Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
- Size 14.2MB
- Sample260808-vm8c3aee69
- SHA256 d7e0f37e3673ca1f59d99b2479cae29ebda209a28466dbdd753a1792e4fdd37e
- MD5 e8bb7008486f3703eff39275c5f8f9ff
- SHA1 27567105519bbfb6c7267a39ad2924055631855a
- SHA512 a300162981750cf9b1889bd522741da40cb2bfcf194e7e0c2d2ad870cf0f30a712830abf4beb702442735d1e161ab8d4bc7292b0e4d71a5edca092a0b3153712
- SSDEEP 196608:tipKDcp1LdzXdXeGZF6bUpMBF1p/kjRm4OWi2bdHOAoXvvO0:4pTnLdzZIbUwF1VERmj2bdOTx
- TLSH T174E6DF1E779880B9D1B781798E66D606E271F8018B3196CF33A4475E2FB37E25E3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\attrib.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\hh.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.19041.1_none_2da6c69fad3fdf0b\DsmUserTask.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_edd345b6c42269da\r\rasautou.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\BrowserCore.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.19041.1_none_95647fabfa4ec9fe\tabcal.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.19041.1_none_71d7deb9b2d1d29b\verclsid.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.1_none_c653cc0f2ac29042\WmiPrvSE.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.19041.1_none_e5c3b6db2fced475\taskkill.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_f8b0afde1e951639\r\WmiPrvSE.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.19041.1_none_b6b53473f278f7cc\repadmin.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\r\MicrosoftEdge.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.19041.746_none_c82b4b805b9ae361\f\SystemSettingsBroker.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\sxstrace.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\f\wsmprovhost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.19041.1_none_b977d9566df127e9\wmpnetwk.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\mode.com- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.746_none_6c16d1714d60fddf\r\mspaint.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.746_none_0f70f5a5b71ec478\f\TSWbPrxy.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.264_none_e85c49c0793f9f24\f\Win32WebViewHost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_aa284d65c7bee591\upnpcont.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1_none_245e11de2a010b62\setup.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.19041.1_none_7aff9045397d4a4c\RdpSaUacHelper.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_42ec0e96ce977bdb\f\gpscript.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_ec5eb439471de957\f\cleanmgr.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_39eaf2470cfe88f0\r\explorer.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\f\msinfo32.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_b40cbfe2afd2c015\f\wowreg32.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.1_none_d333642c61130785\rrinstaller.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\hvix64.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\convertvhd.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\shrpubw.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\DismHost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_64cb20c6329bf2bd\ntprint.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\sethc.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2136afef5fadeaa4\f\prevhost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.746_none_24d91ab4120e42ee\f\rstrui.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_30274b64fe158ec9\f\sxstrace.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\ssh-add.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1266_none_69f1a169b4d96a7c\pcwrun.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_8a237828132e61da\Build.bat- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\7deea44536e5d7012c9b00001815341f.InetMgr6.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.207_none_c5e1b9def3522696\securekernel.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\aspnetca.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_4e193eb76ed5f8cb\r\wiaacmgr.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.264_none_0f23d07ed2574292\DiagnosticsHub.StandardCollector.Service.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\f\agentactivationruntimestarter.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.423_none_df344b9fe5390f25\f\AppResolverUX.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.19041.1_none_da90d957e87f3409\ImagingDevices.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\f\SpatialAudioLicenseSrv.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_f786fa028426f858\f\fltMC.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_8636783e05df6f4e\f\newdev.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\f\smartscreen.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\f\WWAHost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_8b145c40e6c6207f\winrs.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1_none_ac040ccaa73c8c1b\user.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_a4bfcaa32abfcf0e\f\raserver.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_d22800313aa7eb5c\regedt32.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.746_none_915a78ef54321214\f\SystemSettingsRemoveDevice.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\f\rdpclip.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.1_none_2a38e2996ee84e57\TapiUnattend.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_470f45b46101edfb\f\powershell.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.19041.1_none_42154eff4d5817bf\easinvoker.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3612
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 14.7MB
- SHA256 a95a6922a0647c44602b1046b66bf9e634513a6c63f7453986fa3563aa44e63c
- MD5 1eaeaa0329fa3bc2678792b3da6a3283
- SHA1 bec36f8ac0a94a8c6766976d3119605d87003798
- SHA512 a0c667b38fc87378a32f301a42858cc7ab8689002cba3b4c45f3e774d624deb3276f1871262778ba5a86d9938d0e8dfa8d9f68d4cdf1fcae8283267c1cbbcf1a
- SSDEEP 196608:tipKDcp1LdzXdXeGZF6bUpMBF1p/kjRm4OWi2bdHOAoXvvOeox:4pTnLdzZIbUwF1VERmj2bdOTux
- TLSH T127F6D01EB79881B9D1B3C1798EA6D606E271F8014B3196CF23A4475E2F737E25E3A311
- MD5 SHA1 SHA512 SSDEEP TLSH