Overview

overview

10

Static

static

10

2026-05-28...ar.exe

windows10-2004-x64

10

2026-05-28...ar.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/05/2026, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe
  • Size 4.9MB
  • Sample260528-e2nn7sgy8x
  • SHA256 281c45dc061cd24b1628e55253ca4b31058ba3a85735780ad32dd185d4476e85
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoveryneshtaxredpersistencespywarestealer

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detect Neshta payload 64 IoCs
  • Executes dropped EXE 22 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 14 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3172
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3888
      • C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5052
        • C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4308
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:468
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3160
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2492
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4836
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3708
            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3652
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1300
                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
                  8⤵
                  • Executes dropped EXE
                  PID:1032
            • C:\ProgramData\Synaptics\Synaptics.exe
              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:1556
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3920
                • C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:864
                  • C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE
                    "C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE" InjUpdate
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:2424
                    • C:\Windows\svchost.com
                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2240
                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
                        11⤵
                        • Executes dropped EXE
                        PID:4044
                  • C:\ProgramData\Synaptics\Synaptics.exe
                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:3832
                    • C:\ProgramData\Synaptics\._cache_Synaptics.exe
                      "C:\ProgramData\Synaptics\._cache_Synaptics.exe" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:4076
                      • C:\Windows\svchost.com
                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2208
                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                          12⤵
                          • Executes dropped EXE
                          PID:2936
  • C:\ProgramData\Synaptics\Synaptics.exe
    C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:4100
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1464
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:4380

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Modify Registry

        2
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ACROBR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
        • Size 328KB
        • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ACROTE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
        • Size 86KB
        • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEC~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
        • Size 5.7MB
        • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADelRCP.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
        • Size 175KB
        • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RdrCEF.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
        • Size 9.4MB
        • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AcroRd32.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
        • Size 2.4MB
        • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WCCHRO~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
        • Size 183KB
        • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Eula.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
        • Size 131KB
        • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FULLTR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
        • Size 254KB
        • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LOGTRA~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
        • Size 386KB
        • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        READER~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
        • Size 92KB
        • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        arh.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
        • Size 125KB
        • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        32BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
        • Size 142KB
        • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        64BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
        • Size 278KB
        • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEA~1.EXE
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
        • Size 454KB
        • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AdobeARM.exe
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
        • Size 1.2MB
        • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaureg.exe
        • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
        • Size 555KB
        • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOIN~1.EXE
        • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
        • Size 121KB
        • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
        • Size 325KB
        • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
        • Size 325KB
        • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
        • Size 505KB
        • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DISABL~1.EXE
        • Path C:\PROGRA~2\Google\GOOGLE~1\141073~1.0\DISABL~1.EXE
        • Size 5.7MB
        • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        COOKIE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE
        • Size 161KB
        • SHA256 5fee43e3295682e179d6e10c568aeb640bbbcf0d6b962fd27f5b372a45fc272d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ELEVAT~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE
        • Size 1.8MB
        • SHA256 47eb0dc0cd08f4faa389621c43d6407283e3c315012ef1078a6018c117f195b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IDENTI~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE
        • Size 1.1MB
        • SHA256 94c99d3284962585c15fdb061e0685287df11c872ef930263e251d8d3084d5b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe
        • Size 6.6MB
        • SHA256 4ea8adca8a7f73fc71c7e45ef98f8c422a8b161ca6b6fcd912aec701bebd08a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~1.EXE
        • Size 3.2MB
        • SHA256 fc0701d5c47cbd883929abfccf5f6ba88f76a4d0ebfa2d28160cf6c28f018e26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~2.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE
        • Size 1.1MB
        • SHA256 550e6ad6b5fb0dabd28d9009c790b22e9444fc9fc30e952210727f6ac4a00389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~3.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~3.EXE
        • Size 1.5MB
        • SHA256 eb9bbc44c181ddef0d8b53b69bd7327f5c150c0b72d92805a9f3a9ba333f0575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NOTIFI~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\NOTIFI~1.EXE
        • Size 1.3MB
        • SHA256 447a7ccfbece37792dfd82e6cf4e644e261dbe0f3e23a13c475276e8e4fa3561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PWAHEL~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\PWAHEL~1.EXE
        • Size 1.1MB
        • SHA256 c57f8707c1fda09d33efc6b615c0d48174253e9869772841446302748f1f9016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe
        • Size 3.8MB
        • SHA256 6773bf49098b9fa85725651bc789ec2bcef5dd563a356043468c1f7b235defef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\INSTAL~1\setup.exe
        • Size 7.1MB
        • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\msedge.exe
        • Size 4.0MB
        • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ie_to_edge_stub.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\BHO\ie_to_edge_stub.exe
        • Size 562KB
        • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cookie_exporter.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\cookie_exporter.exe
        • Size 155KB
        • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\elevated_tracing_service.exe
        • Size 3.8MB
        • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\elevation_service.exe
        • Size 2.2MB
        • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        identity_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\identity_helper.exe
        • Size 1.4MB
        • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_pwa_launcher.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge_pwa_launcher.exe
        • Size 1.8MB
        • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgewebview2.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedgewebview2.exe
        • Size 3.4MB
        • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_click_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\notification_click_helper.exe
        • Size 1.6MB
        • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\MSEDGE~1.EXE
        • Size 1.5MB
        • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PWAHEL~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\Application\PWAHEL~1.EXE
        • Size 1.4MB
        • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX48FB.tmp
        • Path C:\ProgramData\Synaptics\RCX48FB.tmp
        • Size 753KB
        • SHA256 9fc308d76cac1a6a00b55377e0e8c577b1a35fa95e27d0c90fdede20311f90d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Synaptics.exe
        • Path C:\ProgramData\Synaptics\Synaptics.exe
        • Size 4.1MB
        • SHA256 abc148b01657428cd61c29c563ba9e08ee79d3288c3a635f5f21b43089f32a14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Synaptics.exe
        • Path C:\ProgramData\Synaptics\Synaptics.exe
        • Size 4.2MB
        • SHA256 ef22c58d6b31e3ebd3dd82c5607bc8cc649199fcd4251c18393542bdee912375
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Synaptics.exe
        • Path C:\ProgramData\Synaptics\Synaptics.exe
        • Size 4.2MB
        • SHA256 c441eb46c91af73f95b3a8dcfe58e2fad86fb7eb2b7c7df26aa1c357e3bdd754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Synaptics.exe
        • Path C:\ProgramData\Synaptics\Synaptics.exe
        • Size 4.4MB
        • SHA256 7bdb1226a0cfd9ded7ab61c1a08b9851ea6f0cc6e397ccc4fb6b61acf5e5574a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe
        • Path C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe
        • Size 3.4MB
        • SHA256 9b9d250f107d3356943d6861fecc00e4061d3ebdea981a5c9f97c3337cb82842
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe
        • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe
        • Size 4.2MB
        • SHA256 9a728f9b8d8e256cc1eb89e7f3525b4e9ebd301bc45388e2e401d7d2f7d46f23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        25585E00
        • Path C:\Users\Admin\AppData\Local\Temp\25585E00
        • Size 23KB
        • SHA256 e38883da8468a74a08d2032249bf0d33c254a4cbaf10a570d5d014d20e08c7ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe
        • Size 3.3MB
        • SHA256 de42152611b2166a249c4325f73fde9da745042c7eeceeb60ec68b33f6e2f559
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_231ac40a91e72c6bfef8f086e4d547db_akira_dark-comet_darkgate_elex_gcleaner_glassworm_icedid_neshta_vidar.exe
        • Size 4.1MB
        • SHA256 b5a81485755a333c5ade84aa66741ae2f5aedba6fddb7ca203bd097a9a822c5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        directx.sys
        • Path C:\Windows\directx.sys
        • Size 57B
        • SHA256 a43fa861957415e3b0f25e2b54d931961cd309ff1d5354a9362852895b90b3e1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        directx.sys
        • Path C:\Windows\directx.sys
        • Size 57B
        • SHA256 e0a7bae2a9ac263cff5d725922e40272d8854278d901233a93a5267859c00a3c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        svchost.com
        • Path C:\Windows\svchost.com
        • Size 40KB
        • SHA256 0f3cbae1521639abef0d0bd6741ad99ecbd67bbc52cf16a623a6acdd971c8562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/468-417-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/864-619-0x0000000000400000-0x0000000000823000-memory.dmp
        Download

        memory/1300-492-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/1464-244-0x00007FFBF9DA0000-0x00007FFBF9DB0000-memory.dmp
        Download

        memory/1464-214-0x00007FFBFC130000-0x00007FFBFC140000-memory.dmp
        Download

        memory/1464-181-0x00007FFBFC130000-0x00007FFBFC140000-memory.dmp
        Download

        memory/1464-205-0x00007FFBFC130000-0x00007FFBFC140000-memory.dmp
        Download

        memory/1464-215-0x00007FFBFC130000-0x00007FFBFC140000-memory.dmp
        Download

        memory/1464-228-0x00007FFBF9DA0000-0x00007FFBF9DB0000-memory.dmp
        Download

        memory/1464-206-0x00007FFBFC130000-0x00007FFBFC140000-memory.dmp
        Download

        memory/1556-509-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2208-670-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2240-610-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2424-609-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2492-721-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2492-726-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2492-710-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/3160-381-0x0000000000400000-0x00000000008E9000-memory.dmp
        Download

        memory/3172-3-0x0000000000400000-0x00000000008E9000-memory.dmp
        Download

        memory/3172-117-0x0000000000400000-0x00000000008E9000-memory.dmp
        Download

        memory/3172-0-0x0000000000400000-0x00000000008E9000-memory.dmp
        Download

        memory/3652-491-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/3708-495-0x0000000000400000-0x0000000000823000-memory.dmp
        Download

        memory/3832-729-0x0000000000400000-0x0000000000823000-memory.dmp
        Download

        memory/3832-752-0x0000000000400000-0x0000000000823000-memory.dmp
        Download

        memory/3832-716-0x0000000000400000-0x0000000000823000-memory.dmp
        Download

        memory/3888-727-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/3888-720-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/3888-709-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/3920-512-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4076-669-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4100-382-0x0000000000400000-0x00000000008E9000-memory.dmp
        Download

        memory/4308-416-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4836-229-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/5052-296-0x0000000000400000-0x0000000000823000-memory.dmp
        Download

        memory/5052-118-0x0000000000400000-0x0000000000823000-memory.dmp
        Download

        memory/5052-115-0x0000000000400000-0x0000000000823000-memory.dmp
        Download