Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 13:05
Behavioral task
behavioral1
Sample
2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe
- Size 9.3MB
- Sample260420-qbppcsbs5k
- SHA256 427e85113f61ca38b6faf17a8312a8959183b7ddc1c37447caaed68ae52392a2
- MD5 6b8a8a766a61b17eeb737dd006a9a0f4
- SHA1 9d8b2917acb2892d79d984c9fec5d4da6cdde748
- SHA512 6e0fde0b7ed8e6fab85ccc4a0a5b2265a77aaa674daa46024915103d82197d6000a374d2bbdf4b79403140b729ceee37a7cdd97b98bc49956241f9b64e8ad41a
- SSDEEP 98304:esxfRjxAZf9FDG+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsm/:389dmA39aNwnYBzzXQ
- TLSH T1AAA6C585AEC1987ADCAD0E300965A739F4247E9F7C1E7906EE403B4EF677EC16814632
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\curl.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\more.com- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\recover.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\at.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\notepad.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\sethc.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\winver.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\sc.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\wextract.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\regedit.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\ftp.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\charmap.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\net1.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\regini.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe -
resource yara_rule behavioral2/memory/2656-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000600000002a7e0-5.dat upx behavioral2/memory/2656-819-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2656-3193-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\ConfirmCopy.bat- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.22000.1_none_72d0f19d01454ec8\ieinstal.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.22000.1_none_58ed24a5c85940dc\sapisvr.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.282_none_75821ac4f6866a77\r\WerFault.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_a6af4a93eb065fad\RMActivate.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_a6b2722d9eed2eed\f\fixmapi.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\f\NarratorQuickStart.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.318_none_2bc95a47eaa37094\r\hvix64.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ment-userdatasource_31bf3856ad364e35_10.0.22000.51_none_47d05adb57cc60db\f\UserDataSource.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.469_none_5669b3acf1ecab58\f\winresume.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\quickassist.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\n\MiniSearchHost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.22000.120_none_05dfd9bc9f8bc6b6\Win32WebViewHost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_6b5eb3c4c1ffcde9\r\WerFault.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.282_none_fbdbe8fb711d9878\vfpctrl.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.22000.71_none_bcb9c63bb991a4c6\msconfig.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_4902a165a673e741\mstsc.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.22000.37_none_46638c67a45b1942\r\MusNotification.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.22000.1_none_d22c214b0919be3a\WmsSelfHealingSvc.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cipher_31bf3856ad364e35_10.0.22000.1_none_0daec752de4278a6\cipher.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.22000.1_none_c0fd105a306dfcd0\netbtugc.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_28babea403fb06cb\CallingShellApp.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.434_none_2ca09768f8a7e2e6\r\DiagnosticsHub.StandardCollector.Service.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.22000.1_none_3ad96689f86d60ce\NetEvtFwdr.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_49632d3770877d59\END.CMD- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_0384636b13b61c9e\poqexec.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.22000.318_none_83a303ac2a49c928\bcdedit.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_10.0.22000.1_none_ddfd55862d9061d5\cofire.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.282_none_e2966659594e32a5\LockApp.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\f\NarratorQuickStart.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_ef0bb92fa937f7ee\r\RMActivate_isv.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.22000.1_none_902756b93bcc4aa2\vbc.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.22000.1_none_eff22b32a0d892a9\MDMAppInstaller.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.469_none_3038532b4b83a565\wowreg32.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\query.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.22000.1_none_f6192218a034a3b9\wuapihost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_10.0.22000.1_none_d8155ee7186af991\TpmInit.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.22000.41_none_506d5972b4817c83\f\Magnify.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.469_none_3038532b4b83a565\f\wowreg32.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.22000.1_none_ff2cefc65fe79cac\alg.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.22000.120_none_60f8436cf8662a7a\r\LogonUI.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.22000.434_none_14b16ab1e534f40c\msdtc.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.120_none_4d19d7f0fee9ee87\explorer.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmplayer.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\r\SenseCE.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.493_none_2b6ddb5beae8ce90\f\hvix64.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\AppVShNotify.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.22000.1_none_9f5ecfc704d62df3\dsacls.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.22000.1_none_502f03701a672d6b\takeown.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.22000.1_none_8165809779001f16\edpnotify.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ftp_31bf3856ad364e35_10.0.22000.1_none_0d83a5e891b3d321\ftp.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.22000.1_none_4294863d020c9d21\tcmsetup.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\SpatialAudioLicenseSrv.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.22000.1_none_a061a9a7af162f02\spaceman.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.282_none_8beb92a45fb95e13\f\DataStoreCacheDumpTool.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchProtocolHost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_c1bbc2c937fef3c3\logman.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_cfe0738266c4e593\r\WSManHTTPConfig.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.22000.1_none_9b427621ebb92f7b\csc.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\AppVDllSurrogate.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2656
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 9.8MB
- SHA256 f849069e7f8ddd9a82fa0c7aaacb27b3cef06b979d1dacdcb46d478865cb987e
- MD5 89d94d0ca0691e2e6b64d32411772226
- SHA1 8af868d5451bf32321de44beadb86b48117f0c33
- SHA512 496527c472cafc56f1afb27aca8e4b8740f87b1b643d2eeb3284089b20690b71771ae0ecc305a8df5c05dbfe5c13485eb70c34063ad5e41978c5c6e127de0866
- SSDEEP 98304:esxfRjxAZf9FDG+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsm4:389dmA39aNwnYBzzXqoR
- TLSH T1BEA6C585AEC1987ADCAD0E300965A639F4243E9F7D1E7906EE403B4EFA77EC16414732
- MD5 SHA1 SHA512 SSDEEP TLSH