Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/07/2026, 04:36
Behavioral task
behavioral1
Sample
2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe
- Size 5.9MB
- Sample260701-e8dgtaet9l
- SHA256 df59be8ad1b3d106fe356cfd24b38258f0d23681eef15f27ca4e58b785da5548
- MD5 669ad6de680fdbb1e00c0ef0f8a43bb8
- SHA1 feabfd1ebf72ea535b45bc98f4c22084ce7cf9ec
- SHA512 f0d12a7a678c4ad390bddde42fb9a450dee2bec8946f5b33de05b2a490933e80e8678a1fdc74eb879595ae7c5734ec8c062d9a8becffa77f8963f64c180a2d22
- SSDEEP 24576:JxbqKM84pkc8iHNFpGlwJWvWL0vbv+ZAIiIcsdZQU:JxpM84pkc8MNFvgA0vbGAIiIrdGU
- TLSH T1C056B58F6D2CEE26E66E3DB18C54C2F80A187D94485638223DE8BE9ED7335C57E09171
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\printui.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\replace.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\help.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\curl.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\charmap.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\clip.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\tree.com- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ftp.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\sort.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\timeout.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe -
resource yara_rule behavioral1/memory/6128-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000900000002453e-5.dat upx behavioral1/memory/6128-942-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/6128-3224-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\r\upnpcont.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_ffd303094ff1fe66\r\auditpol.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\notepad.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\r\InputSwitchToastHandler.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1202_none_fef803c70cc0b37b\SettingSyncHost.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\f\iisreset.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.19041.746_none_8443a7febb9ab03d\consent.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.746_none_4e1b852ddd390c0b\NetCfgNotifyObjectHost.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.84_none_809ebfa242fbf368\wimserv.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseCncProxy.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_81cc87a43da05fd1\f\control.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.19041.1_none_05325e2f9f9e6b0a\ldp.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\adamsync.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_10.0.19041.1_none_dae2223cd3e6f926\AddInProcess32.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.746_none_4028b8f4f6c0b829\f\wpr.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.19041.1_none_2318682da2c7a3ea\PresentationSettings.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1ab57d24625888e6\WWAHost.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1_none_efa641d58a943e71\dmcertinst.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_c939d70420d81ce4\logagent.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.84_none_b4499a04dddcc22e\ssh-keygen.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.19041.1_none_8bc62bc63a30d6fb\nslookup.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_ee00310940a3cd37\wordpad.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dusm_31bf3856ad364e35_10.0.19041.1_none_625cda72b86ccf7e\dusmtask.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-getmac_31bf3856ad364e35_10.0.19041.1_none_c1efa43e415898e4\getmac.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\f\wmpconfig.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.19041.746_none_59e1ce71631fef8f\f\WmsSelfHealingSvc.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1_none_2f60455143be03e9\notepad.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_f23fc9b9908be4fc\iexpress.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\f\imjpuexc.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.19041.1151_none_e0e8a531e34051a9\HelpPane.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1_none_2d89ee37314a19a9\cleanmgr.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3fe90cdb6667211e\wevtutil.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasdial.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\r\FileExplorer.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.19041.906_none_1756861d80a1f0f5\inetinfo.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\tscon.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_d19001beed7624dc\CertEnrollCtrl.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.84_none_b4499a04dddcc22e\ssh-add.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_19c9b562d4b65581\IMTCPROP.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_b4441130315b5f1f\mmgaserver.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_f57e58b71b913c6b\f\auditpol.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.19041.1202_none_b9662ef4fe1412ad\f\OfflineScannerShell.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\r\SpatialAudioLicenseSrv.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\f\BrowserCore.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\r\smartscreen.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_4d67350a685e1a3a\bthudtask.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.19041.1_none_9b6f5274d7a3ac24\extrac32.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\f\vmwp.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\UevAgentPolicyGenerator.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_324ea383dbfddeb9\mavinject.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\x86_netfx-ngen_exe_b03f5f7f11d50a3a_10.0.19041.1_none_38a57ff5dba3c9f4\ngen.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.1_none_2eeab9eac7c3eb5c\WFS.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.746_none_2c2bcd67e9d4665c\f\FileHistory.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\acregl.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.19041.1_none_8a11dbe22c9bf6e1\msfeedssync.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.19041.746_none_d99fd60bc1fde773\f\LockAppHost.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.19041.746_none_a89acde4afbab635\r\mip.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.207_none_00b5dbdfab19326f\r\UtcDecoderHost.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\b719614236e5d701619700001815341f.uwfservicingscr.scr- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1_none_2e738f426c6e2839\Magnify.exe- 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_669ad6de680fdbb1e00c0ef0f8a43bb8_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6128
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 6.4MB
- SHA256 4cbbaab6ecb627cb31c56d3b446c12f3e9731c8ed0f2bee65df462c68fc4c8dc
- MD5 fef9b3881cd878e7ee916907cef1dad0
- SHA1 cb77c5f87b9cacd54dd018a862f1f85262166953
- SHA512 21954a85b58aa032ac8359854ec0ce46edea0c3fabd1e503cad2596ca4d2f63f09567d024e6488e5e53f9627f1ade0b272a6a9f19b1c2cccdcacdcf43a72d28e
- SSDEEP 49152:JxpM84pkc8MNFvgA0vbGAIiIrdGUmPji0Ajw:OfkchgAOSJdTcjos
- TLSH T19C66F84E6D2CEA22E57F3DB18C94C2F81A183D94495638623DE4BE9EDB335C17E09271
- MD5 SHA1 SHA512 SSDEEP TLSH