Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 01:13
Behavioral task
behavioral1
Sample
2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
- Size 6.9MB
- Sample260808-bk4sbaxbna
- SHA256 66b07cf8ea87a83620df4af3fa7915031e781dba8509388c486d25460f291524
- MD5 6ceb93254b6aaab4df7b032fcdabfcb8
- SHA1 9ab3e133a55529c619b22087265c4cbd33d7683e
- SHA512 6c4df4b4754b144a0df9ad7d7cdd33efbaf20b8609102b530b06698cc18d69c99a78137f59e5e88652e2f1b7ecb624881e1b54192f03171746ceacd7e482b9e9
- SSDEEP 49152:fkYw9sgydB3ImIR8ILfUdcY/9k9akOElMaFLkMKeW4SkZP4sz9MbqT3S9tsgX8zM:fMsgWCmIiYL9ak7QfkZcqTIOSAq
- TLSH T1C7766D1277FD8633D87942398B78996852713D259B72CA8F31407E9EEDB3385492B323
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x001100000001e4cc-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x001100000001e4cc-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\sfc.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\wusa.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\msdt.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\logman.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\reg.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\regini.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\resmon.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\mmc.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe -
resource yara_rule behavioral1/memory/4052-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x001100000001e4cc-5.dat upx behavioral1/memory/4052-692-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4052-3216-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Windows Mail\wab.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\conhost.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_ba2b07b5ed02761a\f\imecfmui.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.19041.1_none_2da6c69fad3fdf0b\DsmUserTask.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_650ebab5a8c02ffc\r\autofmt.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_c10c5c59091a9a90\fc.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1288_none_f26bd0dcdf662cc9\f\AgentService.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.19041.1_none_646d0595db3c1ad4\EdmGen.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde\f\fontdrvhost.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_895925637881788e\fixmapi.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\f\wscript.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_aa284d65c7bee591\r\upnpcont.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.19041.1_none_69f4af04dd2c1f80\lpq.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\SearchApp.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\f\SpatialAudioLicenseSrv.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.19041.1_none_1b8420121296312d\LogonUI.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.19041.746_none_8443a7febb9ab03d\f\consent.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.84_none_dd81fb99bc3b1e53\f\NgcIso.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.1151_none_15ecde7059d11b7f\wslconfig.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_e2f3aaf24de135ec\Magnify.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\audit.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.1_none_86e0e6ce46c9ed74\WinRTNetMUAHostServer.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\WerFaultSecure.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.19041.1_none_2cda3b956fcdb26f\InfDefaultInstall.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\r\InputPersonalization.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\r\SpatialAudioLicenseSrv.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.19041.1_none_04959f34117554a3\odbcad32.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.19041.1266_none_149b57f8509ce672\f\wuapihost.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\r\SearchIndexer.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.19041.1_none_77274ce3b079d8f5\MicrosoftEdgeCP.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_122a74c9827fe81a\r\IEChooser.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1_none_638e20742b3c9c9a\SpeechRuntime.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.746_none_b8eadbf8a9c907b3\psr.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\f\Microsoft.ECApp.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.19041.1_none_0e98e5367a9d834f\mighost.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.844_none_95c651508e565d13\r\provtool.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.19041.1_none_d374a4c62c9f2643\LegacyNetUXHost.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_e867a49a6e97813d\f\LaunchWinApp.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_9fa94241ef63ceb4\wermgr.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.1_none_26e3edd6087852fc\backgroundTaskHost.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_cdf422107d2779cf\f\cttunesvr.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.746_none_c77d8290c75caeee\r\DataExchangeHost.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\f\sdchange.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_87b019d7cebd66d4\appcmd.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.19041.1_none_6f2ce5f0857cd61a\SecEdit.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_93b4a0a1641d085c\f\svchost.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\r\usocoreworker.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_23c0aa3b7bd960cd\r\CheckNetIsolation.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_d67c2e3d05659825\winrs.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\0be59c4736e5d70107a200001815341f.appcmd.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_9478227a478f23d5\Build.bat- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.19041.1_none_d69d2c25bd407a87\SystemSettingsAdminFlows.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_255ef7c1a8ec5bf0\bthudtask.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1_none_efa641d58a943e71\dmcertinst.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1202_none_5f774093e49b3593\r\refsutil.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1151_none_71aa7fdbb41824a0\ShellExperienceHost.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.264_none_e85c49c0793f9f24\Win32WebViewHost.exe- 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_6ceb93254b6aaab4df7b032fcdabfcb8_amadey_darkgate_elex_glassworm_hawkeye_hijackloader_luca.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4052
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.4MB
- SHA256 89ccce7bd04aa1f90d444be663ba1ea0095a9c6ebc01306b5ca34428f9dced37
- MD5 d29d520ee9e0093f75c3a93cd5e6715e
- SHA1 554ada90f16a9c7b2d04365c53514610efb03142
- SHA512 baf6dfa727f8402468e112fabdf653a660ed906f6c451db3a2b9e37624f969ca2aeac1aa47e79c89ca25729a36213e88de0e5d7b2db3ab7effdf7e614a22c21a
- SSDEEP 49152:fkYw9sgydB3ImIR8ILfUdcY/9k9akOElMaFLkMKeW4SkZP4sz9MbqT3S9tsgX8zy:fMsgWCmIiYL9ak7QfkZcqTIOSAWjo0
- TLSH T17F767E1277F98733D87582398A75996856713C259B72CA8F3140BE9EED73382492B333
- MD5 SHA1 SHA512 SSDEEP TLSH