Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 19:37
Behavioral task
behavioral1
Sample
2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe
- Size 10.6MB
- Sample260417-yca7csaz2s
- SHA256 a2951762cc196147e3db3281b704fa90b94e80a99e19d10d466c38def1f9eab9
- MD5 190391fe60abae23e08473f927bc36a1
- SHA1 2c39a8f377f822a956d0420142a84579cbd81418
- SHA512 99f86b8e3eccc2a0224c845c74c6512cfb38445eaa2acab59920fd118e4245eeab918edb2d1cc169f38c76bd23d8e20ef72733c94d829d27b8df8641af6d44b7
- SSDEEP 49152:esvLfUprOO53RTqtigREJnQYNrRokpKWWhipXqX:essrOO53ARERQYrRokpoX
- TLSH T17FB6C302667CD8D7F86D2C7288D887295AB07C280A31958FF65772DDD93B5C3D9322E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\sfc.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\subst.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\runonce.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\printui.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\sort.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\convert.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\compact.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\instnm.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\clip.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\hh.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\relog.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\timeout.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\write.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\chcp.com- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\fc.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\fontview.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\mode.com 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\psr.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SysWOW64\user.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe -
resource yara_rule behavioral1/memory/3132-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000800000002447e-5.dat upx behavioral1/memory/3132-636-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/3132-3196-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\logoff.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_610e6b21ab533b13\r\autochk.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1_none_245e11de2a010b62\_isdel.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_f3a9dc0fe254a157\wmpconfig.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.19041.1_none_b55c875ed22d28bb\RMActivate_ssp_isv.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\LaunchTM.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\msconfig.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.19041.746_none_61e0347e850155a8\f\UserOOBEBroker.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_e341f52007f6d1a8\wecutil.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\f\CustomInstallExec.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.19041.1_none_39d7f735c58f975e\UserOOBEBroker.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.19041.1_none_729f314325319478\mountvol.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1202_none_958d6588f50ca146\r\edpnotify.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\r\PeopleExperienceHost.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.153_none_c0c4ee134c2535a0\r\DTUHandler.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.19041.1_none_827105fe900187d1\wiawow64.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\f\securekernel.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-getmac_31bf3856ad364e35_10.0.19041.1_none_c1efa43e415898e4\getmac.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_425d54d86cc1f3e2\r\tttracer.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.19041.1_none_5d7644a9644fd29d\ctfmon.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_4c95cf26b3aa5907\CredentialUIBroker.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\f\winload.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\r\omadmclient.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.1288_none_6c70124c60e2b4ef\vmcompute.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\r\wpr.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVDllSurrogate.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.1202_none_42d3a7d52bcb0f8d\WorkFolders.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\f\SysResetErr.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\f\ShellLauncherConfig.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.746_none_46f79836a0dc7206\r\Dism.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_770f598aef14382e\f\dfrgui.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.117_none_9be21f0ef860b570\r\wslhost.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\r\ScreenClipping\ScreenClippingHost.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\r\gpresult.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1_none_63e4d70575e86068\setup_wm.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\IMEPADSV.EXE- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_dc8146375466099a\DWWIN.EXE- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1237_none_7578510aa0f564fa\f\vfpctrl.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\iisreset.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.153_none_59d1094dec9b8480\r\Spectrum.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.84_none_3e82ed1fe15c67db\f\rstrui.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_aee92417063babbe\WinRTNetMUAHostServer.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.15805.0_none_429bcf7adb8e23ed\AddInProcess32.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.84_none_6461f879a9c4a23e\wifitask.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_af1474f55f209109\r\raserver.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\r\sethc.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1_none_fefb8187fb0ed9be\GamePanel.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.1_none_c12e5c6c2037e719\imjpuexc.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\r\wdagtool.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.1_none_20798db5235046f8\provlaunch.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1151_none_71aa7fdbb41824a0\r\ShellExperienceHost.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\r\rdpclip.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.1_none_313898283cd914f7\backgroundTaskHost.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-expand_31bf3856ad364e35_10.0.19041.1_none_18b834522b9eb97e\expand.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.153_none_3c9b504ec5293ad0\r\WpcTok.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.746_none_4028b8f4f6c0b829\r\wpr.exe- 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_190391fe60abae23e08473f927bc36a1_amadey_darkgate_elex_glassworm_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3132
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.2MB
- SHA256 83c80e700c4474b8f4bd82f9131396b1be96c1e9b78959e85681d158b206c5f3
- MD5 b0eba95bf9ae47e526393f7fe223333a
- SHA1 ea072ae2b112d99bd448479c8b0a6e2a83871884
- SHA512 7d173d42fef2ca6b09f1499707dadf9291e24983572e06228d194c39124b35943c28fd4a003cfffe72522e9db5a7f1bca8114447efd1d501cdad1e0fa1d32cb2
- SSDEEP 49152:esvLfUprOO53RTqtigREJnQYNrRokpKWWhipXqvPji0AjA:essrOO53ARERQYrRokpoHjoM
- TLSH T102C6D402667C99D7F46D6C7288D987295AB03C280A31958BF247B2DDDD3B5C3D9323E2
- MD5 SHA1 SHA512 SSDEEP TLSH