3953b4e463c914f5e018c8294cee76d04b971cac6a617c34653942044163e66d

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Size 440KB
Sample260727-rrfl3avvcx
SHA256 3953b4e463c914f5e018c8294cee76d04b971cac6a617c34653942044163e66d
MD5 99c04b6ca439b84682f022655c47695d
SHA1 dd5a5ed4ce4913cac0b5ce44bd338c0718197046
SHA512 f484cf9d6604e07e97c184a197888b23f240f38660438eb89e95faf51258a7ac953cace97158371e63a1c0247ef725b3c28923cb2bf9bb261e1d638c0ee79634
SSDEEP 12288:MkVyYSyAwSfxL/2Dc3jDLLmt0LDQewsAjRE:tkP3aewsAju
TLSH
T13FA48D31FE74E036C7BB0DB21B36D716143D7A604F611AC3E3A88E9D59602D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5060	svghost.exe

Executes dropped EXE 2 IoCs

pid	Process
5060	svghost.exe
3096	2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe

Loads dropped DLL 34 IoCs

pid	Process
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe
5060	svghost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	svghost.exe
File opened (read-only)	\??\I:	svghost.exe
File opened (read-only)	\??\N:	svghost.exe
File opened (read-only)	\??\R:	svghost.exe
File opened (read-only)	\??\U:	svghost.exe
File opened (read-only)	\??\W:	svghost.exe
File opened (read-only)	\??\Q:	svghost.exe
File opened (read-only)	\??\B:	svghost.exe
File opened (read-only)	\??\J:	svghost.exe
File opened (read-only)	\??\M:	svghost.exe
File opened (read-only)	\??\P:	svghost.exe
File opened (read-only)	\??\X:	svghost.exe
File opened (read-only)	\??\Z:	svghost.exe
File opened (read-only)	\??\D:	svghost.exe
File opened (read-only)	\??\K:	svghost.exe
File opened (read-only)	\??\T:	svghost.exe
File opened (read-only)	\??\V:	svghost.exe
File opened (read-only)	\??\Y:	svghost.exe
File opened (read-only)	\??\G:	svghost.exe
File opened (read-only)	\??\H:	svghost.exe
File opened (read-only)	\??\L:	svghost.exe
File opened (read-only)	\??\O:	svghost.exe
File opened (read-only)	\??\S:	svghost.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svghost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svghost.exe	2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
File created	C:\Windows\svghost.exe	2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svghost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 5060	3140	2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe	89
PID 5060 wrote to memory of 3096	5060	svghost.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\svghost.exe
  "C:\Windows\svghost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 630KB
SHA256 1fce0a80e7db5aff4d358bb1d8fa3147d411a8d355c1e00cb72f8d9849552a77
MD5 96bfac4374eb37499f844a44e7245df3
SHA1 cc346e75b8322252933af5c116ea9886454400f2
SHA512 b2d2c05580170659d0ac6938132806de42c6f2841a5401fbfe84ef559396af229c90bf6969aea0a37c46f4c284bbc8c762f1c637112e3302055320bb09083367
SSDEEP 12288:TYSWXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:TPa0Le5ji0hmxNrM
TLSH
T1B9D40916F6748335D073C0B9C5D2A68AED7130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.0MB
SHA256 93e8d2dca26b8b2aa195da53b80e0d9bbf1eb42ae462d8777a2d926208e22eba
MD5 83cae25c127c376c9cb0f01ab3202623
SHA1 6c0b7d67cc244c094a0837160c93953b454f27bb
SHA512 2e96bb020ada17567bc3f4c86998362debdc263cb5a6d6ca2db42f19f2cffa053a4ef6bb6cd94b66d44b952a5cc59035e0370c65848a77b93e59c909d4e928ae
SSDEEP 12288:MkVyYSZ8vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/:tkPaa7/ezSC6vUyD/aqgrvWx6q8wyu
TLSH
T16E35F915F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 773KB
SHA256 b6d64569b95479ecac7b8b2bdfbe9c27cc88e5da2b5d45467cb4781a2e5ebbe9
MD5 fb098955df41775691c6ef38d1e6be4a
SHA1 a61aee13094337ef1b80702f710cc98033ea7a6a
SHA512 638d7e9c6fbf35318040ea67dced1eb1705deb2df2453f328a876dea4dc9a7fc87203afca01b6818fae1ee731ac0e538ee5358ab1b770bcd5844b501353193a2
SSDEEP 12288:MkVyYSaVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:tkPaVbqPb88hv/l+7
TLSH
T1BAF43B66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 14KB
SHA256 2ffa1c010889dc2c03dfef2271343ac6032c3966530c383b92d3dfd99a3aadc5
MD5 5dfdda860ba69df0ae0ab193cf22a4ad
SHA1 631c3b573b87688a9c5c5f9268fa826b315acb22
SHA512 ba844e4157d1da80879d89d52155e10f02682f34d92a5a7a57fb1d723cac66b01ff3aace379072780c01720419fd21f1f25279f6587950e9ed4c43688c284a95
SSDEEP 192:Qplw/Q3AjmqdD5KOEBrXJWRVkdQ2l+827nNHy+NXNUoynP+yJihMNV28d/o:ulgQ3655Kv1XIRV2Qi4Xax+yJ+MNH
TLSH
T1CA62D502CBA454E1FBFB0631B9FA298B5AB6BD104894DE1E47B07F9D0C34680E566357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 95KB
SHA256 39aaa86712b5ce2f0418d89579272d0535fa6b414a0f5fce979253001ff7a8e6
MD5 ec964ba678d5a80ed56dc5842afaffad
SHA1 c0ae53ebaa609b362f638b122fddbdc541a4b7ca
SHA512 cf2cadf1bfcfffb195e43133e32f374124a70a5e952cfad7a5e7042cd35c64250319b9952e59c8d99abeb915d2b18e014ea89e7e64b7de4df76c5524aebfca08
SSDEEP 1536:YA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAW:DCiyiukvvVHC6++uq3eqW14k/EyK9fSt
TLSH
T1BEA301178B516056F7F70130BABF2A96917E1D62DDA8DB0E4B907ACD0E78314E862733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 362KB
SHA256 13b7bad19cce2d408a47bdede942dff27d41a0f35023881490df2e53db19eae6
MD5 9c562637c3902b75b20c9c5d3f5df15c
SHA1 88094b7b5ed9a29fdd1570a755165dcc89f25193
SHA512 ede6fdc3c5baec40942db8b3ab1006a99bd9eafd9e458198dc97424d85c5c0b26bafb18454d7a1a3b67fde28a64dee9a4673faacb39ad194f4eaedbece928d53
SSDEEP 6144:MknVuOGK9faaOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:MkVyYSVeBNUbTVO86Uq
TLSH
T1AF843A3BEE28FCD2C27A8DB857918640E77274704F61A3CBD165820E9E136E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 130KB
SHA256 5d6b0fefd20999430da9409e99bfce3168aa3f78078ea2977f2573758f93d01d
MD5 d86d4d97300c56942ce07468a79b0599
SHA1 18a94032baf0031e40afad0dcfa60898b4da91ca
SHA512 33bc075e5f91df5e2e4cf36292bb8a7ee0b8a5beb180dd02d029cd33c83cfee3b15b66160db77eb11e0666e88fc98749918d2208857a72ec5a4edee20a41fcc0
SSDEEP 3072:zCiyiukvvVHC6++uq3eqW14k/EyK9fq4nzrecrS2aozwL9:sknVuOGK9fqpcr0X9
TLSH
T1D6D3E142A7E44207F9FB0F30B6F586521A7CABD37D30C61F1985B49A1D637808A21B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 a8a2fe3b7cd21d591d680c9a0372dca3fa29f37cad3fdbf9056da7b5cc4a906e
MD5 f82231fc7dbdf0ed07a1777a307a761c
SHA1 453d49816662f6ec2c5823155ae7f7dfaf91261d
SHA512 e776e6036f0b020217e563c8d5aa6499952c3128dc9a2650f4aab57e11cf847896ce90cc97c97f4c94df4673872a6262c10cffc5d62e9ea5145201879dfeee94
SSDEEP 49152:Ze4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3j:Ze4QvGAdlCEL8c/bRNw5CO
TLSH
T1C1165B656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 b6586bec5b8cf53f9f78a5fd84c135b596842aa49adf2d047f6be9bd56f8b106
MD5 41c65f0c968cf2c5aee4070577b607a0
SHA1 69ec828f6c0bf6425b563fa025fd3ba4138f489b
SHA512 0730ff456b874c9c176e2e44d343ff94a859c097417a4434c227ba3cb9b8bd237c5ac9f6a6b3513bf00744940d8958edb7fe1cce627c785f74385ca76fc5488d
SSDEEP 49152:T4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tf:T4QvGAdlCEL8c/bRNw5CO
TLSH
T17F165C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 bc23843b1426b4de511f0c2046e50ed7720b44628dfba13b0edcb89a0bb95b20
MD5 4be2300a88a4ad472cfec82a82bf8771
SHA1 bc0734ac36b7b99a9f747b5a11d2d7405bf5f2fb
SHA512 5096b96012fd3be45e468b1214375bf2fca063f5f994c10354a08d20e5a1ec9389ea3d127789337d32ac294dcf230b60fba5819b0d8e1de69b074d95b9e635fc
SSDEEP 196608:XNEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:XNEtQevvqc2W1cpV2XI32i
TLSH
T172474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 e37bc3c524a5899f8eda52f579096075730d21722996e2efddd3fbcba06023b2
MD5 d8002f17eb5f4f4039271cea3d34a9f8
SHA1 5cc83c38982b70e98ae795c3ebab0a0d35fb2704
SHA512 e5fd5a409040ce29b6bf8209c2b27c695e8b535ebbb65791b3ec2d4662a8f3c21783af31f84a00e2b5d90b0cbdeeab918fe4685a0f2735664386ea4a5db80521
SSDEEP 196608:XyEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:XyEtQevvqc2W1cpV2XI32i
TLSH
T1B2474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.2MB
SHA256 9d540970a3479294bb8ae4bdf320ec31499c741248a440117763b5a28a7d6116
MD5 86687ade3e1f0cccacc5d6aeb218c0a9
SHA1 9a499e351d38c1cb8698990922afb7ea8d0728ba
SHA512 ba616fcc4cefe568bcfb5a97636e5b29014a1ebfaec9706e0712c62c646755bd258e0e58a3e3fc84eb80ca2604a0b31a2d8e9c035d9b95f2f983938a9fc8feaa
SSDEEP 24576:tkPhCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:eZCbRquA/m2yL5zbfFiV+XenmE3/z
TLSH
T108B55C0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 660KB
SHA256 5e5dcc3e6462702de545e656f27b03fc53dbf34670011dbbf63bf04a3353f474
MD5 4abbc1c672f29723cb689613311f0180
SHA1 fc5a69d0ae7fbb6d3e2bf4c40b8790efb4aaa6fb
SHA512 da21fc71dd195772edb1746ba1e48e0c00880019e74c3e118278d1e857610c16cacc9d5917f342a0df8471b70c4927dd85f5fa64d578686430f7248a7938e7e7
SSDEEP 12288:ZAZ7YSaAZ/GLAIFoiwtA5qy97S9uaYFLq3Oq:ZA9PaAhGLAIFoiwtA5l7S53f
TLSH
T1DEE42981E7F941D4F5B3AA7899B6C171EA76BCA65E30D20F1260D21F1E33E509D24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 660KB
SHA256 ae2f4ea05caa487db83200dd38933895b4e12e1ec429c6122c6094149ac52fc7
MD5 934fa5415009862a8b17793e5597f728
SHA1 1dfa12c06ecb5eddd51fa0355715a3c133d80f74
SHA512 e4bf1320b0d639add3eaa432cb293158d1dadd61e746a1658984729797c0dda0366b9cccc087257310841f06bd95f48e64188c9652fdef3df6935b23af359666
SSDEEP 12288:MkVyYSaAZ/GLAIFoiwtA5qy97S9uaYFLq3Oq:tkPaAhGLAIFoiwtA5l7S53f
TLSH
T14AE42881EBF955D4F5B3AA7899B69171EA76BCA65E30C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 338KB
SHA256 ca58f6a7bcb733b1bb172346bd52236ea21afdc248fd6f8de0b8c83772ff1d2b
MD5 36c67628181f5c10a46bb5b0b01bdc68
SHA1 98a41d676c32d3cd838aed821996ca80a680af37
SHA512 2b062525aa6b51ef796d81a67b2dc2e66c3f6251ea5dee37c03d18a0469e0ec3e2aacb921ea4b1d8ecdbafcc8f8ce82004117a3ca1b6a033ea92631c13d00c09
SSDEEP 6144:MknVuOGK9faimw5HEiIsCCINUGBZjgXwYz4WDZSFxgHiGfE:MkVyYSimw5HEjsChNVBFgl0WDm+Cp
TLSH
T151749E4677A41CF9E9A791388697C536F7B2B8022A25D71F0760C65B1F33361BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 177KB
SHA256 72011d12a6c2135e686be92c31ed9b1c7fe509ac9d92a8d91dfdc7de4d974e92
MD5 08a994996b67751690ad5030fd08aa5b
SHA1 35f2ea6e46f12b225664b4511efded6143f355a8
SHA512 6fd25dd6133b75caadbccd3e7011403cf1ca535e10bc74ca568c2a6dd8072bdfdca9fe7f1323895e95d1d962339b163e4e21e187bf005dca666eb3e2b69d6372
SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UXkv57OsX2T3TH0XzZP1Pwe8UXDCsCys:MknVuOGK9fa857L2DTH0Z1Ie8YDfvat
TLSH
T1F204CF5A33E430FAE2A35238D9F55A46E7727463673583CF066042AA1F23BD15E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 224KB
SHA256 6b9d88cabf6e36b2c0197b35298068d46e16eb8b6af9efcd25b01862e937d4b4
MD5 b2ce2ee1e45b20b890c1465bd8de7df5
SHA1 e369fd405716d3e17df30ee950fda75fc6cd7a71
SHA512 c4be20f6d29223715e05985fd901b04e63f124cbfe21ae3b5ddda6432d8c7907a5384688b76c519f76ac0275126c18b6e75f9f3518e29ae3ec7c5b2cd6814823
SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UdvJ9psmeIBcV8pQFq4XKF3QP6:MknVuOGK9faD3psmeI+sQFqT3Qi
TLSH
T1E624591AD29802E8C06E6175C7568A41B3373C6297E1D3CB53D0F53E1F76690AEEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 224KB
SHA256 251aa4ad267dd215eeab56bc410de03ea345171f3b8e3157658ef288d1ac4682
MD5 bc2576cd1e862385a48da282db9db567
SHA1 bd7ad3b3b1ebe3a115b03774e0146deb673a2f08
SHA512 ff4dfd4d3f35b333ef6914dcea192f086a64b375c96c419d9f323b3b27268f340656ce0a29469a2c7651535afa6e97e9b6fabe3f436aa086b2eed583aafb0f76
SSDEEP 3072:p/EyK9fa4UdvJ9psmeIBcV8pQFq4XKF3QP6:TK9faD3psmeI+sQFqT3Qi
TLSH
T15324061AD29802D8C06E6275C7968A41B7377C6683E1D3CB53D0F53E1F366909EEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 137KB
SHA256 e6367a6428bd0aa37df5c510d4af674f75927b28fa55dc338d2c0c71b34963f4
MD5 77881c7d70ad95e5839c0070812a8937
SHA1 6fbd90c9abec47da825aa44de2e9850b83b84e23
SHA512 023edb27d2bd5c5d29957cd46ffbaf42af7cc62f3763307263056714ac1bfba1ad14748157f1e9a1468b070dc4e7421dda6db3e3e4312c9a5c80bdadecee51f0
SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UR4WJgkt:MknVuOGK9faXJJ
TLSH
T1DBD3E10A67B600DAD06781B0C6E25B56F97DF553A75092CF0FA9C21A1F633C49E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 145KB
SHA256 d03d966fb37f8b371da927fd13e733736295a584804d270a172b5fb808435604
MD5 a6155167a4d4c52ffacf2fbc80387787
SHA1 c8e18fa3c55ad3c725d56cd791de025b0525a3ab
SHA512 fae292763eb1f176e678b6d208af6d2aa6d5e6158c3e1e30a873f9576ef82e894425ba0980ab347ac97382810c92cad4fa59f1683a39f34195749eca8f15d57a
SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UTkIvQnkraVTxoQG:MknVuOGK9faJk3nkraVT8
TLSH
T129E3E04513E600EAD25B4278D2A35A45F57AF42387A0E6EF0FE5C21A1F53BC0DE3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 141KB
SHA256 4771301fbb3df42e1ab6ca6aa8b500bc3ba53eb07c33b722ef7bd5cce4ce0bb3
MD5 9afd243055f494e334374075afefc3bc
SHA1 9fc32315fc41ac34b49d054a830e73f04c9ddbfd
SHA512 7ee639c9a0a0cf8f926873f5e5163cdaa78b47adad8b7a5b45d4413818af46ca0370c20debefa5b765c67032505c2cbc6929cac947d681dc39072036c9547409
SSDEEP 3072:TCiyiukvvVHC6++uq3eqW14k/EyK9fa4UZpw5Z/KtbmmD22RQXSfj:MknVuOGK9faTpw5ySuJQX0
TLSH
T1B3E3E18623E200DEE16701B4C2A71647F979F8539BA0D6DF0BA5820D1F637D59E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-27_99c04b6ca439b84682f022655c47695d_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Size 359KB
SHA256 84d4c479221646130ed559a78fb278996fbc060cf87debf6e8bd2c270a7d70f2
MD5 ac6978d0fef8f6f2f07051473d188f02
SHA1 e50da923c96e44b0d7987eb1e6a7940a05b511b4
SHA512 95147a5ff79642e007d718d095cfefb424f7bd40dce15f4810f27ae1d52c21f329f9649fba9e654e3215747cb1fa6f8534f0a0d42c68bd75374530ad059d6ab9
SSDEEP 6144:tWhzr8SfxL/2Dc33C+U4tLsUL6mmt0fSoD78uLwsehNjRMX:tAwSfxL/2Dc3jDLLmt0LDQewsAjRE
TLSH
T101746B31FE74E032C7BB0DB21B36C716183DBA604B511AC3E3A89E9D59702D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwtlm

Path C:\Users\Admin\AppData\Local\Temp\dwtlm
Size 4KB
SHA256 9246c24b939c3aff800b14303e845d3f5b4757b07894e3b039fb2d5b1021e3c7
MD5 4f8b0cc1b83412f2299292f56e32910d
SHA1 f1315c9b1e2bc609d2d5f8349c7f73b6946a444b
SHA512 9578a0d16ade65b4425af88bd552266101fc9ab0bbf75281de2d6678f8cbb731cb8cf692bacd6f52727a7b975d43bce7de06e5268fe2465946f0c4830b10d3db
SSDEEP 96:2nnQTcTvcxPIBfxSQcy3Nk+0cl9/l8KnM:m0eMd
TLSH
T16D918E63630C2D36FC28A8F5ACA26362415CBF5107E4AC429A3DF42CA43EEC259F4438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mvpoa

Path C:\Users\Admin\AppData\Local\Temp\mvpoa
Size 440KB
SHA256 76963b7bd4c28e3218bb472299157c77e5968e0e5f9e8e99eb92df967d6f8b8e
MD5 5c5dea08333fa84e4b1aecb0ffe620e9
SHA1 b03ed6250f04378d06271949a6c5b322270fb881
SHA512 9d0ef551b0b78b8b2491d5ecade71f40175be03e768fda2361d3d6bda4dc14a1d558b068f61c2afd23dc0d454037a6f8d5595b60b49a914cdd8daaaad7fb4a0c
SSDEEP 12288:EkVyYMhAwSfxL/2Dc3jDLLmt0LDQewsAjRE:1klCaewsAju
TLSH
T1B4A48D31FE74E036C7BB0DB21B35C716183D7A604F611AC3E3A88A9D59602D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vidcd

Path C:\Users\Admin\AppData\Local\Temp\vidcd
Size 630KB
SHA256 dec99a6b5feb7bb8f6a908cc6683ff30bba4a0562b518c74acb13e8bae5bfde4
MD5 76a669146d2a71053a09b81dee598e8b
SHA1 9b556dfac8073eb07eaade5e4888919f4010d650
SHA512 0ae1da1c543d17de1a6ce565b238f09d9562104f9ec94a16ac25f6b501ef53b12df29d0f88f940d4ad5ef53ab09ce824d415992a2e7602f7d57694f970a7981b
SSDEEP 12288:MkVyYSWXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:tkPa0Le5ji0hmxNrM
TLSH
T1A1D41A16F6748335D073C0B9C5D2A69AE97130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svghost.exe

Path C:\Windows\svghost.exe
Size 81KB
SHA256 21fad7bdcb08823c874a8a9cf796c91691ecdf505282cdce79d8638fdf4fd2d1
MD5 ef3ba6bce00de0d4a3f0080c5cd32f72
SHA1 f9e806ef7b37d93a216c4d6f54f4186753c6deaa
SHA512 35cc4cb940161afd55d08b07b7364ae3ebf3b34562921f8626ad7591f7a1e7f5488ec6e7686d91e5f11a5b0c8e87829251bf7b3d1961ea8f55fd8846a95a8e6f
SSDEEP 1536:oA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAx:TCiyiukvvVHC6++uq3eqW14k/EyK9faO
TLSH
T14E83026B2743700AD6A251347B5F27E5917D09B3EFBC934E4F82509D1B8A3296D22F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3140-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3140-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3140-9-0x0000000000427000-0x000000000043A000-memory.dmp

Download

memory/3140-2-0x0000000000427000-0x000000000043A000-memory.dmp

Download

memory/3140-1-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5060-23-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5060-12-0x0000000000400000-0x000000000043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads