Overview

overview

10

Static

static

10

2026-05-04...or.exe

windows10-2004-x64

10

2026-05-04...or.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/05/2026, 14:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
  • Size 1.7MB
  • Sample260504-rmrtjadv6z
  • SHA256 f6d9b78b52bb037af353d2379eab8eb0cffaf0547b71dcb026f27049ca3f3ae8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoveryneshtaxredpersistencespywarestealer

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detect Neshta payload 61 IoCs
  • Executes dropped EXE 17 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4740
      • C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1100
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2296
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2068
            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2564
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3700
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:720
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1356
            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1056
              • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4420
              • C:\ProgramData\Synaptics\Synaptics.exe
                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2420
                • C:\Windows\svchost.com
                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4952
                  • C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE
                    C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate
                    9⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:220
                    • C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE
                      "C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:1976
                    • C:\ProgramData\Synaptics\Synaptics.exe
                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:2676
                      • C:\ProgramData\Synaptics\._cache_Synaptics.exe
                        "C:\ProgramData\Synaptics\._cache_Synaptics.exe" InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:2484
  • C:\ProgramData\Synaptics\Synaptics.exe
    C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Executes dropped EXE
    PID:432
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4424

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Modify Registry

        2
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ACROBR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
        • Size 328KB
        • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ACROTE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
        • Size 86KB
        • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEC~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
        • Size 5.7MB
        • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADelRCP.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
        • Size 175KB
        • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RdrCEF.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
        • Size 9.4MB
        • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AcroRd32.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
        • Size 2.4MB
        • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WCCHRO~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
        • Size 183KB
        • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Eula.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
        • Size 131KB
        • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FULLTR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
        • Size 254KB
        • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LOGTRA~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
        • Size 386KB
        • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        READER~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
        • Size 92KB
        • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WOW_HE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
        • Size 147KB
        • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        arh.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
        • Size 125KB
        • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        32BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
        • Size 142KB
        • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        64BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
        • Size 278KB
        • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEA~1.EXE
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
        • Size 454KB
        • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AdobeARM.exe
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
        • Size 1.2MB
        • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaureg.exe
        • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
        • Size 555KB
        • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOIN~1.EXE
        • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
        • Size 121KB
        • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
        • Size 325KB
        • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
        • Size 325KB
        • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
        • Size 505KB
        • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IE_TO_~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
        • Size 557KB
        • SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        COOKIE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE
        • Size 161KB
        • SHA256 5fee43e3295682e179d6e10c568aeb640bbbcf0d6b962fd27f5b372a45fc272d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe
        • Size 6.6MB
        • SHA256 4ea8adca8a7f73fc71c7e45ef98f8c422a8b161ca6b6fcd912aec701bebd08a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~2.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE
        • Size 1.1MB
        • SHA256 550e6ad6b5fb0dabd28d9009c790b22e9444fc9fc30e952210727f6ac4a00389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~3.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~3.EXE
        • Size 1.5MB
        • SHA256 eb9bbc44c181ddef0d8b53b69bd7327f5c150c0b72d92805a9f3a9ba333f0575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NOTIFI~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\NOTIFI~1.EXE
        • Size 1.3MB
        • SHA256 447a7ccfbece37792dfd82e6cf4e644e261dbe0f3e23a13c475276e8e4fa3561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PWAHEL~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\PWAHEL~1.EXE
        • Size 1.1MB
        • SHA256 c57f8707c1fda09d33efc6b615c0d48174253e9869772841446302748f1f9016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe
        • Size 3.8MB
        • SHA256 6773bf49098b9fa85725651bc789ec2bcef5dd563a356043468c1f7b235defef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ELEVAT~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\ELEVAT~1.EXE
        • Size 3.8MB
        • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\MSEDGE~1.EXE
        • Size 3.4MB
        • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PWAHEL~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\PWAHEL~1.EXE
        • Size 1.4MB
        • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdgeUpdate.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe
        • Size 250KB
        • SHA256 81df1bd3d6a8fbc580ad8b7d1c40aa92851b49eae10f1f6920f096b76524a4e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ie_to_edge_stub.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\BHO\ie_to_edge_stub.exe
        • Size 562KB
        • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\INSTAL~1\setup.exe
        • Size 7.1MB
        • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cookie_exporter.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\cookie_exporter.exe
        • Size 155KB
        • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\elevation_service.exe
        • Size 2.2MB
        • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        identity_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\identity_helper.exe
        • Size 1.4MB
        • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_proxy.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge_proxy.exe
        • Size 1.5MB
        • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_pwa_launcher.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge_pwa_launcher.exe
        • Size 1.8MB
        • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_click_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\notification_click_helper.exe
        • Size 1.6MB
        • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\msedge.exe
        • Size 4.0MB
        • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX6712.tmp
        • Path C:\ProgramData\Synaptics\RCX6712.tmp
        • Size 753KB
        • SHA256 4dcae97eb5017edd627a55bccde72df8420e65948ece25967070c45e4690bedd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
        • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
        • Size 990KB
        • SHA256 f257a6fea80db5faea3ee86986d06899ff0299b818b70e723a824a12fa7aa606
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache__CACHE~1.EXE
        • Path C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
        • Size 196KB
        • SHA256 84f69d439cdee84afd417529680730509fd0f11e7e0a9e4f1ba75d15410f6f12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
        • Size 949KB
        • SHA256 fa322f0e2c97cdd994b2aaf53ac94f53f02e08c049863604ece62675b3f13c6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-05-04_88561f46863f440016f81749ac6befc5_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glasswor.exe
        • Size 1.7MB
        • SHA256 d267dd7d59eba53b565776fc88a116d8176227225c4cd05c35344f7fb144ec90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        B3985E00
        • Path C:\Users\Admin\AppData\Local\Temp\B3985E00
        • Size 22KB
        • SHA256 5e511d688a7e194734f3e120eb0ebe676e18d5b404220cac17de04d3f7ba3ad0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        svchost.com
        • Path C:\Windows\svchost.com
        • Size 40KB
        • SHA256 03576289d8c009ce2d1cd53661661889d42c266b209fc781b4d47b95f43de122
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/220-653-0x0000000000400000-0x00000000004F3000-memory.dmp
        Download

        memory/220-654-0x0000000000650000-0x0000000000675000-memory.dmp
        Download

        memory/720-329-0x0000000000660000-0x0000000000685000-memory.dmp
        Download

        memory/720-327-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1056-512-0x0000000000730000-0x0000000000755000-memory.dmp
        Download

        memory/1056-511-0x0000000000400000-0x00000000004F3000-memory.dmp
        Download

        memory/1100-717-0x0000000000A40000-0x0000000000A65000-memory.dmp
        Download

        memory/1100-787-0x0000000000A40000-0x0000000000A65000-memory.dmp
        Download

        memory/1100-781-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1100-716-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1100-785-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1100-771-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1356-352-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1356-354-0x0000000000A60000-0x0000000000A85000-memory.dmp
        Download

        memory/1976-596-0x0000000000670000-0x0000000000695000-memory.dmp
        Download

        memory/2068-459-0x0000000000B20000-0x0000000000B45000-memory.dmp
        Download

        memory/2068-458-0x0000000000400000-0x00000000004F3000-memory.dmp
        Download

        memory/2296-137-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2296-138-0x0000000000A40000-0x0000000000A65000-memory.dmp
        Download

        memory/2420-527-0x0000000000740000-0x0000000000765000-memory.dmp
        Download

        memory/2420-526-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2484-713-0x0000000000A80000-0x0000000000AA5000-memory.dmp
        Download

        memory/2564-460-0x0000000000690000-0x00000000006B5000-memory.dmp
        Download

        memory/2676-795-0x0000000000400000-0x00000000004F3000-memory.dmp
        Download

        memory/2676-727-0x0000000000720000-0x0000000000745000-memory.dmp
        Download

        memory/2676-811-0x0000000000400000-0x00000000004F3000-memory.dmp
        Download

        memory/2676-826-0x0000000000400000-0x00000000004F3000-memory.dmp
        Download

        memory/2676-774-0x0000000000400000-0x00000000004F3000-memory.dmp
        Download

        memory/2676-726-0x0000000000400000-0x00000000004F3000-memory.dmp
        Download

        memory/3700-435-0x0000000000400000-0x00000000005BA000-memory.dmp
        Download

        memory/3700-436-0x0000000000BF0000-0x0000000000C15000-memory.dmp
        Download

        memory/4420-437-0x0000000000A90000-0x0000000000AB5000-memory.dmp
        Download

        memory/4424-723-0x00007FFAD5320000-0x00007FFAD5330000-memory.dmp
        Download

        memory/4424-722-0x00007FFAD7C30000-0x00007FFAD7C40000-memory.dmp
        Download

        memory/4424-725-0x00007FFAD5320000-0x00007FFAD5330000-memory.dmp
        Download

        memory/4424-724-0x0000019AC6660000-0x0000019AC6670000-memory.dmp
        Download

        memory/4424-721-0x00007FFAD7C30000-0x00007FFAD7C40000-memory.dmp
        Download

        memory/4424-719-0x00007FFAD7C30000-0x00007FFAD7C40000-memory.dmp
        Download

        memory/4424-720-0x00007FFAD7C30000-0x00007FFAD7C40000-memory.dmp
        Download

        memory/4424-718-0x00007FFAD7C30000-0x00007FFAD7C40000-memory.dmp
        Download

        memory/4424-773-0x0000019B065C0000-0x0000019B06D6E000-memory.dmp
        Download

        memory/4740-113-0x0000000000400000-0x00000000005BA000-memory.dmp
        Download

        memory/4740-12-0x0000000002340000-0x0000000002341000-memory.dmp
        Download

        memory/4740-13-0x00000000004A0000-0x00000000004A1000-memory.dmp
        Download

        memory/4740-114-0x0000000000D20000-0x0000000000D45000-memory.dmp
        Download

        memory/4864-769-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4864-779-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4864-715-0x0000000000B90000-0x0000000000BB5000-memory.dmp
        Download

        memory/4864-784-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4864-786-0x0000000000B90000-0x0000000000BB5000-memory.dmp
        Download

        memory/4864-714-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4952-531-0x0000000000640000-0x0000000000665000-memory.dmp
        Download

        memory/4952-530-0x0000000000400000-0x000000000041B000-memory.dmp
        Download