Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
- Size 14.2MB
- Sample260808-vm8c3aee69
- SHA256 d7e0f37e3673ca1f59d99b2479cae29ebda209a28466dbdd753a1792e4fdd37e
- MD5 e8bb7008486f3703eff39275c5f8f9ff
- SHA1 27567105519bbfb6c7267a39ad2924055631855a
- SHA512 a300162981750cf9b1889bd522741da40cb2bfcf194e7e0c2d2ad870cf0f30a712830abf4beb702442735d1e161ab8d4bc7292b0e4d71a5edca092a0b3153712
- SSDEEP 196608:tipKDcp1LdzXdXeGZF6bUpMBF1p/kjRm4OWi2bdHOAoXvvO0:4pTnLdzZIbUwF1VERmj2bdOTx
- TLSH T174E6DF1E779880B9D1B781798E66D606E271F8018B3196CF33A4475E2FB37E25E3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\chcp.com 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\subst.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\certreq.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sethc.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\find.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\mmc.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\subst.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\recover.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\relog.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{19C38D80-0C26-4176-9E53-8ABFFD293E4D}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.26100.1150_none_cccbe77f5e2ee6e2\aitstatic.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.26100.1_none_91c8eae9745a351d\SystemPropertiesRemote.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\AccountsControlHost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmpshare.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.26100.1150_none_5952ab67e391cc12\ofdeploy.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.26100.1591_none_b89e4fe4764210cb\SIHClient.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevTemplateConfigItemGenerator.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.26100.1_none_31377d396bb3aacd\tzutil.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.26100.1000_none_6715fee261171762\wevtutil.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVNice.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.26100.1150_none_544768fb4cb870ae\NDKPing.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.26100.1_none_007a743337203bf3\wmpnetwk.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.26100.1301_none_248cf2c6018a558d\r\curl.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.26100.1150_none_d6b9ea087315f389\r\sessionmsg.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.712_none_b7b410b79e222f1d\r\imjpuexc.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\NETSTAT.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.1742_none_f6cbfd471cc28a5c\r\winload.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\adaminstall.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\subst.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userdeviceregistration_31bf3856ad364e35_10.0.26100.1591_none_b519370a5498ebc4\dsregcmd.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.355_none_8633c2a132a5236f\aspnet_regbrowsers.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.26100.1150_none_7e5b72d9f82ad1d1\hdwwiz.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.26100.1150_none_090eab20b35405f2\r\PresentationSettings.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_496d6688fe6244d2\r\PickerHost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_c6fec8639b4d0909\r\sfc.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_49f1b033747ffae2\wab.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.26100.1591_none_72c54a0c20f4219b\AxInstUI.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.26100.1150_none_a25df22273335338\ComputerDefaults.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmBroker.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\IMTCLNWZ.EXE- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1150_none_9e0e1ec5a1c14e55\GameBarPresenceWriter.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.26100.1591_none_1fa6e4d8d638e827\r\UserOOBEBroker.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\ssh-agent.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_783b330506082901\backgroundTaskHost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.1_none_4b983a10daa468ad\odbcad32.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\csvde.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.26100.1_none_8c4a868d0582d524\DataSvcUtil.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.146_none_57dbe416963fa154\ilasm.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_196dbbee022bb530\r\SpeechModelDownload.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_e81c261923f0a4b6\ntkrla57.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\spoolsv.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.26100.1591_none_c6d9ee3b6b5cb11f\HealthAttestationClientAgent.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.26100.1_none_b4b86b7122033aff\wmpnscfg.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\r\WmsUserAgent.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_wpf-presentationfontcache_31bf3856ad364e35_10.0.26100.1_none_028d3f2f7abaac3f\PresentationFontCache.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_7b25a93731217002\sdbinst.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.26100.1_none_0dbef45e6036c735\ComputerDefaults.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\r\CompMgmtLauncher.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\r\EASPolicyManagerBrokerHost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.1150_none_2a04d71b9e7ba19d\mspaint.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_a661f954ca482f71\r\Win32WebViewHost.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15912.0_none_aa82bd90bcd50b03\AppLaunch.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\CapturePicker.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1150_none_092b86d80d75b9b6\r\cleanmgr.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.26100.1_none_2e6b5339c0dc1a38\TSWbPrxy.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.26100.1150_none_5418e1dbd4f45309\r\telnet.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.26100.1_none_61895966950582dc\bdeunlock.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908\hcsdiag.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_ed74a23929c34603\explorer.exe- 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_e8bb7008486f3703eff39275c5f8f9ff_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:820
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 15.1MB
- SHA256 187a81090fd8740894d6c3a9c654a488f60fa398f320de35de83e5340349d06d
- MD5 b316293154a8b51de71dce78d17c75fa
- SHA1 3e0cb59764462ee302d60b19e4309b5f78df4bee
- SHA512 b4a182ffc9ad4a5c478dd70ae29dbe9152d07af9190e5c59a490a68b28fe906ea9df80b60f1fb2013d47f7c6a953fcd67766ca11415688c8aea13f7ec9f8d168
- SSDEEP 196608:tipKDcp1LdzXdXeGZF6bUpMBF1p/kjRm4OWi2bdHOAoXvvOqP:4pTnLdzZIbUwF1VERmj2bdOTB
- TLSH T18FF6D01EB7A881B6D0B3C179CAA6D606F671B8014B3196CF2394475E2F737E25E3A311
- MD5 SHA1 SHA512 SSDEEP TLSH