Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 18:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
- Size 14.2MB
- Sample260808-wnb7pascla
- SHA256 2edbdaeb0dde4c942beacaf592f58f440d4b64d3ce021bbca0b5eca98b7dd186
- MD5 36029c580d0aac7d61fa75b48f555343
- SHA1 5e152714889f0255176cd012c23258994ed4c346
- SHA512 4eda6332393b2e2ac301a28407d97e95d57c00c1b767b06742284c532cc5d07298668a8ad965caad32481c8f9246ed3b25d9a6e1023eca801b7bfcea366c3ea7
- SSDEEP 196608:tipKDcp1LdzXdXeGZF6bUpMBF1p/kjRm4OWi2bFHOAoXvvO0:4pTnLdzZIbUwF1VERmj2bVOTx
- TLSH T1D8E6DF1E779880B9D1B781798E66D606E271F8018B3196CF33A4475E2FB37E25E3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\setx.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dccw.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\logagent.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\logman.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\systray.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\find.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\net.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\doskey.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Mail\wab.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-sk-helper.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseSampleUploader.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmplayer.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.26100.1_none_6609a7146abf3e09\powershell.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\r\spoolsv.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\r\SpaceAgent.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmmon32.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browserexport.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-voiceaccessstub_31bf3856ad364e35_10.0.26100.1591_none_129ee3df08a8deda\r\VoiceAccess.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\r\IMTCPROP.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\find.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..tofservice-oposhost_31bf3856ad364e35_10.0.26100.1_none_84152c97a6cd932c\OposHost.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_421e63a4855b894f\perfmon.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1150_none_e59c5dab3c0f4ed2\r\Fondue.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\r\wscript.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\finger.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\SearchHost.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.712_none_1b914f4a8d4789f2\r\notepad.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1150_none_e04b5db66660ee87\r\fontview.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.26100.1591_none_356e88b34c16567d\r\MDMAppInstaller.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\SnapLauncherProtocol.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmpshare.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.26100.1150_none_05685d8fac7c4f66\SyncHost.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\r\CustomInstallExec.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.26100.1150_none_eb28a122b02acd12\r\ldp.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.26100.1591_none_fa6fdcd71655ec4d\WpcTok.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_10.0.26100.1_none_bd06c5e20c19d210\aspnet_compiler.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\SearchHost.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.26100.1591_none_07d88b48de1d8831\r\HelpPane.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.26100.1591_none_361f20b3ac5f9b91\nltest.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\MoNotificationUx.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\r\MoNotificationUxStub.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1_none_4a85b7d59dcc025f\prevhost.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\audiodg.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.27000.360_none_ec5dcd352cf057e6\aspnet_regbrowsers.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.26100.1591_none_80585f5752dd6955\r\EoAExperiences.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\r\AppVDllSurrogate.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.26100.1591_none_269260d4786a1186\wpnpinst.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.26100.1_none_6e96156553a511df\dplaysvr.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1150_none_9e0e1ec5a1c14e55\GameBarPresenceWriter.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1150_none_f57fd51c6f680fbc\r\eudcedit.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1_none_db3c93db8c43c151\ielowutil.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\EDPCleanup.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1_none_e42fc57779c55fcd\cmdkey.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\wmpconfig.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\logman.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.26100.1150_none_47a573c9c96cd2e9\sort.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1_none_18d76879146fa99e\TabTip32.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.26100.1_none_c4a8407c4f3e3810\DmNotificationBroker.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.26100.1_none_a07bad500e90d9fe\ucsvc.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1150_none_78cec33b8cc1ebd0\r\cmdkey.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\r\BitLockerWizard.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseImdsCollector.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.26100.1_none_2152e7eb342c1e53\TsWpfWrp.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1591_none_6c3d16dfebe198e3\SndVol.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_bc36ad3cb5eb132d\r\wermgr.exe- 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_36029c580d0aac7d61fa75b48f555343_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3496
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 15.1MB
- SHA256 4ea15be0ca68bfb12d48298f83c93911c2443f58f39211022470100c864405f9
- MD5 32a12e6768f66962e81b41dd76cbc0cd
- SHA1 e17bb3416fc2d64c1cccd40c7a29bc6a38b18858
- SHA512 4b3e314f2062971153ed308b04e2d2a7a37b9272760c611aafee25e0207cec19a530278ffd2dc7f292aa0ba2a516eb1d314dca78422b8afd3a98eef8a3054235
- SSDEEP 196608:tipKDcp1LdzXdXeGZF6bUpMBF1p/kjRm4OWi2bFHOAoXvvOqP:4pTnLdzZIbUwF1VERmj2bVOTB
- TLSH T1C1F6D01EB7A881B6D0B3C179CAA6D606F671B8014B3196CF2394475E2F737E25E3A311
- MD5 SHA1 SHA512 SSDEEP TLSH