Analysis
- max time kernel
149s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/04/2026, 05:48
Behavioral task
behavioral1
Sample
2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe
- Size 10.5MB
- Sample260420-ghrmvsat8j
- SHA256 e31f52312385799ec7edc53b433ac51df2e45fc2f5f301e0032b3394784b1078
- MD5 dcfd9d686b8d5a62592f9ecf04fe364c
- SHA1 cd34b4501274be5c4437df7dd10aaa7a8007d7f1
- SHA512 cf4b579d9daef2664fffa90a6b703ccb483a0745a5310b8225d51ce4777cc262aada233a99069a301c9f15874dc33666b25da49ee8e5878fa5eecf8f80248a89
- SSDEEP 98304:Ai9qgxK8mzHHtLK3BDhtvS0Hpe4zbpaAKQkroGIh3fkZcr:j05KBnvjeApaAvktYPr
- TLSH T1BCB69E82BE7084FECCB582308549A736ED317E5D79229A07F68CB75E7F322526921335
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wextract.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\cscript.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\help.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\msdt.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\write.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\control.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\sc.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\autochk.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\certutil.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\print.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\printui.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\certreq.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\cipher.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\explorer.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\fc.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\setx.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe -
resource yara_rule behavioral1/memory/4748-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x00050000000231b9-5.dat upx behavioral1/memory/4748-540-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4748-3212-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{4A94AA11-90CA-4C29-90D1-DFB13A8291E4}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_e3ab86b70c430b3c\wordpad.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.19041.1_none_e341aee7030e39c4\MigRegDB.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.746_none_77bd4cfbe87238a7\SnippingTool.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.1_none_6b92f924ed7df79b\fixmapi.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.746_none_58702f801199ce06\NetCfgNotifyObjectHost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVNice.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\SyncAppvPublishingServer.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_d19001beed7624dc\CertEnrollCtrl.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1_none_5d1b02917c107c75\convert.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1_none_d16ea4809a87fadb\WPDShextAutoplay.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\r\iisrstas.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.746_none_4e1b852ddd390c0b\NetCfgNotifyObjectHost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1_none_805682e34c6552d0\winrm.cmd- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_309e9e4a939c0bac\wscript.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\msra.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.1266_none_8f272afdd624490f\r\sppsvc.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.19041.1_none_0c4e6556fb852148\srdelayed.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.19041.1_none_2fe41983d5cad0a7\DevicePairingWizard.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\logman.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\r\GamePanel.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.19041.423_none_12ca604b48f8d3fb\f\CapturePicker.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\WpcUapApp.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.1_none_21244f0b33e2b22d\PerceptionSimulationInput.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.906_none_686405dc140529cf\f\schtasks.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_4.0.15805.0_none_7219923700ae18c0\RegAsm.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchIndexer.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\f\WerFault.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.264_none_29367e02ede71097\r\wbadmin.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\f\WerFaultSecure.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\f\aspnetca.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.1288_none_e0f8082a6952ce81\ntoskrnl.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.264_none_4a12028313046a9e\ntoskrnl.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.844_none_c0d0cb934c1c1f17\f\DTUHandler.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4ecd10b107da65f7\f\AtBroker.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_regasm_b03f5f7f11d50a3a_4.0.15805.0_none_9be7d950c1f8addd\RegAsm.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1_none_b3f1d9ff0e206c99\quickassist.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.84_none_ee550b91ec0a7e82\MBR2GPT.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\ea94772a36e5d701947000001815341f.tlsbln.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\r\WerFaultSecure.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\f\ndadmin.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\f\Setup.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_83b794e5516730a0\AddSuggestedFoldersToLibraryDialog.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\f\winload.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.19041.746_none_a5ade2e84580e250\f\DmNotificationBroker.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1_none_d6be4622df33d026\edpnotify.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_955497efbb030cb9\r\wermgr.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\WerFault.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.1_none_1a55178fad503598\ttdinject.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\r\msra.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\f\CallingShellApp.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_e6d5f08988c6cb95\DWWIN.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1_none_fefb8187fb0ed9be\GamePanel.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\PrintBrmUi.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\f\systemreset.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\ResetEngine.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\query.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.1202_none_42d3a7d52bcb0f8d\r\WorkFolders.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.19041.844_none_c606f47e6aa94b5b\f\hvsievaluator.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc\r\WinMgmt.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_ed5986fc58f1b817\r\SystemUWPLauncher.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4748
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.0MB
- SHA256 f30b0091ff08394782146bb649edb11e15d943ee97ece42ee867000fd94249fd
- MD5 1d0948f4653849519a65699d692e9350
- SHA1 3aef968211a5d41562dea2a3fb803a40c776d2ef
- SHA512 e9c4a09e7589b22c3cd75c4ae5b6f104db0feff37a38a2fe0a00f0c8328abc8b62f3801a3c753c2f71b2d57851b17e53d58e39f22faed0d30eb7c333f09bcc74
- SSDEEP 98304:Ai9qgxK8mzHHtLK3BDhtvS0Hpe4zbpaAKQkroGIh3fkZcDjo5:j05KBnvjeApaAvktYPno5
- TLSH T166C69F86BE7085BECCB182708549A73AED313E5D3A218B47F64CB75E7F322925921335
- MD5 SHA1 SHA512 SSDEEP TLSH