Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 14:34
Behavioral task
behavioral1
Sample
2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe
- Size 4.0MB
- Sample260504-rxm84ady2x
- SHA256 e516490d7f43b8a358d21f0bff6995917acf01b2866f961b8deeff5f967d8e41
- MD5 38e62fd68631f492560cc656fcb2e0e7
- SHA1 af43457028a2f850b1c914a6d70e59d5b99d86f7
- SHA512 2cd916f424d8c632f8bb74d8f8e7d8aedb9eb3fadd9d624c2273427d52dca349bc6a3a1c974c71bf6bd4d0e30b061b5b528278693537962d5900adfdd15560b7
- SSDEEP 49152:esOBMQ0hKPgssSt2gNiT3S9tsgX8zEC8ULgCSA/Bkj0m:es60hv7StCTIOSA0
- TLSH T1E5165B1333E8452BF1BA677E94744A3857B6BD3A9E37C70E7540789E48B1B428A13723
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x001d00000002b1f7-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x001d00000002b1f7-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\credwiz.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\doskey.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\timeout.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wusa.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\finger.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\find.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\cipher.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\mode.com 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\dccw.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\logman.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\more.com 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SysWOW64\mmc.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe -
resource yara_rule behavioral2/memory/4568-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001d00000002b1f7-5.dat upx behavioral2/memory/4568-1287-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4568-3182-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.22000.41_none_46e53612c0e92204\f\BdeUISrv.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_890a915053a73623\TCPSVCS.EXE- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\f\msinfo32.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.22000.65_none_9f7612893c144c09\f\smartscreen.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.376_none_742ed331adb702b6\WFS.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.22000.1_none_4a72530ae0a1ba07\regedt32.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\AuditShD.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.22000.282_none_8a68951ea6251dba\wkspbroker.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.22000.1_none_8a87727f07f023b8\tzutil.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15806.256_none_7593da10f932a980\mscorsvw.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.22000.1_none_e92240163a52addb\ktmutil.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.22000.65_none_5df9e0d1a9b3658b\f\Spectrum.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ment-userdatasource_31bf3856ad364e35_10.0.22000.51_none_47d05adb57cc60db\r\UserDataSource.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..el-la57-setuphelper_31bf3856ad364e35_10.0.22000.51_none_b4d2b89d5693dc06\r\la57setup.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.22000.41_none_506d5972b4817c83\f\Magnify.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\r\wmplayer.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.258_none_dfe62f4e03f8472a\f\LsaIso.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_hyperv-vmsp_31bf3856ad364e35_10.0.22000.318_none_7f5bff6941991869\vmsp.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_d171c2327b4ef3a7\f\printui.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.22000.1_none_5b10fc4c4e155bd7\icsunattend.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.469_none_8c502cfed26c810b\TrustedInstaller.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.22000.1_none_1653a1993e779350\svchost.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.194_none_3a6786958001450b\r\wowreg32.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.22000.1_none_95dccdc9d43c7f46\dsdbutil.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.22000.1_none_baa7a7b212bbc28d\tttracer.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.22000.1_none_03442f231d65ee9c\wusa.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.22000.1_none_12ea1a72b4886bec\ssh-keygen.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15806.0_none_de9c072f19e4a666\vbc.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..platform-media-base_31bf3856ad364e35_10.0.22000.376_none_d0bc762eaa58a5f0\f\SetupPlatform.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmpconfig.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.22000.1_none_adc9f4fa8fe1731e\BitLockerWizard.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.22000.1_none_9c0146f8151e14ec\gpresult.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_10.0.22000.1_none_35b3f196fa600d12\NETFXSBS10.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.22000.1_none_17403e0ec10de4a8\verifier.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.469_none_4cf7a08cff0239cf\f\explorer.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.22000.1_none_010c2089229afa0b\fsavailux.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.318_none_40ba790c85795e91\BioIso.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15806.0_none_7d39f9a025126e55\mscorsvw.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\MsSense.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.318_none_b4bd4664802eaae9\f\CheckNetIsolation.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.22000.51_none_8fdc96dca7b0b006\r\SpeechRuntime.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.22000.1_none_3bc1e2973d0f3919\extrac32.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_037bca9e287fff5c\quickassist.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-csvde_31bf3856ad364e35_10.0.22000.1_none_55632d7a2ef05cc1\csvde.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\SpatialAudioLicenseSrv.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.22000.1_none_bb5cdd91d9f726ea\fsquirt.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_3023ad156f648a5a\r\CapturePicker.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_6b23f06ce93f4f52\f\RMActivate_ssp.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\f\vds.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\vds.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.22000.1_none_0367376385127fe1\FXSUNATD.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.132_none_f836cc528422524b\ShellExperienceHost.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\TiFileFetcher.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\r\WebExperienceHostApp.exe- 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_38e62fd68631f492560cc656fcb2e0e7_amadey_darkgate_elex_glassworm_hijackloader_smoke-loader_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4568
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 4.5MB
- SHA256 1f0a29a6dc30e6c3448c6d977963e60a8f09988a951f679f0de24e3d9a39f2c5
- MD5 94266a65f2e576843e7ebf34ff7b41c3
- SHA1 9556abb93e818cfdff0e61a3a2aa26cc5634dc1d
- SHA512 b9cc86421507c68115787a1546ba5b6814427ee7ea7520be8b0d68858a25e865eb115dce0d552537e63bba0a87f41bb2952a1d3840ec951ba8d0fcbbf972ba2a
- SSDEEP 49152:esOBMQ0hKPgssSt2gNiT3S9tsgX8zEC8ULgCSA/Bkj0MPji0AjE:es60hv7StCTIOSAUjo4
- TLSH T15E266B1273F84527F1BA673E94B14A3897B67D3A9F36C64F3540795E48B1B428A23323
- MD5 SHA1 SHA512 SSDEEP TLSH