Analysis
- max time kernel
149s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 20:06
Behavioral task
behavioral1
Sample
2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
Resource
win11-20260513-en
windows11-21h2-x64
24 signatures
150 seconds
General
- Target 2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
- Size 19.2MB
- Sample260528-yvrbascx21
- SHA256 cdd3c7c0cc5a694d7b9cf343608f1bd17ab9c90376bd3db7ccb234e36844f688
- MD5 572b4772d88d296f723220c8562f95dc
- SHA1 28357c4ae607279c6fb5d243a9420e8ba10adf79
- SHA512 c793f4a3829e890550726e6433dea7c40f3a25fa38171ea6fa697393811fffedb6c2329eb35229bbf766e6c1dca0c2450a926f162b3a32eac8d8d318102c9af2
- SSDEEP 393216:oVHoIKlQYV/WW5TJz5h+oG6b9cioCMrBXFifEOEA5JS84pteRpf:qovmo/WW5TJzas6lXr/mDJV4p2f
- TLSH T15017232372A05076C0F28D3D8C37FEE470B637279E5168BA77F96ECA1A355D0A612583
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with VMProtect. 1 IoCs
resource yara_rule behavioral2/files/0x001900000002b51c-40.dat INDICATOR_EXE_Packed_VMProtect - Downloads MZ/PE file 1 IoCs
flow pid Process 3 3164 MaRPackCheck.exe - Executes dropped EXE 22 IoCs
pid Process 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 5068 Synaptics.exe 4220 markany_ImageSafer_v5.18.0307.exe 3164 MaRPackCheck.exe 1784 ._cache_Synaptics.exe 768 Synaptics.exe 1852 ._cache_Synaptics.exe 4164 vcredist_x86.exe 1156 install.exe 2080 vcredist_x64.exe 4052 install.exe 3548 IMGSF50Svc.exe 1604 ImageSAFERDrv64.sys 4184 IMGSF50Svc.exe 2968 IMGSF50Svc.exe 3136 IMGSF50Svc.exe 4788 IMGSF50Start_x64.exe 3500 MaRPackCheck.exe 4568 IMGSF50Start_x86.exe 2656 MaCBFltInstall_X64.exe 4996 FontInstall.exe 2112 cbfltfs.sys - Loads dropped DLL 37 IoCs
pid Process 4220 markany_ImageSafer_v5.18.0307.exe 4220 markany_ImageSafer_v5.18.0307.exe 4220 markany_ImageSafer_v5.18.0307.exe 1156 install.exe 4052 install.exe 4220 markany_ImageSafer_v5.18.0307.exe 4220 markany_ImageSafer_v5.18.0307.exe 4788 IMGSF50Start_x64.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 4568 IMGSF50Start_x86.exe 4996 FontInstall.exe 3212 Process not Found 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 1784 ._cache_Synaptics.exe 1852 ._cache_Synaptics.exe 4996 FontInstall.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 2772 Process not Found 5036 EXCEL.EXE - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe - Drops file in System32 directory 50 IoCs
description ioc Process File created C:\Windows\system32\IMGSF50Start_x64.exe markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\MaRPackCheck.exe ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\MaRPackCheck.exe ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File created C:\Windows\SysWOW64\MaCallbackFlt.dll ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File created C:\Windows\system32\MaCallbackFlt.dll ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File created C:\Windows\SysWOW64\MaProtection.dll ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File created C:\Windows\SysWOW64\MaPrintInfo_KFTCRP.dat ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ImageSAFERRecovery.exe markany_ImageSafer_v5.18.0307.exe File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File created C:\Windows\SysWOW64\ImageSAFERProcMon.dll markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\IMGSF50Start_x86.exe markany_ImageSafer_v5.18.0307.exe File created C:\Windows\system32\IMGSF50Policy.xml markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\SUPD_Provider.dll ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File created C:\Windows\SysWOW64\MAOnFPS_KFTCRP.dll ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\FontInstall.exe ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File created C:\Windows\SysWOW64\IMGSF50Policy.xml markany_ImageSafer_v5.18.0307.exe File opened for modification C:\Windows\SysWOW64\markany_ImageSafer_v5.18.0307.exe ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\MaCBFltInstall_x64.exe ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File created C:\Windows\SysWOW64\FontInstall.exe ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\MaPrintInfo_KFTCRP.dat ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\markany_ImageSafer_v5.18.0307.exe ._cache_Synaptics.exe File created C:\Windows\SysWOW64\IMGSFMgr.dll markany_ImageSafer_v5.18.0307.exe File created C:\Windows\system32\IMGSF50Lang.xml markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\MAePageSAFERRexpert.dll ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File created C:\Windows\SysWOW64\uninst_MAWS_KFTCRP.exe ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File created C:\Windows\SysWOW64\MaRPackCheck.exe markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\markany_ImageSafer_v5.18.0307.exe ._cache_Synaptics.exe File created C:\Windows\SysWOW64\markany_ImageSafer_v5.18.0307.exe ._cache_Synaptics.exe File created C:\Windows\SysWOW64\ImgsfprocPolicy.xml markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\IMGSF50Filter.dll markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\IMGSF50MGR.dll markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\IMGSF50Lang.xml markany_ImageSafer_v5.18.0307.exe File created C:\Windows\system32\IMGSF50Filter_x64.dll markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\MaRPackCheck.exe markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\MaCBFltInstall_x64.exe ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File created C:\Windows\SysWOW64\MAePageSAFERRexpertV.dll ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File created C:\Windows\SysWOW64\markany_ImageSafer_v5.18.0307.exe ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe File created C:\Windows\SysWOW64\IMGSF50Helper.dll markany_ImageSafer_v5.18.0307.exe File created C:\Windows\system32\IMGSF50Helper_x64.dll markany_ImageSafer_v5.18.0307.exe File created C:\Windows\system32\IMGSF50MGR_x64.dll markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\ImageSAFERLang.xml markany_ImageSafer_v5.18.0307.exe File opened for modification C:\Windows\SysWOW64\markany_ImageSafer_v5.18.0307.exe ._cache_Synaptics.exe File created C:\Windows\SysWOW64\ImageSAFERFilter.dll markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\ImageSAFERMessage.exe markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\ImgsfProcPolicyForExe.xml markany_ImageSafer_v5.18.0307.exe File created C:\Windows\system32\IMGSFMgr.dll markany_ImageSafer_v5.18.0307.exe File created C:\Windows\system32\ImageSAFERMgr.dll markany_ImageSafer_v5.18.0307.exe File created C:\Windows\system32\ImageSAFERDrv64.sys markany_ImageSafer_v5.18.0307.exe File created C:\Windows\SysWOW64\ImageSAFERMgr.dll markany_ImageSafer_v5.18.0307.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 3824 2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 5068 Synaptics.exe 768 Synaptics.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\MarkAny\ePageSafer\drivers\x64\cbfltfs.sys ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\InstallTemp\20260528160703333.0\mfc90enu.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703333.0\mfc90kor.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703364.2\9.0.30729.4148.policy msiexec.exe File created C:\Windows\SystemTemp\~DF84C6E155E14FA812.TMP msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260528160703364.3 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706880.2\9.0.30729.4148.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706786.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_673f7fa2.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703317.0\mfcm90u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706802.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_069f922e.cat msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1007C6B46D7C017319E3B52CF3EC196E msiexec.exe File created C:\Windows\Installer\e587812.msi msiexec.exe File created C:\Windows\Fonts\SourceHanSansK-Regular.ttf FontInstall.exe File created C:\Windows\SystemTemp\~DF00B43ED59D4C4828.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703302.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703349.0\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703364.1\9.0.30729.4148.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260528160706833.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260528160703364.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706802.1\amd64_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d7860533.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706864.0\9.0.30729.4148.cat msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1007C6B46D7C017319E3B52CF3EC196E\9.0.30729\FL_msdia71_dll_2_60035_amd64_ln.3643236F_FC70_11D3_A536_0090278A1BB8 msiexec.exe File created C:\Windows\IMGSF50Svc.exe markany_ImageSafer_v5.18.0307.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703364.2\9.0.30729.4148.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260528160703333.0 msiexec.exe File created C:\Windows\SystemTemp\~DF547A4CF728052F1E.TMP msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260528160706864.0 msiexec.exe File created C:\Windows\Installer\e587809.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703286.0\atl90.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703364.0\9.0.30729.4148.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703317.0\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703364.1\9.0.30729.4148.policy msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\CFD2C1F142D260E3CB8B271543DA9F98\9.0.30729 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706833.0\amd64_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_22d6ba8a.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706802.0\msvcr90.dll msiexec.exe File opened for modification C:\Windows\Installer\e587809.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703364.3\9.0.30729.4148.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703333.0\mfc90rus.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703349.0\vcomp90.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260528160703364.1 msiexec.exe File opened for modification C:\Windows\Installer\e58780e.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706833.1\9.0.30729.4148.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706802.1\amd64_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d7860533.manifest msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703333.0\mfc90jpn.dll msiexec.exe File created C:\Windows\Installer\e58780d.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706802.1\mfc90u.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260528160706802.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703333.0\mfc90fra.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260528160703302.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260528160706880.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703333.0\mfc90deu.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703317.0\mfc90u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706880.1\9.0.30729.4148.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706802.1\mfc90.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706817.0\mfc90deu.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706864.0\9.0.30729.4148.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260528160706786.0 msiexec.exe File created C:\Windows\ImageSAFERSvc.exe markany_ImageSafer_v5.18.0307.exe File created C:\Windows\Installer\SourceHash{1F1C2DFC-2D24-3E06-BCB8-725134ADF989} msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703333.0\mfc90esp.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160703333.0\mfc90ita.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260528160703349.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706817.0\amd64_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_480678f3.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260528160706833.1\9.0.30729.4148.policy msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMGSF50Start_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FontInstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MaRPackCheck.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language markany_ImageSafer_v5.18.0307.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MaRPackCheck.exe - NSIS installer 3 IoCs
resource yara_rule behavioral2/files/0x00100000000261ea-6.dat nsis_installer_1 behavioral2/files/0x00100000000261ea-6.dat nsis_installer_2 behavioral2/files/0x001900000002b51c-40.dat nsis_installer_2 - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFCLOC,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 51005700510038004000640026004400640035006c0036005b004f0067005900790075002b007300460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800360034003e003700650072006b002e0062004a007500780034004400560079005100620036004f0065002c004d0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7BEB9232-028D-4DA9-9EE4-7F79672E93E2}\1.0\FLAGS ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6175CCBA-7348-418B-BE47-0998BFA6C292}\TypeLib ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6175CCBA-7348-418B-BE47-0998BFA6C292}\TypeLib\ = "{588363CE-A68D-4EDD-9ADE-38B362F8217E}" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6175CCBA-7348-418B-BE47-0998BFA6C292}\TypeLib\Version = "1.0" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE394852-2398-4231-9B74-D5785945C9AA}\VersionIndependentProgID ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CFD2C1F142D260E3CB8B271543DA9F98\FT_VC_Redist_MFCLOC_x86 = "VC_Redist_12222_x86_enu" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1007C6B46D7C017319E3B52CF3EC196E\FT_VC_Redist_MFC_x64 = "VC_Redist_12222_amd64_enu" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MAOnFPS_KFTCRP.MAWS_KFTCRP\ = "MAWS_KFTCRP Class" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE8F1ABA-6766-471D-B1C5-731BC4D51B84} ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.ATL,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 3400750074007e002c0069005a004c00780037006200340029003300420034003f00440045005400460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e0072004600390039004e002c00610079007d00370030002d0079007e00460069007000780027003f0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 51005700510038004000640026004400640035006c0036005b004f0067005900790075002b007300460054005f00560043005f005200650064006900730074005f00410054004c005f007800360034003e0073006b0028004400540038006500400033003400490068006f006c00740067005d0065002400780000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1007C6B46D7C017319E3B52CF3EC196E\ProductName = "Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MAOnFPS_KFTCRP.MAWS_KFTCRP\CurVer\ = "MAOnFPS_KFTCRP.MAWS_KFTCRP.1" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF23F9A2-A2D1-4F82-8BB9-142EEE26CF80}\InprocServer32 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE8F1ABA-6766-471D-B1C5-731BC4D51B84}\ProxyStubClsid32 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE394852-2398-4231-9B74-D5785945C9AA}\ProgID ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE394852-2398-4231-9B74-D5785945C9AA}\VersionIndependentProgID ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MAOnFPS_KFTCRP.MAWS_KFTCRP.1\ = "MAWS_KFTCRP Class" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAOnFPS_KFTCRP.MAWS_KFTCRP ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF23F9A2-A2D1-4F82-8BB9-142EEE26CF80}\ProgID ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7BEB9232-028D-4DA9-9EE4-7F79672E93E2}\1.0 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE8F1ABA-6766-471D-B1C5-731BC4D51B84} ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MAePageSAFERRexpertV.MAePageSAFERRexpertVista\CurVer\ = "MAePageSAFERRexpertV.MAePageSAFERRexpertVista.1" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{588363CE-A68D-4EDD-9ADE-38B362F8217E}\1.0\ = "MAePageSAFERRexpertV 1.0 Type Library" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{588363CE-A68D-4EDD-9ADE-38B362F8217E}\1.0\FLAGS ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 3400750074007e002c0069005a004c00780037006200340029003300420034003f00440045005400460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e00300062006900480044004e00490038004000340061006a004500540046005f00360065005300330000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CFD2C1F142D260E3CB8B271543DA9F98\FT_VC_Redist_CRT_x86 = "VC_Redist_12222_x86_enu" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CE394852-2398-4231-9B74-D5785945C9AA}\ = "MAePageSAFERRexpertVista" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE394852-2398-4231-9B74-D5785945C9AA}\InprocServer32\ = "C:\\Windows\\SysWow64\\MAePageSAFERRexpertV.dll" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{588363CE-A68D-4EDD-9ADE-38B362F8217E}\1.0 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6175CCBA-7348-418B-BE47-0998BFA6C292}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6175CCBA-7348-418B-BE47-0998BFA6C292}\TypeLib ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE394852-2398-4231-9B74-D5785945C9AA}\ProgID ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFC,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 3400750074007e002c0069005a004c00780037006200340029003300420034003f00440045005400460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e0028005200290025005200690047002d007900330033007e006a006f0054006300420060004b00650000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CFD2C1F142D260E3CB8B271543DA9F98 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList\Net\1 = "f:\\ce36db98bfc97064c2a1665a452572\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1007C6B46D7C017319E3B52CF3EC196E msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAePageSAFERRexpertV.MAePageSAFERRexpertVista.1\CLSID ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MAePageSAFERRexpertV.MAePageSAFERRexpertVista\ = "MAePageSAFERRexpertVista Class" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAePageSAFERRexpertV.MAePageSAFERRexpertVista\CurVer ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6175CCBA-7348-418B-BE47-0998BFA6C292}\ProxyStubClsid32 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\CFD2C1F142D260E3CB8B271543DA9F98 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE394852-2398-4231-9B74-D5785945C9AA}\ProgID\ = "MAePageSAFERRexpertV.MAePageSAFERRexpertVista.1" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE394852-2398-4231-9B74-D5785945C9AA}\InprocServer32\ThreadingModel = "Apartment" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1007C6B46D7C017319E3B52CF3EC196E\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1007C6B46D7C017319E3B52CF3EC196E\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF23F9A2-A2D1-4F82-8BB9-142EEE26CF80}\TypeLib ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{588363CE-A68D-4EDD-9ADE-38B362F8217E}\1.0\HELPDIR ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.ATL,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 51005700510038004000640026004400640035006c0036005b004f0067005900790075002b007300460054005f00560043005f005200650064006900730074005f00410054004c005f007800360034003e00250075006600520074002b007a00310046003500260076005b00700067007b004500540055004e0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1007C6B46D7C017319E3B52CF3EC196E\SourceList\PackageName = "vc_red.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF23F9A2-A2D1-4F82-8BB9-142EEE26CF80}\ = "MAWS_KFTCRP Class" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7BEB9232-028D-4DA9-9EE4-7F79672E93E2}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE8F1ABA-6766-471D-B1C5-731BC4D51B84}\TypeLib\Version = "1.0" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE394852-2398-4231-9B74-D5785945C9AA} ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MAOnFPS_KFTCRP.MAWS_KFTCRP.1\CLSID ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7BEB9232-028D-4DA9-9EE4-7F79672E93E2}\1.0\FLAGS\ = "0" ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5036 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3824 2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3824 2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 4220 markany_ImageSafer_v5.18.0307.exe 4220 markany_ImageSafer_v5.18.0307.exe 4220 markany_ImageSafer_v5.18.0307.exe 4220 markany_ImageSafer_v5.18.0307.exe 4220 markany_ImageSafer_v5.18.0307.exe 4220 markany_ImageSafer_v5.18.0307.exe 4220 markany_ImageSafer_v5.18.0307.exe 4220 markany_ImageSafer_v5.18.0307.exe 5068 Synaptics.exe 5068 Synaptics.exe 768 Synaptics.exe 768 Synaptics.exe 3436 msiexec.exe 3436 msiexec.exe 3436 msiexec.exe 3436 msiexec.exe 4220 markany_ImageSafer_v5.18.0307.exe 4220 markany_ImageSafer_v5.18.0307.exe 4220 markany_ImageSafer_v5.18.0307.exe 4220 markany_ImageSafer_v5.18.0307.exe 3136 IMGSF50Svc.exe 3136 IMGSF50Svc.exe 3136 IMGSF50Svc.exe 3136 IMGSF50Svc.exe 3136 IMGSF50Svc.exe 3136 IMGSF50Svc.exe 3136 IMGSF50Svc.exe 3136 IMGSF50Svc.exe 4788 IMGSF50Start_x64.exe 4788 IMGSF50Start_x64.exe 4568 IMGSF50Start_x86.exe 4568 IMGSF50Start_x86.exe 4568 IMGSF50Start_x86.exe 4568 IMGSF50Start_x86.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found 688 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1156 install.exe Token: SeIncreaseQuotaPrivilege 1156 install.exe Token: SeSecurityPrivilege 3436 msiexec.exe Token: SeCreateTokenPrivilege 1156 install.exe Token: SeAssignPrimaryTokenPrivilege 1156 install.exe Token: SeLockMemoryPrivilege 1156 install.exe Token: SeIncreaseQuotaPrivilege 1156 install.exe Token: SeMachineAccountPrivilege 1156 install.exe Token: SeTcbPrivilege 1156 install.exe Token: SeSecurityPrivilege 1156 install.exe Token: SeTakeOwnershipPrivilege 1156 install.exe Token: SeLoadDriverPrivilege 1156 install.exe Token: SeSystemProfilePrivilege 1156 install.exe Token: SeSystemtimePrivilege 1156 install.exe Token: SeProfSingleProcessPrivilege 1156 install.exe Token: SeIncBasePriorityPrivilege 1156 install.exe Token: SeCreatePagefilePrivilege 1156 install.exe Token: SeCreatePermanentPrivilege 1156 install.exe Token: SeBackupPrivilege 1156 install.exe Token: SeRestorePrivilege 1156 install.exe Token: SeShutdownPrivilege 1156 install.exe Token: SeDebugPrivilege 1156 install.exe Token: SeAuditPrivilege 1156 install.exe Token: SeSystemEnvironmentPrivilege 1156 install.exe Token: SeChangeNotifyPrivilege 1156 install.exe Token: SeRemoteShutdownPrivilege 1156 install.exe Token: SeUndockPrivilege 1156 install.exe Token: SeSyncAgentPrivilege 1156 install.exe Token: SeEnableDelegationPrivilege 1156 install.exe Token: SeManageVolumePrivilege 1156 install.exe Token: SeImpersonatePrivilege 1156 install.exe Token: SeCreateGlobalPrivilege 1156 install.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe Token: SeRestorePrivilege 3436 msiexec.exe Token: SeTakeOwnershipPrivilege 3436 msiexec.exe - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 5036 EXCEL.EXE 5036 EXCEL.EXE 5036 EXCEL.EXE 5036 EXCEL.EXE 5036 EXCEL.EXE 5036 EXCEL.EXE 5036 EXCEL.EXE 5036 EXCEL.EXE 4788 IMGSF50Start_x64.exe 4788 IMGSF50Start_x64.exe 4788 IMGSF50Start_x64.exe 4568 IMGSF50Start_x86.exe 4568 IMGSF50Start_x86.exe 5036 EXCEL.EXE 5036 EXCEL.EXE 5036 EXCEL.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3824 wrote to memory of 3364 3824 2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 82 PID 3824 wrote to memory of 5068 3824 2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 83 PID 3364 wrote to memory of 4220 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 84 PID 4220 wrote to memory of 3164 4220 markany_ImageSafer_v5.18.0307.exe 85 PID 5068 wrote to memory of 1784 5068 Synaptics.exe 87 PID 768 wrote to memory of 1852 768 Synaptics.exe 91 PID 3164 wrote to memory of 4164 3164 MaRPackCheck.exe 92 PID 4164 wrote to memory of 1156 4164 vcredist_x86.exe 93 PID 3164 wrote to memory of 2080 3164 MaRPackCheck.exe 96 PID 2080 wrote to memory of 4052 2080 vcredist_x64.exe 97 PID 4220 wrote to memory of 3548 4220 markany_ImageSafer_v5.18.0307.exe 99 PID 4220 wrote to memory of 2968 4220 markany_ImageSafer_v5.18.0307.exe 105 PID 3136 wrote to memory of 4788 3136 IMGSF50Svc.exe 108 PID 3364 wrote to memory of 3500 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 109 PID 3136 wrote to memory of 4568 3136 IMGSF50Svc.exe 110 PID 3364 wrote to memory of 2656 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 111 PID 3364 wrote to memory of 4996 3364 ._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\markany_ImageSafer_v5.18.0307.exe"C:\Windows\system32\markany_ImageSafer_v5.18.0307.exe" /q3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\MaRPackCheck.exeC:\Windows\system32\MaRPackCheck.exe4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Public\Documents\vcredist_x86.exeC:\Users\Public\Documents\vcredist_x86.exe /q5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\f:\ce36db98bfc97064c2a1665a452572\install.exef:\ce36db98bfc97064c2a1665a452572\.\install.exe /q6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
-
C:\Users\Public\Documents\vcredist_x64.exeC:\Users\Public\Documents\vcredist_x64.exe /q5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\f:\1f2577bf968cf44e8035ad8f66b64b31\install.exef:\1f2577bf968cf44e8035ad8f66b64b31\.\install.exe /q6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4052
-
-
-
-
C:\Windows\IMGSF50Svc.exeC:\Windows\IMGSF50Svc.exe -install4⤵
- Executes dropped EXE
PID:3548
-
-
C:\Windows\IMGSF50Svc.exeC:\Windows\IMGSF50Svc.exe -start4⤵
- Executes dropped EXE
PID:2968
-
-
-
C:\Windows\SysWOW64\MaRPackCheck.exeC:\Windows\system32\MaRPackCheck.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3500
-
-
C:\Windows\SysWOW64\MaCBFltInstall_X64.exeC:\Windows\system32\MaCBFltInstall_X64.exe3⤵
- Executes dropped EXE
PID:2656
-
-
C:\Windows\SysWOW64\FontInstall.exe"C:\Windows\system32\FontInstall.exe" /q3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4996
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1784
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5036
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1852
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3436
-
C:\Windows\system32\ImageSAFERDrv64.sysC:\Windows\system32\ImageSAFERDrv64.sys1⤵
- Executes dropped EXE
PID:1604
-
C:\Windows\IMGSF50Svc.exeC:\Windows\IMGSF50Svc.exe1⤵
- Executes dropped EXE
PID:4184
-
C:\Windows\IMGSF50Svc.exeC:\Windows\IMGSF50Svc.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\system32\IMGSF50Start_x64.exe"C:\Windows\system32\IMGSF50Start_x64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4788
-
-
C:\Windows\SysWOW64\IMGSF50Start_x86.exe"C:\Windows\SysWOW64\IMGSF50Start_x86.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4568
-
-
C:\Program Files (x86)\MarkAny\ePageSafer\drivers\x64\cbfltfs.sys"C:\Program Files (x86)\MarkAny\ePageSafer\drivers\x64\cbfltfs.sys"1⤵
- Executes dropped EXE
PID:2112
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Synaptics\Synaptics.exe
- Size 19.2MB
- SHA256 cdd3c7c0cc5a694d7b9cf343608f1bd17ab9c90376bd3db7ccb234e36844f688
- MD5 572b4772d88d296f723220c8562f95dc
- SHA1 28357c4ae607279c6fb5d243a9420e8ba10adf79
- SHA512 c793f4a3829e890550726e6433dea7c40f3a25fa38171ea6fa697393811fffedb6c2329eb35229bbf766e6c1dca0c2450a926f162b3a32eac8d8d318102c9af2
- SSDEEP 393216:oVHoIKlQYV/WW5TJz5h+oG6b9cioCMrBXFifEOEA5JS84pteRpf:qovmo/WW5TJzas6lXr/mDJV4p2f
- TLSH T15017232372A05076C0F28D3D8C37FEE470B637279E5168BA77F96ECA1A355D0A612583
- MD5 SHA1 SHA512 SSDEEP TLSH
._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
- Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_572b4772d88d296f723220c8562f95dc_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
- Size 14.5MB
- SHA256 d4ba2431f1b5e3385d7604dd9b08d4a7259cc51721f5fa52a2149a141f012d47
- MD5 7a119cb6e7a37a1e93097d68c60b1db1
- SHA1 2a6196e7d6e5738ba7d09f9ddd60e98524fb2816
- SHA512 f3b9420cdc3caeed5523a6b321cf9aa842a0e05f6ffaef3c1e40775eb61bd035b142dd25537624bfd25ce906282b5f361d89f2f3da55178c4c7d7da401e36fae
- SSDEEP 393216:JQYV/WW5TJz5h+oG6b9cioCMrBXFifEOEA5JS84pteRpq:qo/WW5TJzas6lXr/mDJV4p2q
- TLSH T15CE633CC1CF67424E1B29EBB68A2BD7880097B17E5F6183653757FB35838E74BA48904
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9E685E00
- Size 23KB
- SHA256 0078162e2d6c7436ad9635432fd89d2a5e040589899cdb092cbc05c4a4d8a1d6
- MD5 b170a53040859db228c5a9f0d25a15d1
- SHA1 8dae7446a8554f3ec077df3a2511903f3150e207
- SHA512 f6831b6975f22b48ad2627a4255bb0303759486e956be24f209d989efc0fae13df0d9e23f8b6db16f545cee48ef3f06b1f67e1c86cc7607b5d93f37ca687cbe5
- SSDEEP 384:MHU2/HtSp+o5bjmUk1Rc/2fmhMBmmbP45UdR87QAGNzNVInl:MHU2P04o5bE3SpMmifgkAGNRinl
- TLSH T15BB2D00BD340FC4EFA155C39922D0272E34E3E498D0A7C8EAA61F9569F82D4B130E9D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\VWL8BD0.tmp
- Size 392B
- SHA256 81db41d2d0d92f4f681b3014a2f17f792304d5bdf945fd5019cfca6af6031a94
- MD5 047fc0191af2943970ec148fcdf60078
- SHA1 b6d6f62eb4f5636d34947b02644a826bf68be25f
- SHA512 e60efd39138c0fc105e44fa0a29c845a6e86d1898ef3d8685e172d97c41b01ee7cc8a18253b79bb1424af900fbf6e96d2a047449e884f3e003dc1a08a7695c62
- TLSH T1E0E01A7A62DA651CFDF2DE8E82FA52636B75BE643878C50C20EA234C50E6001A1B1767
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2DA9.txt
- Size 1KB
- SHA256 b5b1bdd6c8efca87a5cbc21bfb435961957208f4064e68869babb5bb80ed7218
- MD5 72e591cf336f88fd690bfaad4d30ff5f
- SHA1 de60f0ee2d3bfaa3518de61b1d19d46d8af33250
- SHA512 bbb21a2c2021e7c53b82324243d7a1ded21614199c301ff57468cbdbe7a28d3896e07f9339ece8bcbfbaa26c59ebacb0076fae9088edadccf88c388fa5005b46
- TLSH T18C31C3682BD50D1AB5B39707BEF3C1526A33FDD578348B4C32898219466BD066CA837A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2DB6.txt
- Size 153KB
- SHA256 5921f1d3790ceae0c9a5dfa252f8b9d865d541d6939e6e8b7889a76ef1a4d34d
- MD5 6b080ca62a81ad3a88b221c231f057e3
- SHA1 aaea30182d1ff8a18ed10b1995428cc4d4840898
- SHA512 b615149823d160ba4a7ce3cd3b0f6913a6e49d67a5b2d86ffbea4d5a4387ad7ce976c14c85a1be035fd9735760c13926acb229041d9e45da4abda6b825e99a1f
- SSDEEP 1536:kteSnjKxwnksFjfah1IR0SQJN1g+frkNK2KXnj3Gx8rxHdnoKxDlix8hqtx7G0r2:Eu
- TLSH T1F4F37B381EF60316B5BB9A839EF381137933BEA9F935C54C7244830D06A1A05957AB7F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsg6211.tmp\MaPlugins.dll
- Size 9KB
- SHA256 379a34474a239a118746a67170aa9c3aa22c86ac5b646ed58f2f3023639cc137
- MD5 72d4d22b2f59af9e40333c6c35cd9da0
- SHA1 4ae18123f36e08430de0d8cc934eb45ec4231ea3
- SHA512 ed723e38a1fbe722c216cfbfa94bd8c956ac4e336edc00721adbbec9a015b1bf044121c5f2ea4e84873790e21ee22abdb327b7ed157a6f0d0730adcc56cc4d38
- SSDEEP 96:XZ2XBx18a7e9itv2tgKN5zPdqc5lGm5DNQPBTI3XAp+RqR1xQj8OC7tCETP/z:J2XBx1B69i4ge8cymA5M3X+EqRO87TP
- TLSH T1DB12D728A6870126F65A0FF2BE9382964BBD7A1333E6207FF74501991DD0641E8B0776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsg6211.tmp\System.dll
- Size 11KB
- SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
- MD5 9625d5b1754bc4ff29281d415d27a0fd
- SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
- SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
- SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
- TLSH T1BD325D06235081F3E1914138846B3E175F6A15069BF58E97DFD38646BE30BE7BD79503
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsg6211.tmp\nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- TLSH T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy9AB5.tmp\System.dll
- Size 11KB
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- TLSH T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vw8zz8U1.xlsm
- Size 17KB
- SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
- MD5 e566fc53051035e1e6fd0ed1823de0f9
- SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
- SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
- SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
- TLSH T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Documents\vcredist_x64.exe
- Size 5.0MB
- SHA256 06abf71e4b4cfc446d311ed12bad2266139df6901820b23ba44fc3038f40365f
- MD5 eaad14d7809207da4e1afda3614802a6
- SHA1 f06190ac2cd0ae0c065a38b2b22693af43db316b
- SHA512 f9b69adc24ac56b74ebd8452f49cfbdb6813beb51b7cc4e0500358d27f95f919aadf6eabf099cd2b140aef78d1634807cc88dc97831cf3b0437ade62099e3d3a
- SSDEEP 98304:vce3XQoI3neqsutviL+SZa2hi2ZWpZbCC9rbjz5a7oCs1TiQK:vc1uGTSZvjWpZTlb/l1HK
- TLSH T1453633C636D86A80F0105B3A4AF3EFE768B677159026E1533997F0C21A607C297F661B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Documents\vcredist_x86.exe
- Size 4.3MB
- SHA256 1336c1b517cb9384dc86300c934a58d5902205a6dc846d2e2f517e4c139b56c7
- MD5 c71f73f3c800650c6a308673827d3f96
- SHA1 4e85affe0eb7386a73d20f95b5cc16f0c6e5ab19
- SHA512 a865f63c58bc12a494e365e868ba352e962a219e59cd02da4575cf1d24da4099013046a35af57ecc07a75fcb543e721081889b606dfd0a52c66ff4e8a4fbc3fb
- SSDEEP 98304:xOZQLmFQ+pJonN69Epgcu7FNEiMeTPL1R6teYc:xEQLmFLpJkN6H7F5MebL1Rv
- TLSH T1C226332487C70F95D2DA29F945E1EFCC95DEFC4B97088209F8B66CC0C622A48975FB19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\MAOnFPS_KFTCRP.dll
- Size 76KB
- SHA256 836df10ece269c8b1d32f9cdfadae958415edc2092616d9ffc243681a15a4a50
- MD5 0282c2970563421637cb3e9aaca651d6
- SHA1 f410ae5d59d389b79a7692321c124aef9f4ccafd
- SHA512 ae80564fdbc70088b61ec1c5ad5a008d679aaa73cf8f0b985e22256cd7425310f89751c49cf7a706a28e361e8171c0b718e56b8749c802eced2e33281869e42a
- SSDEEP 1536:QFqMUvb2uF8wa36dTTyEKytKtg6V1wDxp:Jt2uF8wFkEKy8tgdX
- TLSH T11E737C02375080F3C68547748A969B168BB9BF501FE958436BA136CF2E327F1E73A247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\MAePageSAFERRexpert.dll
- Size 397KB
- SHA256 b32665fdd859ba893221a14fece7e10a2e8792a865c70f00f8579d21e0d510a9
- MD5 958c4097113c161db929bb6d9ae23c71
- SHA1 179607574331c20d4984aef9eaa7c015a194b68e
- SHA512 e07fee43c33427ac70c21ccffcf1382b4bf653e78f4fe973d7ae683ccb5e4fde69803e470fdbc3dbacd38e7aa26d77fd200b57d8a4e6cde7d3ddf961f476478f
- SSDEEP 6144:pLoj3tlQS2/SaZKKm0/o83rrXJTBld7VZae:pLo0WaZ67snXJTLd7Lae
- TLSH T14E845902B980C4B6D45A083ACC97D6FE4A797D19DF2491D3B7C43F6F7931391A63228A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\MAePageSAFERRexpertV.dll
- Size 135KB
- SHA256 a446411eb9c7fb1bc33036c8231694f9cb5fcb7ad33afacca91e98f5e3a1f143
- MD5 64d4e2481360b9eec97258a2fff1a338
- SHA1 b1473b33851e037507ce5463f55b41e86a1d3fe3
- SHA512 ea0e0aa91b8e0cb0125975e9901194c808f99512f0d18edbacca0d148bcc2873dc5ad1508cbb84ebeb8b82df85c728c83ecc34a2c9bf83ade81407b236a63de5
- SSDEEP 3072:Dq7g61lHI2dAy/LsaaB2Q5QkWvmS5/CYR:Y1BrA2spBckf4B
- TLSH T16DD38D2232D4C072D59E443D8952C7715BBBBC60CEA5498B3FA423AE5F353A19F39346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\MaCallbackFlt.dll
- Size 146KB
- SHA256 14f518920f2252a6bce6e8541a23768bfc1dea4255b21b6a9988bedbdc96e652
- MD5 d38e4b869bdc1acafb60fdb57af52473
- SHA1 5d8b1dbe43d5a5246aa255196fa7daf628954960
- SHA512 dfdc5c75bde21b9705afad353cf505d9ec7f722f08f7403e17c84b1614e9c62fca62b47888c0fcfd1a6a01b2749238bdbc927fa500eeaf14662c1e628ff57234
- SSDEEP 1536:zT8q2ALTijwls96xPP6MzwqSHnEeAmboQR2v//FJZHmUTkCG2Y/N5U/8Xb5UYJrk:lCjexPmErTRv/QUdSrU/8Xb5UYJk
- TLSH T191E39D217E95C873E59B05BC4822C3A61E3F78365B3058C37B941BB98B217D2DE7934A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\MaProtection.dll
- Size 46KB
- SHA256 02a4e57646afd73c27d11069313685de28e42ce49b9738042210152bfa54da35
- MD5 97295f4677f40f408ffcd82e16e14779
- SHA1 97467095812c1421d7131c92144934f643ad0ae8
- SHA512 e7c9c3324314c08f8b12d9c9738e7bb080810ebbf2b63aa94c5dbd92cc6b5ab5c095673929c5c6cfbee900bedac79ca9fe88f91e51a8a74c0ed89f1a8ca47da6
- SSDEEP 768:sDWq2Sp52KPkpsupepi9y1FI/rTARsUALzBkk1naYRlZna:siqTp5hpmy1FEAROrJRXna
- TLSH T12C235A007513C073C40A5539146ACBA159BEBB122BF790977FBB13AE9F313C1A63A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\MaRPackCheck.exe
- Size 58KB
- SHA256 6a0d1132e0e5ab7e0b71779f16dbfdc1f37b29f8937c9259d68d7d5c9aa3f23b
- MD5 c0c550881fc0d4daaee3819cd8fcf89f
- SHA1 ba357336dfc3ebf0cd92023e86e3c5ce8a31616e
- SHA512 b2e36115dbec41acd23de3c56fe6e1988226556c64f5fdc06f7da8223bd7f9d928a318f7e8096f9e7f82ae03bdb47cceff4790646d25d945ae1037c0c81d6151
- SSDEEP 768:skLLuxEDX00467k3FZqs01C/uKiB9Sf5O8lCFttmL8KR8OrAGx7:skH0p/67kVx92AczttmQKR8Or77
- TLSH T1E0439E2729E0C033E4A3C97001F58B1B9F7BB755076159DB97A8589A3F61FE16A33207
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\markany_ImageSafer_v5.18.0307.exe
- Size 1.4MB
- SHA256 265a6af14cbed6324e0a11d95697da903a86154af313b76cbd00adf6e45a4e50
- MD5 06a156c5bd363253d2ff23932b18392e
- SHA1 a3c0113c38208015c276168f08dce4d351e38b7e
- SHA512 09b57cbf7b7da09588f6881fa3b120aff3437f7d488af3e4df80b74d05d07b1200d278f47f4129770bb9bd3a0c5a34ba03833ca42a7f3e1c3a29085fe7161e61
- SSDEEP 24576:hDsS5QZiN8ieoY/Aw4Oh7eEz7Zy/Bpi+KMzi+8ppJjwwFHUZcRqol/KkpZNCGRyj:FhiZK8juwRh7eU7Zyj0MziLvjzH5l52j
- TLSH T1A26533C35850C866D8E35E3B4CB12D3A592FD211C8443E1B87A8CDA1BF66666D72CB98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\ce36db98bfc97064c2a1665a452572\install.exe
- Size 547KB
- SHA256 e63a5274b437b55c65bf1259a25bbf602335f466f5d01e4ad0291be21e3edf3c
- MD5 828f082302e94cbfbb1f3f13e491c706
- SHA1 bfd17b3f08461e501fd625518de8660ea8b4f4db
- SHA512 ce7b613254e9622ffc455368cc9ec8c31eb12253dddd34e07843f944ed9b2e260148762203eec0d29e268c1f771ecf3f3f731289731cebe1fc4359ccadc0c049
- SSDEEP 12288:jkaeBKGNVzadJ4V+HvRfun9YVxi6zVpJXgfdfr:ApF+HvFuYi6zV/wFfr
- TLSH T11FC46D307EF48035D4F351B496AD626551B9FC700B3984CBA38453FEAAB07D1AA35BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\ce36db98bfc97064c2a1665a452572\install.res.1033.dll
- Size 85KB
- SHA256 597151959d4264234fa25ebe470516125d36ed57c13baa1df7933b4019b3f314
- MD5 267642394c0d8b1c9a2dc279ce21ef43
- SHA1 b69de3e259c264f0650018c6fa3bcc1ccab5bb2e
- SHA512 65b2b62960a023b5010ba697f7eebe7bf30744c6214cb39f5bf0d283336c9fb6323779ab041dbae43dcebb183ddaab7513628494c486b90891e611159f2529a8
- SSDEEP 768:eP/1vPhLnHqCHyDRO6ApsnzwPu1+IiPMRrphO/CaqpuK6tm7z4qjXHUa:OvPhLsOazwPIRrphO/CajrqrHUa
- TLSH T16183510177F88525F5F73B74ACB956701E7ABC91AE38C28E2280219E4DB2AC0DD74763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\1f2577bf968cf44e8035ad8f66b64b31\install.exe
- Size 834KB
- SHA256 3d2bdad60f7fed1243072c1ed268ce3c3d7a0f9c4d8bd5ed811c6d1d868a4ae7
- MD5 dbfd18f9dd13466964c09d522893c594
- SHA1 06f756afa088e6ebbb510573ddb3edb8c9a3cc57
- SHA512 864e5012e11d85397fcfabde0c6e6b54a77156655c125bef0c85404abc9d386c4fe391116916884fd01c77f17fb28fa793f14378a0036746d0d136fb4240a3f8
- SSDEEP 12288:UPIymlbqZ3S3Ah8enys2yTH8jDrcKVHZ+RVQsFFguO5qpT4REmONt0k:UPTmxqU8jys2AH8jDrBHZ+oOFgvvOUk
- TLSH T11F051A15FAA84179E07AD57FD7A38656E27234062B3596CB03128BEB0E37AD5C335332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\1f2577bf968cf44e8035ad8f66b64b31\install.res.1033.dll
- Size 84KB
- SHA256 f5dbe5a1cd8cdab7c483f17aed9cb485ae8a385b241ac550ce38c84a0c7dd1bc
- MD5 1234c94116cecbb9ea602db8793c2086
- SHA1 743ff2607683ffb37e871d1d4a81b8b2e53069c4
- SHA512 63d0bd538f7f99bd14589ba030faee86999f0bbe7117f75c119234cd09dc9d9989557d07f8a824dd0e2618801ea0c7ed07db3f82024b4ddc21af89dc30fe1fff
- SSDEEP 1536:kCcdi4cluhIaUAy4KdDgrW2hO/Cajdq5L:kCcdi9lc96UrRhO/Cajdq5L
- TLSH T14A833E4267F84128F5B72B34ACB55A756E36BC96AF38D28F0250605E0EB2BC0DD74763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\1f2577bf968cf44e8035ad8f66b64b31\install.res.1041.dll
- Size 75KB
- SHA256 6ae9abb89bd7a23803f48c263dd29e3ed49cbf24de1204d621ef518d95485aba
- MD5 3a4046cdfaa22ae1f8f4e2991a6117cd
- SHA1 0e190fcc9f4640987be11cc4f78d7a886df2b397
- SHA512 cdf593363e8212fa4ee05f9fd5dcc84f968a24192e1c3844d74ff673706bc88bf9c0c2bd033a1cd2fcb9f335809536648283b8e2225d7d6d1f06f16a05db7d2e
- SSDEEP 1536:kZcdi4cluhIaUAy4KdDgrSrO/dasPBK7YDJZ/w:kZcdi9lc96UrCO/dasbJZ/w
- TLSH T18473174872A0457AE4B6423588F2BBA5ABB4FC8547B506CB069CF41F1D327C85F393B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\1f2577bf968cf44e8035ad8f66b64b31\install.res.1042.dll
- Size 73KB
- SHA256 427bda731938cc5f2f9e645da0affb976f55d2320ca1b4c6375b068981122ea0
- MD5 3e4b26a084ed2f96beec5eb3ccfe665e
- SHA1 0d38a3e29b25a67fc9f674dac477941028095621
- SHA512 442264b317d72a310ab4dae38f2b1f457dfd56233433d9e5bdeab39840cf2f7d7299a78c63a9f3903cc05743ea919a073b0cdf66bf2a2c93429e0a6c2ae0ada3
- SSDEEP 1536:kwcdi4cluhIaUAy4KdDgr5BO/iaE5IelPpQpwIzvqrHUE:kwcdi9lc96UrrO/iaHvqoE
- TLSH T11D733A4A62A49072D421473598F38BA7A737BC815B2A12CFA360B42E1EF77D4DD343E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\1f2577bf968cf44e8035ad8f66b64b31\install.res.1049.dll
- Size 86KB
- SHA256 4768c79c74d51fc94940de3ca3b2f1df2c6678cccef987537db6ba7e5e97908d
- MD5 3e3b2a14e17f3e3330dc700fde8e8af2
- SHA1 0468b35f2e93c4e4395911dc6cced57f4f86bd42
- SHA512 557b35dae8acff39c3813c678e2ba7c1d170408658072aab355d4ad6a3e69cdea5fdeba0f577d5203c24c9646262d237217b45e33071e363f20cb45ab5578327
- SSDEEP 1536:kBcdi4cluhIaUAy4KdDgrasO/ck4g7Z/FK:kBcdi9lc96UrdO/ck4g7Z/8
- TLSH T12F93940FF6789160E455C2744A738AE32575BB40132952CB529FBC6968BA3F4BB383C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\1f2577bf968cf44e8035ad8f66b64b31\vc_red.msi
- Size 226KB
- SHA256 dd6b7459aff8b29d19164e429b7e4d3b1f331e06191a86a4f12520b8bd6835b2
- MD5 36fa686b188b7012c1e616ac0e21004e
- SHA1 13c7e0116993d0829f12abef4080bdf29d955a7b
- SHA512 3b9223b9ce488d2dc600349fc96accf9f4b41e99f19ac58734548b8afee36691b6f5ae84a338c4432d922ceab32850b6f5036302e4856a3d8d0075b09e8b2761
- SSDEEP 3072:aZhkpPqo6SChupVksKCM4GzFumfvfBX58M+q5SDkIai2Nm1BWVcqelSxbwBnZ1:ehap+s+3zFu48AcD3aaTV
- TLSH T15B345C06B3468033D4016372819B9B56AFB5BE960B224BDB16AAB34C1F737D1D636389
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\VC_RED.cab
- Size 3.7MB
- SHA256 66f27dc82a9dce30e5bd74aea9cc00d8d25d5f473666715d829162fe527bf1f9
- MD5 f84e6c9efa97c4dbf8eb9aad0fc019de
- SHA1 ccc1f76c74d956ab97169e4b3f5388125a2d51a6
- SHA512 2ea2d5346804a2b822bfff5705eea328c2eb71475744c7e59ba2a48e6294a9f6f43fafbf2d086421ed11f09c2e077a988003dcdaf348684359e99c8cbdb4325c
- SSDEEP 98304:7oKfL8aHcUGQRV6kQ5l62SsHOB6QmcEGl:hfL8a8UGE6hSsRQp5l
- TLSH T1B20633A18787AED2CE0923FB0520DFCC65EAABAFDFC55148B4785DC1C222B95E75580C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\eula.1028.txt
- Size 3KB
- SHA256 cfa4f2c6c2a8f86896c5a6f9a16e81932734136c3dfde6b4ed44735e9c8115c2
- MD5 f187c4924020065b61ec9ef8eb482415
- SHA1 280fc99fb90f10a41461a8ee33dbfba5f02d059d
- SHA512 1d5a8e80fb6805577258f87c4efd7c26a9ac1c69f7dea1553d6f26bcc462d2d9c01d4b94077f70110a33b39648c9aa3bb685e10534f19ba832d475e9ee6aa743
- TLSH T15E81A6AC1DF32742F493ABB39D834821C7F1A6912BBA0A77458C87495A7045EB049BD7
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\eula.1031.txt
- Size 15KB
- SHA256 3e4d78fcc11eecb23af12a4eaa316114bb36d39561f6062a3921c08a43261321
- MD5 3168ed3b48c1dc8d373c2abc036574cf
- SHA1 7ffbcfb6cd9b262a0e9a55853d76055693f60c60
- SHA512 9465640705c382bb736e468a2ffb303ecfb2637c55ddca759d1fb190279b98103def64a8c599deaa1439e58c41d7b2c2809332c2a5f18945e9ee3d6c046a5197
- SSDEEP 192:unSQcLPGw05JEwLW4bt9xepjQOw9cqOANn2fxd:u2LPRwJEwK4xypjUGlA12fxd
- TLSH T13862C02167E5961CF6F37F542EB9E3689F72BDE2A87AD51E2340105E48B1B14CA20733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\eula.1033.txt
- Size 9KB
- SHA256 c68a0fd93e8c64139a42af4fcd4670c6faea3a5d5d1e9dd35b197f7d5268d92b
- MD5 162fc8231b1bd62f1d24024bb70140d5
- SHA1 7fa4601390f1a69b4824ee1334bee772c2941a24
- SHA512 a707b5ef0e914ba61e815be5224831441922ed8d933f7a2ffe8aecf41f5a1790a1e45981f19d86aa5eab5ea73d03b0c8e2ab6b9f398ab0154d1c828da6f6beda
- SSDEEP 192:6cJ4sOGsTRyAiLfoIPtjlDxsk4apSfqn7yb/:6cJTYyAwdPtjnszasfzb/
- TLSH T1D1229E15A7FD1208F6FB7F906EB9A1685E3A7CA6AD3EC65D1110105E09B6E40CE70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\eula.1036.txt
- Size 11KB
- SHA256 3456ebc9c6decef8b27b10d97f7f6d30a73b5da0024e1b8a0657e3b9a1cc93d9
- MD5 c360851dfdf51b6ddc9cfcc62c584898
- SHA1 f8fbe6b98039d01700dc49eb454bb1c1d8cc4aa6
- SHA512 a340a7d98b4b6f925a803805224e733433e76230a36c4ab17e28f9d5951b81280d776153414701b29bb05b496b726932683e35fb603587d7ff5b716a88fece8d
- SSDEEP 192:lHcOi0SMq5Gl9EAbGu8xFk7XetMKgTqebK8T25C76j1o3M6ykT4Z9KhI/b:1cOiGF/BN3EWN09UAb
- TLSH T1C9425762A6FA5209F6F27F90BEBD91554F3BBD969D3AC11D1210118E48B1E44CEB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\eula.1040.txt
- Size 13KB
- SHA256 ebafaeb37464ed00e579dab5b573908e026cd0e3444079f398aada13fa9a6f66
- MD5 04b833156f39fcc4cee4ae7a0e7224a1
- SHA1 2ffa9577a21962532c26819f9f1e8cd71ab396bd
- SHA512 8d3f6a900ebd63a3af74ab41ac54d3041de5fe47331a5e0d442d1707f72a8f557d93d2f527bbb857fb1c67dd8332961fd69acc87de81ba4f2006c37b575f9608
- SSDEEP 192:KYCk+hFhpk2i7mJZKVJTlVec3xo3xWScwMnuEz3ZGE88agajQq+Cv:5co6XG9lmhyukqSajsI
- TLSH T1F1528F51B7FD2208F2F77F90BE7AA6684E7BBE56A83AD11E1150109E4871E608D60733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\eula.1041.txt
- Size 5KB
- SHA256 467773ddffdb3f31027595313b70d1ea934c828b124d1063a4aa4dbe90f15961
- MD5 031fab3fb14a85334e7e49d62a5179fe
- SHA1 12370185ef938a791609602245372e3e70db31be
- SHA512 7424a52bbb18a006816ee544d47f660e086557d13bb587d765631307da96aba56d8b9cd3d4e7d50c2a791815273910cef95ebe928bc03dd9c540b97ac7a86447
- SSDEEP 96:JV48yKn6zm4X4zyG61NDyroY1fnODSQJR4Jbcnnik49joxfhUWuNdTvp2U9:JZBn6lYSuxpO4MU7IS
- TLSH T15FC1116C1ABA09BE94F6809758C955F8F7B9F615A2DE0C89044CC88B05548ED730FFBE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\eula.1042.txt
- Size 5KB
- SHA256 3d45f022996cd6d9ebb659a202fbfd099795f9a39ed4e6bbd62ac6f6ed5f8c7b
- MD5 6fcd6b5ef928a75655d6be51555288c7
- SHA1 eafdcc178343780b83f1280dad9d517aaedab9e4
- SHA512 635ba44d8d8ecfbdb83a88688126f68c9c607e452e67d19247dfe7c307c341dad9b1d2dc3eae56311c4b3e9617ab1ee2bd2a908570df632af6de1e1fa08bf905
- SSDEEP 96:A48gbatW+eU2giS0wyGjlH+5YO9M60AoV7nokPJ:MTi+ZREU
- TLSH T16AC152BB3AEDAA813251668017C6A7F7635F7202721F9C81CB90413421E87B48639BDF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\eula.1049.txt
- Size 13KB
- SHA256 f82bca639841fa7387ae9bbf9eca33295fab20fade57496e458152068c06f8a3
- MD5 bc3a8865b60ec692293679e3e400fd58
- SHA1 2b43b69e6158f307fb60c47a70a606cd7e295341
- SHA512 0d9820416802623e7cd5539d75871447f665481b81758c08f392f412bc0fd2ef12008be0960c108d1c1ce6f26422f1b16161705104d7a582df6a1006b0d1b610
- SSDEEP 384:dSqMupEO2FQgf7vmbw6ZZSSOTewMtsKaK4NnszO2W:bkFszk
- TLSH T17852586FF8BC9515A460E2111F628AF710AB7750A328A5CAF2CF7DA8906D53533217CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\eula.2052.txt
- Size 3KB
- SHA256 744275c515354ece1a997dd510f0b3ea607147bbf2b7d73f8fca61839675ba27
- MD5 ec4b365a67e7d7db46f095f1b3dcb046
- SHA1 d4506530b132ef4aad51fcbc0315dadc110c9b81
- SHA512 5e5d1e196fc6ac194589bc6c6ab24e259aed8cbd856999390495fd5ec4211f212c6898e1b63538bfbb4401a5b4da08f3a2e09bca1cfb2e9c2cee38e63190b2a2
- TLSH T1D981096E5DFB1412F493795158A686D36BF315A3573B4DE3088C490C52374CE9830F9E
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\eula.3082.txt
- Size 12KB
- SHA256 c79ff7b9e67aed57f939343a3d5fd4fb01aa7412530693464571148b893b7132
- MD5 c2d1221cd1c783b5d58b150f2d51aebf
- SHA1 3bc9b6419a5f9dcf9064ae9ef3a76c699e750a60
- SHA512 c4ec596814b408e3c0aaf98864e2769c6175dba020f3014dd79f0190d81812020c932afca449e6b8b35233f36f2ab2efad0dc8d0d68dccdb40f6715fb1d050b4
- SSDEEP 192:++hGO8i6aZyiqQm6W7TlR3LycUV2G+74G:+Vi3ZyDVF+mB
- TLSH T11C423650A6F96606F2F77F51AEB991688E3BBDA29C3EC51D0210119E0DB1E44DE34B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\globdata.ini
- Size 1KB
- SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
- MD5 0a6b586fabd072bd7382b5e24194eac7
- SHA1 60e3c7215c1a40fbfb3016d52c2de44592f8ca95
- SHA512 b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
- TLSH T1AF11D64846A04125E2F2485298E21CEA9DAB74235E39E95A00D52BCF9AB4E41FD3634B
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\install.ini
- Size 841B
- SHA256 c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d
- MD5 f8f6c0e030cb622f065fe47d61da91d7
- SHA1 cf6fa99747de8f35c6aea52df234c9c57583baa3
- SHA512 b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde
- TLSH T18201EF63C629518928E6E8B740A00A8ABC519EC973412C54C0512C8C2FEB89BD35AB7E
- MD5 SHA1 SHA512 TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\install.res.1028.dll
- Size 71KB
- SHA256 365555c74e0d81b0ae886b229810512171644d8985b7e56f4f60b777ec893fa8
- MD5 12c90dcbe3990439b30a1750d7d6a838
- SHA1 fa0d6dd105a694260c42c9ca96e08b33fec76fc9
- SHA512 3231e8c3b1c2ec9f261b1981fa14edd5d0d28bc3d065e9523155d3b26c3fedc56a0296d2d29cd734bd06bccd1e281020bb702615baf6ce9b08844e8e1f3934f6
- SSDEEP 768:Uy/1vPhLnHqCHyDRO6ApsnzwPu1+IiPMR6qO/wa2Lc3aE1Nk+6nKz4Z1jf:NvPhLsOazwPIR6qO/waBlx6JZ1L
- TLSH T150635C007591C532D492163884BAD3B1ABBDBDC12B2582C37BDC75AE6DB27D0BD38399
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\install.res.1031.dll
- Size 90KB
- SHA256 a4ed9ad6352cfa6accccf50dc103f6bde4e8d78367ab8f0ef17c497b2d6c6030
- MD5 de3591fbd976bbc0006e09148b345059
- SHA1 3a88b08dc00946046d82872e87fc88911a2d73f2
- SHA512 764570b4ef2df43a7b9c08aded845bae381f8aecb0f6ffe0bbe7d64e72e0c9710d6a531d0ac28cf5c28816d60824f8312fcf1d6978691996d2e82ee98063284c
- SSDEEP 1536:WvPhLsOazwPIRhhO/6NabBfDNh5T8fdXWohToh+ohvodoEuQGKQG56KjtrE4HErj:WHhLsFRvO/6NabBfDNPT8fdXWohToh+M
- TLSH T173933D1163E58629F5F22B34ADB993A06E76BCD1AA35D18F239021AD1CB1BC0DD34773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\install.res.1036.dll
- Size 91KB
- SHA256 66515bfcf8398a5abc7659ec8ef42e9b0de5db0d1f8147aa5fde5169d41b23b5
- MD5 c4edff7bc690871dad6372fe82f1818a
- SHA1 31938b640faec058767ed652c0e997d44fe423ab
- SHA512 3b04c24b030bf8dc9025d668548ad3318f9f379eeca1cf4e3a91a4887121bd2a668e2a643bf9880202e086a720f3d66431ffa029ca3766313246618689dcc3bd
- SSDEEP 768:K5h/1vPhLnHqCHyDRO6ApsnzwPu1+IiPMRyXYO/3aXLNRg41isJafbAgw8XDWz46:CvvPhLsOazwPIRyoO/3aUsJ4pqrHUw
- TLSH T106932D11A3E88521F6F33F34ACB992611E7A7C8AAE35C15E2780659E1CB1B90DD74733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\install.res.1040.dll
- Size 89KB
- SHA256 d2323ad38dc863226c4fc4b0ad49a621100e96265ba17c361603a613f9a8faa1
- MD5 e154e908fea2658dd8e68b85f1d12c9e
- SHA1 8dc6a5ffb6e96c7ef52b610895ee1ae7ebb9a1ea
- SHA512 40f2a7825784ec32ccbe12677853ea4e979946e29dfede23f363ec93a2ad172345d6139cbf43df9b4abd86e482341982ff605babdd62990664170f0021e611f0
- SSDEEP 768:AP/1vPhLnHqCHyDRO6ApsnzwPu1+IiPMRSD+O/2adt6bkWhqKYe8/z4Z1jh5:QvPhLsOazwPIRu+O/2aWbXhqKtzZ17
- TLSH T164934D1167F99625F5F33B34AC7996A41E3ABD91AE34D14F138120AE58B2AD0DC70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\install.res.1041.dll
- Size 76KB
- SHA256 0aeb96829c7350da4519de3667a0202b8be83f6236bd10ab1f3960426eba4ccd
- MD5 cc764b52a03340e5291b6c6a00eb6726
- SHA1 e099cf148a4584502a106c7746caa0797d343d69
- SHA512 677b0a2abc5867ee06605cab9ea272546e975f85bdf7d68a2e73e593ae5513d271289318f1fab2e4313e9b3a5e029b00379db1d164b0d5d026de2ce211321aec
- SSDEEP 768:7d/1vPhLnHqCHyDRO6ApsnzwPu1+IiPMRnyO/da42K4HMobKUzqBK7YDYHz4Z1jI:nvPhLsOazwPIRnyO/dasPBK7YD/Z1M
- TLSH T12B730840B560893AE4A2017844BAF3E02BBCFD9057A145C36BCCB59F59727D46F393BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\install.res.1042.dll
- Size 74KB
- SHA256 d1871469703578f35fb770f295d705ed54e2257ad4daf8cc319d15d4792f9723
- MD5 0cf1ce042664ed53231a1abd3c3acd4a
- SHA1 90f17cc1b9d2765d61d7b7488b180661460ea7da
- SHA512 94c4a3f95ccdaf556560db9b97253d3681f73d85dd5019ad0413f7719c1aecf0cc8c08fed0c4470fb93b2acff208a1427787ce5bf6761208cb8a4d106f0c06c9
- SSDEEP 1536:JvPhLsOazwPIRshO/iaE5IelPpQpwIzDqrHUe4:JHhLsFRGO/iaHDqoe4
- TLSH T11F7318427464C532D451127899FA93B2673EADC05B275183FB8075AE9EF23E0EE343DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\install.res.1049.dll
- Size 87KB
- SHA256 aa4b5c8c52df5482c9c9c51ea95fd0408da5856dfa0da24363c03d07dfab72ee
- MD5 bb8cc77eed188b459ad376a2fe755acd
- SHA1 be984ee3091dc7e3800780e3dc95131660b8be41
- SHA512 60d9c6a867837f35219fac38ff192f7cf2529b3ac3d189e1f189ae8ce14d126cf0628b708476403f152e3122e5dc82dce404dff94d6ec7b212c7bd8bbb2795f7
- SSDEEP 768:Qn/1vPhLnHqCHyDRO6ApsnzwPu1+IiPMRfBO/ckYiE7t0gd7tWdtYZz4Z/ji+T:YvPhLsOazwPIRfBO/ck4gtZ/ua
- TLSH T1BB93B50FF538C521E455D2740A768AE225B9BB50231941C7A6CF7DA9A4B53F0BB383CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\install.res.2052.dll
- Size 70KB
- SHA256 d949ee3b60bbb5037d7ad3c196cb7e195e9936c0f26f3a11cbf51a9b8e38b32f
- MD5 37937b4fb2351a95704982b0b4af6088
- SHA1 c10adb8f1d19318ab3f04c684c7aae7562c4dd15
- SHA512 a338608e9d746a23086f0d4c479c3126d4eb2c04cf87a6e9789ecfdf657a4229efd5577ee6933ce73648eeb607c7a8edc8540c25b851036a71a37f6b63726819
- SSDEEP 768:mU/1vPhLnHqCHyDRO6ApsnzwPu1+IiPMRmiFkd0p4B7QcmSkjsSvz4Z1jFX:5vPhLsOazwPIRmakd0psNhZ1RX
- TLSH T113635B1175A1CC32C582153885BAD7B12BBEBDC11B2586C37BCC76AE5DB22D0BD38399
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\install.res.3082.dll
- Size 90KB
- SHA256 85dc1c7dee6436b4816b3b853b2d16ae8615eb8378b2f2ebdb9187bd49ed7294
- MD5 492875bc841bf1931070d31b748c58c5
- SHA1 591aa5d209a210b53fc0ab6ace1add3fd7cf6ef6
- SHA512 dfeeeec046835733fe4956fc92fb7dc8bd24f3386224a3ec17e0f7c44f97d41145fc6ca254f0fc5ad08a0655da78dbeab0e26346bc504a427cd525f25a2d5804
- SSDEEP 1536:jvPhLsOazwPIR8BO//a3p1yN0mnp4FqrHUy:jHhLsFR6O//aqN0mn+Fqoy
- TLSH T16F932D0066F89666F5F33B38A87956605E7ABC919E39C14E535026AE0DB1FC0DE34B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\vc_red.msi
- Size 218KB
- SHA256 2cc196bed01619b5498a974c19cfcba6a04b7746e84808f06d9e4de3129ab4db
- MD5 e493a21c57d160f4fa023c63145fe580
- SHA1 f57a601c422201ec70650afcd987c132bef26d52
- SHA512 a503f221de3b61aba7aa69e09382e7167dfb4246e1a31884b3381713e50b31b4b04088204b9277208f066127d8c3962b3351b3da1a6f52be3776cdc357d76778
- SSDEEP 3072:2ZhkpPqoVVE9JXgvJVJS5XoZ/eATFNmHK0+E4mN2EJ4Eq5:Kp/QvzJ4ux8W
- TLSH T185244C12B512C133D8402371515ED7A26ABCBFE64B518AA723DD739C5EB27D0933A2CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\f:\ce36db98bfc97064c2a1665a452572\vcredist.bmp
- Size 5KB
- SHA256 594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
- MD5 06fba95313f26e300917c6cea4480890
- SHA1 31beee44776f114078fc403e405eaa5936c4bc3b
- SHA512 7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd
- SSDEEP 24:pS75l775l7aqV7j7Q55okTg2vrlgprDDcaWJQvS2PRSmob6SHSl4CiZ:pKV7j7AXgbjlLI
- TLSH T15EC1E74B200A6854D296603147AECDFB472BADC182E063F631F93E8A36FDC98351E719
- MD5 SHA1 SHA512 SSDEEP TLSH
