\reg.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\netsh.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe -
resource yara_rule behavioral2/memory/3528-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x002000000002afee-5.dat upx behavioral2/memory/3528-322-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3528-3174-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\AuditShD.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.22000.71_none_e67840367b6dc817\ssText3d.scr- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.22000.71_none_c26272ecb066f6ab\f\ByteCodeGenerator.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.22000.1_none_f27e3cf28c93be1a\UwfServicingMasterScript.cmd- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.282_none_6b2d7072c225a87c\r\WerFaultSecure.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.22000.469_none_265cec8f409ba4eb\r\HealthAttestationClientAgent.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.469_none_160103e31c4d8d88\r\SystemSettings.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.22000.1_none_de173b06bfe08f32\InetMgr.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.22000.1_none_58ed24a5c85940dc\sapisvr.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.132_none_e66ce03b0132db6b\r\systemreset.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.22000.1_none_2ff0d0b731c6431b\ApplicationFrameHost.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.493_none_6ec3ffab3ec4b07b\r\LaunchWinApp.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.22000.1_none_b416d6c5e2f3a677\where.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.22000.100_none_bac6834bfb16b20d\SecurityHealthSystray.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.22000.1_none_570d0ffac0c0516c\efsui.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.22000.71_none_123327ab91644184\raserver.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.132_none_f836cc528422524b\r\ShellExperienceHost.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_49632d3770877d59\TSMKUDIR.CMD- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.469_none_8c502cfed26c810b\r\TrustedInstaller.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.22000.282_none_aa0f0c4e1a1cb43f\r\UsoClient.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.22000.1_none_98ecfb26dc5bb1d2\wab.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.22000.1_none_615eec7b6e862785\fc.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.22000.1_none_12f1c1658a9d216d\mountvol.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.22000.493_none_31b28f9ae4503c95\r\vmms.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_28babea403fb06cb\CallingShellApp.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.22000.1_none_f20a18a4fd0f4d43\LocationNotificationWindows.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.22000.282_none_3c5af3814be830ab\f\klist.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.22000.65_none_ac11e3d68c043701\f\BootRec.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.22000.1_none_d41670a1d239e747\dpapimig.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.22000.1_none_eb3f5def5135f996\ProximityUxHost.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_0483b4854ca89ef9\poqexec.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.22000.65_none_9f7612893c144c09\smartscreen.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.469_none_82154d2009b8e727\MoUsoCoreWorker.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.22000.1_none_7aa2dd30d068973e\TsWpfWrp.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.22000.1_none_9c0146f8151e14ec\gpresult.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.434_none_bb381a0becef4d51\f\certutil.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_ddb5359fa07e69e6\mode.com- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_dbc66c84afafb5a2\f\printui.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_53574bb7dad4a93c\f\mstsc.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.1_none_542efeeac7d0b582\CertEnrollCtrl.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\x86_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_8c1e5976c0145439\PkgMgr.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.22000.1_none_a8719e3ea40f5d74\sxstrace.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\TiWorker.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timeout_31bf3856ad364e35_10.0.22000.1_none_e2a80a66cb0dc4bd\timeout.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-recover_31bf3856ad364e35_10.0.22000.1_none_e6ab95c6edc4d4dd\recover.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4dda7ffaba1d5c31\cscript.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.348_none_790557e9d75b5a9c\SpeechModelDownload.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_0f0554e930e1de1c\f\RMActivate_ssp.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\SpatialAudioLicenseSrv.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.22000.493_none_674ce99b39869941\r\ntoskrnl.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_6b23f06ce93f4f52\RMActivate_ssp.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.22000.1_none_50931f3c57820a75\cttunesvr.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..platform-media-base_31bf3856ad364e35_10.0.22000.376_none_d0bc762eaa58a5f0\f\diagtrackrunner.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.22000.1_none_af27817de8dec1bc\csrss.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3528
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 21.6MB
- SHA256 b601fff2c208dd8c6e10b13430536c6db91212af4ea5d767e4e3232749a20785
- MD5 0b67ccbdfbe2e8fca605a8a5d56467ac
- SHA1 e40992a85a01c7360d56aa321f38545d824efef1
- SHA512 e3c92c850e2de645616370e45baa9ba2124e66630727ddef1e347bbfe00e61ee46a317cb369e355a8f9120a2b622a1e0d83eba2945ac3d8f6f9b3be4c8231542
- SSDEEP 196608:3ipKD0OdjBnvjeApaAvkt1vUpTfejrOOwH+vDd+oM:SpyjNvjtIAvkuGjrOB+zM
- TLSH T1DE376D026ADC8BA5D06FAD30CD2596B546337C454E309BDB2DC07E197A722E16E3D32B
- MD5 SHA1 SHA512 SSDEEP TLSH