Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:37
Behavioral task
behavioral1
Sample
2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe
- Size 6.4MB
- Sample260809-w9kqysbr2x
- SHA256 7e103ce58f65f70167de268eab312eea158a1c8c5c15aacf464c8b897f7f246c
- MD5 4d0d2610e170c702d8ce4f04166a98e4
- SHA1 b24e316e91a27296b8a93ab66fdbc10a85d216e7
- SHA512 9a197c68890b10c5e7270e134a4b2124089139d8ac900c768cdb28e060efae7047313777db5329c2f1a20d13cc7697bc59c3652f5abaf3ba870a11fcf5eb1e42
- SSDEEP 49152:JxpM84pkc8MNFmrRokpDljBDtoZIeWo3n2bjlJ+MYu8m1/N9apYqz:OfkcsrRokEmZgxK8mzA6I
- TLSH T1A466E513BA79EC22F67E38F1DC98D5501C2D7C650AA3756732BEF76D9B335809A10222
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\comp.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\findstr.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\finger.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\user.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\help.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\resmon.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\printui.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\efsui.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\clip.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\replace.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\relog.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\timeout.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe -
resource yara_rule behavioral2/memory/1088-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000e00000001c56b-5.dat upx behavioral2/memory/1088-626-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1088-2915-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1150_none_dbed5373b4208431\msfeedssync.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.26100.1_none_5d5870c25fd0c1ea\netbtugc.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.26100.1591_none_dcb2480c8ab03707\desktopimgdownldr.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.26100.1_none_8c35e9ae895560fc\wkspbroker.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_58449d9961468d2f\IMJPSET.EXE- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_e06d5ce38536ffdd\colorcpl.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1_none_1831c57751bfb3cc\iisreset.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.26100.1150_none_0c04974f069bcd17\r\cliconfg.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_10.0.26100.1_none_ddc589fe5044ffed\MSBuild.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\r\SecurityHealthService.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browser_broker.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_5e31b7c284234e98\r\FilePicker.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1_none_42b151b278e19c01\gpupdate.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_55053aa4ab175950\CheckNetIsolation.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.355_none_a2d78d0e147c4763\aspnet_regsql.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.26100.1150_none_0b85b224b1f670b4\r\DevicePairingWizard.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.26100.1591_none_97668666133579f2\r\LockAppHost.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.26100.1591_none_4273d4b4f12943c2\mfpmp.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.26100.1_none_1093cc6b1440f8d9\RMActivate_ssp.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6157b26c767f49a2\ttdinject.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1150_none_0bdb83c7d007c6bc\PresentationHost.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\msil_multipoint-wmsdashboard_31bf3856ad364e35_10.0.26100.1_none_4d201f2d5466838a\WmsDashboard.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\ctfmon.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.0_none_acc2fb65a486a112\aspnet_regsql.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\r\AppVDllSurrogate.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.26100.1150_none_714a211aef7dc47f\r\eventcreate.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.26100.1150_none_4f487e99a54cb5d2\r\SystemSettingsRemoveDevice.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\HOSTNAME.EXE- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regini_31bf3856ad364e35_10.0.26100.1_none_139e8f2156be3ffe\regini.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.26100.1742_none_cbf6967615a0f1cb\hvax64.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.26100.1150_none_5c8523a823214933\r\wmprph.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\r\PrintBrmEngine.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1150_none_3d9125d57cc0da9e\r\WMIC.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\WebExperienceHostApp.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.26100.1_none_6b60acbaf3301f6c\setup.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\winhlp32.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.CscUnpinTool.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\SndVol.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.26100.1591_none_d5752f789b3d8f3a\dmcertinst.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.26100.1591_none_8055c40aa3ab24a2\NetEvtFwdr.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.26100.1150_none_51a2aa17b537a668\r\svchost.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\tsdiscon.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1150_none_a0f2e25475ab99da\SystemUWPLauncher.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\r\BitLockerWizardElev.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\r\IMTCLNWZ.EXE- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.26100.1591_none_69d37612269b8f36\r\WorkFolders.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.26100.1301_none_8550d029188c257c\DataExchangeHost.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.26100.1150_none_c74b9bded5451f89\r\iotstartup.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.26100.1591_none_efac539d4dc51fdd\r\PktMon.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.26100.1150_none_da9d1a28d73a79cb\GamePanel.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.26100.1_none_b21add2e107e23b6\w3wp.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.26100.1_none_373bf2a6128009cf\raserver.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.26100.1_none_c53f9dbf15451292\IEChooser.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevAppMonitor.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.26100.1150_none_ced6ba8820394f22\fodhelper.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_b17acfc36f0ec944\runonce.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.26100.1_none_d1331449ca23b444\wsqmcons.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1150_none_80212900f68082da\dialer.exe- 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4d0d2610e170c702d8ce4f04166a98e4_amadey_darkgate_elex_glassworm_hawkeye_manuscrypt_remcos.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1088
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 7.4MB
- SHA256 4de3df9cf1751d3997c2df090cc48f76a6f4a880c548109501212171fd09e19b
- MD5 4b035d05f0ef1fc9e1f6c2a7fb7b3611
- SHA1 f251d0f2369efd62086824a8b4527832befa437b
- SHA512 47fd3eec9254fc0fe8029f591bfca051ab3158f3302cbf31e8d54c2c21b5a3e4bc90056ed977a285d383da1f42f671309410aa2610242159feecb170f27b04a4
- SSDEEP 49152:JxpM84pkc8MNFmrRokpDljBDtoZIeWo3n2bjlJ+MYu8m1/N9apYqM/ezSC6vUzPR:OfkcsrRokEmZgxK8mzA6pezSC6v2XMHK
- TLSH T157760612B678ED22F57E74F1D8D8D6546C2D3C550BA374A732BEF32D5B336909A20222
- MD5 SHA1 SHA512 SSDEEP TLSH