Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 17:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
- Size 20.4MB
- Sample260808-v4cmqaar2v
- SHA256 ec65c28e1c29b824794695648bcbc20194312205710f0b8b71300e5c516ab5ea
- MD5 9a6dd573933a74ed558743dd09948e95
- SHA1 da9c803e680ca70db7cfe393347819f4e43ce7e3
- SHA512 60817bf8adba15e2b3ec3430b5adea399bf69f8fb12f8502d163510c420db477549f0374f743288d6e5717a2a5029b99c0b41d62e6b8f98ffec24ff9b6210fdd
- SSDEEP 393216:4pTnLdzZIbUwF1VERmj2bOIbUwF1VERmj2bSOTR:4pbVZIY092bOIY092bxR
- TLSH T19427F11E779880B9D1B381798E66D616E271F8118B3196CF33A44B1E1FB37E25E3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mode.com 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\format.com 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\runas.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\net.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\hh.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\logman.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\net1.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sc.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\user.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sort.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\clip.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.26100.1_none_f7e1c28598378da8\LinqWebConfig.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15912.0_none_b064199c91afa844\EdmGen.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.26100.1591_none_d5752f789b3d8f3a\r\dmcertinst.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.26100.1_none_ab6fa072a46b2ede\EdmGen.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_dual_kdnic.inf_31bf3856ad364e35_10.0.26100.1150_none_0d22cb5713b04a04\kdnicctrl.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\r\pcalua.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_70d0fee4fcc0ae07\r\sdbinst.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.26100.1591_none_461a2040b9fd2031\FaceFodUninstaller.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-choice_31bf3856ad364e35_10.0.26100.1_none_c05a936cf44f86b0\choice.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\r\wextract.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\r\UserAccountBroker.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.26100.1_none_6eba2dc7c1074207\aspnet_regiis.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\UUS\amd64\wuaucltcore.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.26100.1591_none_5181bbfe74a17a20\r\FsIso.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\r\mobsync.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1_none_0c53e49062af0dd7\SystemUWPLauncher.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_7fa09276a9a8ba6c\r\esentutl.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.26100.1_none_bd03ac53a23b1a65\svchost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browser_broker.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_10.0.26100.1150_none_84c881fffaa85756\DeviceEject.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_5301f4e1e5797d14\XamlViewer_v0300.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.26100.1_none_373bf2a6128009cf\raserver.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_db09ff29aaa57394\wowreg32.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.26100.1_none_603d466a5482ab50\Register-CimProvider.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1_none_ed041165ae384870\dcdiag.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\changepk.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchIndexer.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1150_none_48fdcfd155028bbe\r\cipher.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingShell.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_e0a0e7a383989b03\r\IMEPADSV.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\typeperf.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.26100.1_none_c32f23e8b061a8a0\verclsid.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\hh.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\notepad.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-flexible-platform_31bf3856ad364e35_10.0.26100.1591_none_dd61c19e2e413ac5\fclip.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\UpdateNotificationMgr.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.26100.1591_none_b89e4fe4764210cb\r\SIHClient.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.26100.1150_none_7de38ebb78ccb039\tcmsetup.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.26100.1591_none_269260d4786a1186\wpnpinst.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.26100.1_none_8c35e9ae895560fc\wkspbroker.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.26100.1_none_931673d5fd963a61\driverquery.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.26100.1591_none_4606dbfb8b0028fd\r\dasHost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\tsdiscon.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmdiag.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\MRINFO.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_a4b44acdd9ec4aa3\r\DWWIN.EXE- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1_none_f7b54b8cda580fc5\ThumbnailExtractionHost.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.26100.1150_none_139d0992bdcc4113\r\DsmUserTask.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1150_none_78cec33b8cc1ebd0\r\cmdkey.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.26100.1_none_67ad1b14943183e5\netbtugc.exe- 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_9a6dd573933a74ed558743dd09948e95_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5868
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 21.3MB
- SHA256 34e9bdcb77f9cd3669a475ae79dd8a6034d65895cf689139f70e0075526453df
- MD5 ab00fb9527886dde7a6fef1fd6737a58
- SHA1 5c3b619de74bbfee13baa782b148e84f044606ee
- SHA512 c4acdbb547a05aa845d620656f4e793f09689b4f5db038479e10c8c7510926c933de6b99781fab75bb216d3709a62ca2696f76d244c99e60b3fc3cbe655b91f8
- SSDEEP 393216:4pTnLdzZIbUwF1VERmj2bOIbUwF1VERmj2bSOTl:4pbVZIY092bOIY092bxl
- TLSH T10937F11EB7A881B6D0B3C179CAA6D616F671B8024B3156CF2394471E2F737E25E3A311
- MD5 SHA1 SHA512 SSDEEP TLSH