Analysis
- max time kernel
149s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 16:49
Behavioral task
behavioral1
Sample
2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe
- Size 6.8MB
- Sample260825-vbvmtswdnc
- SHA256 f6e06250d93804e6d67d1528949b05b97af5601c5f7038470002bb921c5c2795
- MD5 28a712b8f91a22edc21d642ed24a769d
- SHA1 820a38873a15f6f07de13e85e1bec67929ec6211
- SHA512 8df1d886653b40ed380ebd38435fb5e6cacc63c204d8b5f2c436f7756fb2554a9ba46fe69732fd1e3843290937079936e52465474d9437b0b4102ba67be10d2c
- SSDEEP 98304:354GUKDkNp1PTJxjRXz4yVPKAAqnstLE9jo+:3ipKDcp1Ldzeqnh5o+
- TLSH T1847628126EAC8171D0AFFD308D61D789A1357D108F21AACB7EC4BD5DAE326D1793D222
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Netplwiz.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\recover.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\charmap.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\relog.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\expand.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\fontdrvhost.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\print.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\regedit.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\getmac.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe -
resource yara_rule behavioral1/memory/724-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x00060000000168d6-5.dat upx behavioral1/memory/724-776-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/724-3228-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\SuspendLimit.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_eddf8132c42e0857\AssignedAccessLockApp.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..erience-parser-task_31bf3856ad364e35_10.0.19041.1_none_80036e190af52e7c\MbaeParserTask.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.19041.1151_none_21b291c4f7bdb6e0\f\nfsclnt.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_d22800313aa7eb5c\r\regedit.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\ByteCodeGenerator.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_10.0.19041.1_none_857c0c60dec56103\snmptrap.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\f\usocoreworker.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.19041.1266_none_23ae8c0349f1b325\UsoClient.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1266_none_90436a82b05bca89\WPDShextAutoplay.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1_none_b817dbd29134ec4d\GameBarPresenceWriter.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1_none_52c6583f47afba7a\autoconv.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.19041.572_none_846686e46b73c8e3\PnPUnattend.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\r\SearchApp.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\r\WSManHTTPConfig.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.19041.1_none_0ee51e56d7e170fb\xwizard.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_7d1b4a535854fe42\quickassist.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\r\licensingdiag.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\f\ResetEngine.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.153_none_6ef8a222ac00dbc2\r\TrustedInstaller.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_510ebdd9292eed06\r\diskpart.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_19c9b562d4b65581\IMTCLNWZ.EXE- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_556ec3cb05e3ec5a\OpenWith.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1_none_e5e4ad7714f033ca\raserver.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.19041.746_none_18c3ddf7dbfedda0\f\PinEnrollmentBroker.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_76e6fb38a70dbd6d\r\GameBarPresenceWriter.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_f20ecec27517964b\PinningConfirmationDialog.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1_none_cbabe2205e65787b\runonce.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.19041.1_none_0d5748d7e02a5474\bitsadmin.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\n\InputApp\TextInputHost.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.19041.1_none_45dc4032c659ae7c\dsamain.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.19041.1_none_b19798c3028c2929\LockAppHost.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.746_none_e72c4ffca9db7315\r\lpkinstall.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icacls_31bf3856ad364e35_10.0.19041.1_none_f2fa56e679b879d1\icacls.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.19041.1_none_f4898caed6e558be\tzutil.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_512e9d368c70b758\f\iexplore.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\f\StartMenuExperienceHost.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.153_none_580ef30a6bb05e53\browserexport.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\sdchange.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchFilterHost.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\explorer.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.19041.1_none_ec479f963c4c3325\ddodiag.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.1_none_51b7888297a3c04e\WindowsActionDialog.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1_none_8c3cb0a560e64b91\spoolsv.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\SearchProtocolHost.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\FaceFodUninstaller.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.19041.1151_none_21b291c4f7bdb6e0\r\nfsclnt.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\f\systemreset.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\r\wsmprovhost.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.264_none_c765d8a6c76ec25f\f\DataExchangeHost.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\f\FXSUNATD.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.84_none_d062347205e52d46\r\PerceptionSimulationService.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\cscript.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.928_none_31fd477afc7b8278\PktMon.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15805.0_none_5ffcb7ce21b4d707\aspnet_state.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.1_none_2eeab9eac7c3eb5c\FXSCOVER.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.19041.1_none_a37f8905d149f29b\PackagedCWALauncher.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1_none_d16ea4809a87fadb\WPDShextAutoplay.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.1_none_4005191f803b56e1\isoburn.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVStreamingUX.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.4MB
- SHA256 d9a2b2ba42f458fb38f0e3c1ad8643cd26b3f3a92f3571d1b7257284b16c8fcd
- MD5 6e2666cf4bc249830fb51d4d6b1bfff2
- SHA1 673a4d42cb335f7813123c13111a7cb8b475a36d
- SHA512 a2a1cdd35936487e600c303afe9912ae9081933ce035f4959db2bbd95af25b19a5c5b5bf57c4e587200039a1f66d2152c39f3f43ec14ec9f527c40857de8c753
- SSDEEP 98304:354GUKDkNp1PTJxjRXz4yVPKAAqnstLE9joSjoF:3ipKDcp1Ldzeqnh5oEoF
- TLSH T12F7629126EAC8131D0AFFD308DA1D789A5357D104B31AACB7EC4BE5D6E326D1793D222
- MD5 SHA1 SHA512 SSDEEP TLSH