Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 16:49
Behavioral task
behavioral1
Sample
2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe
- Size 6.8MB
- Sample260825-vbvmtswdnc
- SHA256 f6e06250d93804e6d67d1528949b05b97af5601c5f7038470002bb921c5c2795
- MD5 28a712b8f91a22edc21d642ed24a769d
- SHA1 820a38873a15f6f07de13e85e1bec67929ec6211
- SHA512 8df1d886653b40ed380ebd38435fb5e6cacc63c204d8b5f2c436f7756fb2554a9ba46fe69732fd1e3843290937079936e52465474d9437b0b4102ba67be10d2c
- SSDEEP 98304:354GUKDkNp1PTJxjRXz4yVPKAAqnstLE9jo+:3ipKDcp1Ldzeqnh5o+
- TLSH T1847628126EAC8171D0AFFD308D61D789A1357D108F21AACB7EC4BD5DAE326D1793D222
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\reg.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\autochk.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\expand.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\print.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\logagent.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\sort.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\Dism.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe -
resource yara_rule behavioral2/memory/5032-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000d00000001c5b9-5.dat upx behavioral2/memory/5032-635-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/5032-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\7-Zip\7z.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.26100.1_none_7ac67b5c35fd6e5c\dpapimig.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1150_none_e8f8e178bc55f481\bitsadmin.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\query.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\RestartAgent.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deploymentcsps_31bf3856ad364e35_10.0.26100.1150_none_09f77181ae5e3bb1\deploymentcsphelper.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.26100.1150_none_544768fb4cb870ae\r\NDKPing.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_10.0.26100.1_none_46c1c0aa0704aa24\RegSvcs.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\r\SecurityHealthService.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.26100.1_none_0a6a82dd5aa9d087\odbcconf.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.26100.1150_none_3cdcbfd9e162066d\RMActivate.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.26100.1150_none_59491cddd00c2dba\smartscreen.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.26100.1150_none_d6b9ea087315f389\sessionmsg.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_470d3c75c9c68669\fixmapi.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tioncenter.appxmain_31bf3856ad364e35_10.0.26100.1150_none_9cb5d3bc417a5c42\PrintQueueActionCenter.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\SpaceAgent.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.26100.1000_none_c42bc74a0a3c26d8\taskhostw.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.26100.1_none_55e7b933a1108505\xwizard.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1150_none_49db19f88674c270\unregmp2.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\r\logman.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.26100.1591_none_269260d4786a1186\wpnpinst.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\BitLockerWizard.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.26100.1150_none_47a573c9c96cd2e9\sort.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\TiWorker.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\wextract.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\bridgeunattend.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\r\msra.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_acf5850f76c86db8\r\WPDShextAutoplay.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\ARP.EXE- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.26100.1591_none_cfa6fd46757cb5b5\r\dwm.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\ie4ushowIE.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.26100.1_none_92f5fcf757ed42ed\vbc.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\r\AppVClient.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\ssh-agent.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.26100.1_none_1ecd646959af4e74\auditpol.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1150_none_9e0e1ec5a1c14e55\r\GameBarPresenceWriter.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.26100.1_none_dffd701c50bad456\mqbkup.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.26100.1_none_2271a765c49d2684\taskkill.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1150_none_8c544950ed549bc8\ThumbnailExtractionHost.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_1ac5fa16ecade80d\r\stordiag.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\x86_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1_none_10c9402dd04d0788\PresentationHost.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.27000.360_none_eb22a7e4bb95e7f1\aspnet_regsql.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.26100.1591_none_0065af33551e5c88\BdeUISrv.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.26100.1591_none_ae6cc2a1ab3ee224\ShellAppRuntime.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-codeintegrity-citool_31bf3856ad364e35_10.0.26100.1301_none_aeea3d3f880e8dea\CiTool.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_773b7b96c37cb0e9\DpiScaling.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\AppVDllSurrogate.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_d64c3d514f37d908\r\IMEPADSV.EXE- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.26100.1_none_5d5870c25fd0c1ea\netbtugc.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qprocess.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\UNPUXLauncher.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\EaseOfAccessDialog.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\CapturePicker.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\r\cmdiag.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1_none_1831c57751bfb3cc\iisreset.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systray_31bf3856ad364e35_10.0.26100.1_none_fa99cf8592f76fdd\systray.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\VmComputeAgent.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\ctfmon.exe- 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_28a712b8f91a22edc21d642ed24a769d_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_kwampirs.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5032
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 7.8MB
- SHA256 5f17e799e9b77e3166c20b5c4c53f56cdf86f8aace7f28e10c9928308c40fc2e
- MD5 f7dad1074af8c02a5c916b26cdbf5ae9
- SHA1 0fb3c1da0777e93c646a12ab0bf184d6b11a48a0
- SHA512 5434f303b58406d56b77e60dba336fe25f5ebe62c210a3ae57f9bea1b3e01587e8d6c94a175d2412633f65bbd6be1082751c52538f4141398dca29ea7db9bd6b
- SSDEEP 98304:354GUKDkNp1PTJxjRXz4yVPKAAqnstLE9joXezSC6v2XMHs:3ipKDcp1Ldzeqnh5oMX
- TLSH T1B98618126EBC8231D0AFFD7489A1D789A5313D014B319ACB7AC4BE5D6E326D1793D322
- MD5 SHA1 SHA512 SSDEEP TLSH