Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 17:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
- Size 20.4MB
- Sample260808-v4cmqaar2v
- SHA256 ec65c28e1c29b824794695648bcbc20194312205710f0b8b71300e5c516ab5ea
- MD5 9a6dd573933a74ed558743dd09948e95
- SHA1 da9c803e680ca70db7cfe393347819f4e43ce7e3
- SHA512 60817bf8adba15e2b3ec3430b5adea399bf69f8fb12f8502d163510c420db477549f0374f743288d6e5717a2a5029b99c0b41d62e6b8f98ffec24ff9b6210fdd
- SSDEEP 393216:4pTnLdzZIbUwF1VERmj2bOIbUwF1VERmj2bSOTR:4pbVZIY092bOIY092bxR
- TLSH T19427F11E779880B9D1B381798E66D616E271F8118B3196CF33A44B1E1FB37E25E3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\label.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\subst.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\convert.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\whoami.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\print.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\cacls.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\format.com 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\calc.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\cttune.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.19041.1_none_3f67a7384812df13\ComSvcConfig.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\r\CredentialEnrollmentManager.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.19041.1_none_1e01a107b6c5cadf\certreq.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-label_31bf3856ad364e35_10.0.19041.1_none_0d20194b69a60627\label.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.844_none_ef8661e4d6535c5c\TabTip.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\f\WFS.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.19041.1_none_d7372edf29e45655\LanguageComponentsInstallerComHandler.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\r\NarratorQuickStart.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.1_none_0423901f2a62a812\FileHistory.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\f\hvsiproxyapp.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\f\SearchIndexer.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_1d38815769c81e5a\dllhost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_556ec3cb05e3ec5a\f\OpenWith.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.746_none_581ccf386ba57d51\browserexport.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-getmac_31bf3856ad364e35_10.0.19041.1_none_c1efa43e415898e4\getmac.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\MusNotifyIcon.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoftwindows-undockeddevkit.appxmain_31bf3856ad364e35_10.0.19041.488_none_7201e1dc944d1765\UndockedDevKit.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.19041.1_none_9439f8fec314ad47\ielowutil.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_955497efbb030cb9\r\wermgr.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.1_none_f4db83a870443aa2\CloudExperienceHostBroker.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.19041.1_none_6e5126083c2c0ea6\NDKPing.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1_none_b3f1d9ff0e206c99\quickassist.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\r\systemreset.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\r\gpupdate.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_ee614da092435ac4\f\rasdial.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\r\WerFault.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1_none_039ee78ea24cb495\dmclient.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\r\smartscreen.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\r\mstsc.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_309e9e4a939c0bac\wscript.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\mavinject.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.19041.1_none_911aa822a342ea29\extrac32.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\finger.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_5940d1a4fc4ad8f3\f\backgroundTaskHost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_fefa067e67e7af8b\f\UserAccountBroker.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\WindowsSandbox.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.19041.1_none_8f7cfa81649ea7a8\esentutl.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_87b4b95ab967b582\r\fontdrvhost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_f0e6f722ec2403d4\r\rrinstaller.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_255ef7c1a8ec5bf0\bthudtask.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\hnsdiag.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\omadmclient.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\r\DismHost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.19041.1_none_1b8420121296312d\LogonUI.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\chcp.com- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\r\rdpinit.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\f\ImeBroker.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.19041.1_none_3640cf5b039ce2f0\DiskSnapshot.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\f\notepad.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.84_none_8a067925a612632c\f\ApproveChildRequest.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.19041.1_none_42154eff4d5817bf\easinvoker.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_23c0aa3b7bd960cd\r\CheckNetIsolation.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.19041.1_none_112f38db81e24102\csvde.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\r\eshell.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.19041.1_none_a78dc4e9f3c6c606\bdechangepin.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7a559100246cff2b\f\CloudNotifications.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\SearchProtocolHost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\r\securekernel.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_dc8146375466099a\f\DWWIN.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.117_none_1db60e061b48335a\f\bash.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\r\gpresult.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_51cf02378fc26da3\SyncHost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 20.9MB
- SHA256 72bfad6ddf87f6f67eb6377bf0a7491817fc55f23e4a89953cd525550e7b5672
- MD5 78d3f5fce95d57a3959ea359a557520d
- SHA1 dccc6b18e2d2e6574f24c7eb70b7214ba939cbd7
- SHA512 11702c150fed5f05fd1ab0857060bf791aca1b266449becc39f899d57417109a241540bd2a0a32f4009a23fdb8005d2372328cf3073ffb4402e7fddafd3c22f5
- SSDEEP 393216:4pTnLdzZIbUwF1VERmj2bOIbUwF1VERmj2bSOTOV:4pbVZIY092bOIY092bxOV
- TLSH T11A27F11EB79881B9D1B3C1798EA6D616F271B8014B3196CF23A4471E2F737E25E3A311
- MD5 SHA1 SHA512 SSDEEP TLSH