Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 19:56
Behavioral task
behavioral1
Sample
2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe
- Size 3.1MB
- Sample260729-ynq2ystycy
- SHA256 2fb545e29a11e0a0930dd20555d53d60cdf04bc18dfa4e7bbbdff72cf619d063
- MD5 a24e9037caae9ed32c3c406fed510abe
- SHA1 d20f8b7d66b52833019f42b55d90120ab258248e
- SHA512 7958e201a2351eda1434046b0922e0914da4c8fd6c4742fdbd725df9b0cdecb7f8876dc0f70813ddf542009eea65e5e5c52afe72a7dd5860532e7c6c6c12a490
- SSDEEP 49152:jxPw9dH40N54M84pZM84p8lj4I8boQhfD6UDvxvykXk1rBsgyg:WdH4ApfOf9DS
- TLSH T13AE59E23FBA48465C17B497986A5D307E771BC040B2047C793A8AB6A9F337F05E3A725
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\chcp.com- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\compact.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\sort.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\tree.com 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\compact.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\curl.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\fc.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\cacls.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\replace.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\regedit.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe -
resource yara_rule behavioral2/memory/4796-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000f000000016ce7-5.dat upx behavioral2/memory/4796-728-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4796-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\7-Zip\7z.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.26100.1742_none_32a8c94cc5f2eef2\r\ClipUp.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\adamuninstall.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6415f1d934c35258\hh.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\bthudtask.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\r\services.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\tracerpt.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.26100.1591_none_f467d2d98b46d418\mighost.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.26100.1150_none_c8dd030624b7f968\r\OOBENetworkConnectionFlow.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.26100.1150_none_24aebd36aef95f82\ISM.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\SecurityHealthService.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\msil_edmgen_b77a5c561934e089_10.0.26100.1_none_6cad1ce863fa4761\EdmGen.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-recover_31bf3856ad364e35_10.0.26100.1_none_8d5ba08151885bf2\recover.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.26100.1591_none_cfa6fd46757cb5b5\dwm.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\SearchHost.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_installutil_b03f5f7f11d50a3a_4.0.15912.0_none_022ec4a0cabdc41e\InstallUtil.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_824861107299001b\r\imecfmui.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.26100.1_none_3dee2da03b86f50d\SystemPropertiesHardware.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1_none_11a8c65c8f61d5fb\dpnsvr.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1150_none_d0d1e07b8681fa6b\r\dllhost.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1150_none_ad5d9bcb00930036\newdev.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\r\SecurityHealthService.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\r\HvsiSettingsWorker.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.26100.1150_none_0c04974f069bcd17\cliconfg.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1150_none_e59c5dab3c0f4ed2\Fondue.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1150_none_8c544950ed549bc8\r\ThumbnailExtractionHost.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structure-minkernel_31bf3856ad364e35_10.0.26100.1_none_e03d543c53b702b7\perfhost.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\NETSTAT.EXE- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\LaunchTM.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.26100.1742_none_227796ba348ec62b\r\MoUsoCoreWorker.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\wuauclt.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\r\XblGameSaveTask.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.26100.1_none_f49f0778ad4f459c\Netplwiz.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmdl32.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_496d6688fe6244d2\r\PickerHost.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\CompMgmtLauncher.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-vaultcmd_31bf3856ad364e35_10.0.26100.1_none_e3755908c2899c00\VaultCmd.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.26100.1_none_136be58c8b89053d\sihost.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_0f19119bcdcaf335\r\SpeechModelDownload.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1150_none_8c544950ed549bc8\ThumbnailExtractionHost.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\x86_aspnet_regsql_b03f5f7f11d50a3a_10.0.27000.360_none_32cfdebbd01210f7\aspnet_regsql.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\r\UwfServicingSvc.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.26100.1_none_a385593075152a7a\PnPUnattend.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.26100.1_none_1ae648617b7c1208\NisSrv.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1_none_3ea069de9ed32ac7\sdchange.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.26100.1591_none_5181bbfe74a17a20\r\FsIso.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\nfsadmin.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\mofcomp.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\RestartAgent.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-resume_31bf3856ad364e35_10.0.26100.1742_none_091721c8d0a92082\winresume.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\ChtIME.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\InputSwitchToastHandler.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.26100.1_none_2e87dc5d933c136a\reg.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\IMTCLNWZ.EXE- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.26100.1150_none_4f487e99a54cb5d2\SystemSettingsRemoveDevice.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\poqexec.exe- 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_a24e9037caae9ed32c3c406fed510abe_amadey_darkgate_elex_glassworm_hawkeye_rhadamanthys_smoke-loader_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4796
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 4.0MB
- SHA256 74f697761ec4d9d2d97178691bb6c6634616f48fe9cce8d63e9415cf668be8de
- MD5 e75df66d17583844dc811262fa7f26f5
- SHA1 c8f91744de95c5221d1747fe4960b6e700dc52bf
- SHA512 124e994dc50cd8a7417307727068b8afad9c5be1e337a896bc5c00ac6952c7c247d152f2b1419e81a0570fd66dd34770de800c34a5c5f3f63fd518ac6f4c22c6
- SSDEEP 49152:jxPw9dH40N54M84pZM84p8lj4I8boQhfD6UDvxvykXk1rBsgyx/ezSC6vUzPvMHs:WdH4ApfOf9DDezSC6v2XMHs
- TLSH T1E2168D23FA748262C0B78479C6D2E716FB7178050B2047CB9298976D6F337F19A3A725
- MD5 SHA1 SHA512 SSDEEP TLSH