Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 05:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
- Size 4.5MB
- Sample260701-gfekhsg16w
- SHA256 62fdd77cbdf9475639e8c9ffef2f44e95b862f459c3114730776a62fdecf5bb1
- MD5 3341dcfbda140bd155220bcb87a41fec
- SHA1 b4c89eae0df54375c3581a3b8da6357063be8739
- SHA512 17176566daa7aaff45a1c0a1c75ae972fe496fcbf4a5d295c3595a72deb0534f5f7b4c10cde14f1ac3f814ecadfa51c939563b0709cd6e84d131816c914cb84f
- SSDEEP 98304:aqvkjJKgeiKdeU7/OaxyE7TBY1ZXFv9/rm:aqvovydeG/Oas7Fk
- TLSH T12326CF12B6719136D9670A31056E2632B56DB8301F038BFBA654A7BC2E632D1DF35F23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\proquota.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\format.com 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\chcp.com- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\replace.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\PING.EXE 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\regedit.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\makecab.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\user.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\ftp.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\sc.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\compact.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\setx.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.26100.1150_none_5404854ee1749b61\r\shrpubw.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_8e244623f18086ce\net1.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\ARP.EXE- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\user.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.26100.1591_none_435b2733e13c4689\r\dxgiadaptercache.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.26100.1150_none_544768fb4cb870ae\NDKPing.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.26100.1_none_255c949d766547ab\aspnet_state.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9c264eeaa60fc0ca\BioEnrollmentHost.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_989a65f2aef55b28\r\ShellExperienceHost.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\audiodg.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.26100.1150_none_e9952a81b2d9169d\dmclient.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\NDKPerfCmd.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.26100.1591_none_756d2e37dd0406ef\r\ApplicationFrameHost.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.26100.1_none_6b60acbaf3301f6c\setup.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_496d6688fe6244d2\PickerHost.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_a05e61712d324fe9\dfrgui.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\AccountsControlHost.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.26100.1150_none_acf35f94a536be18\r\RunLegacyCPLElevated.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.26100.1591_none_9d960bc9bb2901f9\r\rdpclip.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1150_none_88f06bccebd86289\w32tm.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15912.0_none_ed62602ac24399fc\Microsoft.Workflow.Compiler.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\PrintQueueActionCenter.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SystemApps\Windows.PrintDialog_cw5n1h2txyewy\PrintDialog.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\r\logman.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\chgport.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-keyscan.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.26100.712_none_685cc408c767126a\Windows.Media.BackgroundPlayback.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.0_none_58273f1b819405f8\aspnet_wp.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\x86_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1_none_10c9402dd04d0788\PresentationHost.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\r\spoolsv.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.26100.1591_none_1754f2ff6760d03e\r\WinSAT.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1_none_b0d3de420cfbf405\iissetup.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_421e63a4855b894f\resmon.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\r\WDAGNetDiag.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupcl_31bf3856ad364e35_10.0.26100.1_none_55a2ae3453d48859\setupcl.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1150_none_80212900f68082da\r\dialer.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1150_none_88f06bccebd86289\r\w32tm.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1_none_36c64bb72fffb46a\Dism.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\logoff.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\finger.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1_none_4f21a8f907d2e489\sxstrace.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVStreamingUX.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core_31bf3856ad364e35_10.0.26100.1591_none_944de837a97599ab\UsoClient.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\VmComputeAgent.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1150_none_00fe88f91f962b70\gpscript.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.26100.1_none_136be58c8b89053d\sihost.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_10.0.26100.1_none_84ad60409153e8ea\cofire.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.26100.1591_none_4b326ab0aa8da2bf\r\DeviceCensus.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_4fd441a3f30753ec\replace.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\NETSTAT.EXE- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deploymentcsps_31bf3856ad364e35_10.0.26100.1150_none_09f77181ae5e3bb1\deploymentcsphelper.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.26100.1150_none_0c04974f069bcd17\r\cliconfg.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1150_none_0c098ad82e53afc9\r\NetCfgNotifyObjectHost.exe- 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_3341dcfbda140bd155220bcb87a41fec_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5752
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 5.4MB
- SHA256 898a84287324e78f6f45d65eb44a1d258240faae4685ced8d85e58a5fbcbe5e9
- MD5 9d31d06467a8b253930042aa7af687b0
- SHA1 8e4603b1453593c940d4e0f3b0848291237a809e
- SHA512 faaf69a4562b9a989a3bd7893bc1fbd42374338f078165f120936ea2d4473aeee214e5e1b4087fab8efd32037660cc2e5acfaf7777ae27e9b86ebdd7a8445a1f
- SSDEEP 98304:aqvkjJKgeiKdeU7/OaxyE7TBY1ZXFv9/rvezSC6v2XMH6:aqvovydeG/Oas7F69
- TLSH T11146CF11B6708337D873857185AE7626F93DB8211B228BFB5245D3BC2E232D1DE35B26
- MD5 SHA1 SHA512 SSDEEP TLSH