Overview

overview

10

Static

static

10

2026-05-28...ry.exe

windows10-2004-x64

10

2026-05-28...ry.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    6s
  • max time network
    144s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/05/2026, 04:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
  • Size 2.8MB
  • Sample260528-e3hjksft2m
  • SHA256 7ccaef1aa761703a6e95a74632a259773ff5583c723a31dc3ac69c00a190a658
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoverygh0stratneshtaxredpersistenceratspyware

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detect Neshta payload 64 IoCs
  • Gh0st RAT payload 21 IoCs
  • Executes dropped EXE 12 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4616
      • C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4188
        • C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3448
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3160
            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4472
              • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE
                "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"
                7⤵
                  PID:3260
                  • C:\Windows\svchost.com
                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXE"
                    8⤵
                      PID:1264
                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXE
                        C:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXE
                        9⤵
                          PID:3292
          • C:\ProgramData\Synaptics\Synaptics.exe
            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1472
            • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
              "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
              3⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:228
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                4⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2664
                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                  5⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:5112
                  • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                    "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3152
                    • C:\Windows\svchost.com
                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                      7⤵
                        PID:1260
                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                          8⤵
                            PID:3756
                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE
                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate
                              9⤵
                                PID:3224
                                • C:\Windows\svchost.com
                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate
                                  10⤵
                                    PID:1804
                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate
                                      11⤵
                                        PID:444
                            • C:\ProgramData\Synaptics\Synaptics.exe
                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                              6⤵
                                PID:2532
                                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                  7⤵
                                    PID:3560
                                    • C:\Windows\svchost.com
                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                      8⤵
                                        PID:2380
                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                          9⤵
                                            PID:1200
                                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                              10⤵
                                                PID:1440
                                                • C:\Windows\svchost.com
                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                  11⤵
                                                    PID:4308
                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                      12⤵
                                                        PID:4640
                                                        • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE
                                                          "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate
                                                          13⤵
                                                            PID:1752
                                                            • C:\Windows\svchost.com
                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE" InjUpdate
                                                              14⤵
                                                                PID:1324
                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE InjUpdate
                                                                  15⤵
                                                                    PID:2148
                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                        C:\ProgramData\Synaptics\Synaptics.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious use of WriteProcessMemory
                                        PID:5016
                                        • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                          "C:\Windows\system32\._cache_Synaptics.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:4004
                                          • C:\Windows\svchost.com
                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"
                                            3⤵
                                              PID:4284
                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                4⤵
                                                  PID:4044
                                                  • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                    "C:\Windows\SysWOW64\._cache__CACHE~2.EXE"
                                                    5⤵
                                                      PID:3752
                                                      • C:\Windows\svchost.com
                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE"
                                                        6⤵
                                                          PID:1748
                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                            7⤵
                                                              PID:2372
                                                              • C:\Windows\SysWOW64\._cache__CACHE~4.EXE
                                                                "C:\Windows\SysWOW64\._cache__CACHE~4.EXE"
                                                                8⤵
                                                                  PID:1408
                                                                  • C:\Windows\svchost.com
                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE"
                                                                    9⤵
                                                                      PID:2092
                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_C578E~1.EXE
                                                                        10⤵
                                                                          PID:1712
                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~3.EXE
                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXE
                                                        1⤵
                                                          PID:3912

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              ACROBR~1.EXE
                                                              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
                                                              • Size 368KB
                                                              • SHA256 715f6420c423ae4068b25a703d5575f7c147b26e388f0fff1ae20c6abe821557
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ACROTE~1.EXE
                                                              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
                                                              • Size 86KB
                                                              • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ADOBEC~1.EXE
                                                              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
                                                              • Size 5.7MB
                                                              • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ADelRCP.exe
                                                              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
                                                              • Size 175KB
                                                              • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AcroRd32.exe
                                                              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
                                                              • Size 2.4MB
                                                              • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              WCCHRO~1.EXE
                                                              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
                                                              • Size 183KB
                                                              • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Eula.exe
                                                              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
                                                              • Size 131KB
                                                              • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              FULLTR~1.EXE
                                                              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
                                                              • Size 254KB
                                                              • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              READER~1.EXE
                                                              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
                                                              • Size 92KB
                                                              • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              64BITM~1.EXE
                                                              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
                                                              • Size 278KB
                                                              • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ADOBEA~1.EXE
                                                              • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
                                                              • Size 454KB
                                                              • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AdobeARM.exe
                                                              • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
                                                              • Size 1.2MB
                                                              • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              jaureg.exe
                                                              • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
                                                              • Size 555KB
                                                              • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              javaw.exe
                                                              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
                                                              • Size 325KB
                                                              • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              javaws.exe
                                                              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
                                                              • Size 505KB
                                                              • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              DISABL~1.EXE
                                                              • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
                                                              • Size 5.7MB
                                                              • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              IE_TO_~1.EXE
                                                              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
                                                              • Size 557KB
                                                              • SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              COOKIE~1.EXE
                                                              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE
                                                              • Size 161KB
                                                              • SHA256 5fee43e3295682e179d6e10c568aeb640bbbcf0d6b962fd27f5b372a45fc272d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ELEVAT~1.EXE
                                                              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE
                                                              • Size 1.8MB
                                                              • SHA256 47eb0dc0cd08f4faa389621c43d6407283e3c315012ef1078a6018c117f195b2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ie_to_edge_stub.exe
                                                              • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\BHO\ie_to_edge_stub.exe
                                                              • Size 562KB
                                                              • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              setup.exe
                                                              • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\INSTAL~1\setup.exe
                                                              • Size 7.1MB
                                                              • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              elevation_service.exe
                                                              • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\elevation_service.exe
                                                              • Size 2.2MB
                                                              • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              identity_helper.exe
                                                              • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\identity_helper.exe
                                                              • Size 1.4MB
                                                              • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              msedge_pwa_launcher.exe
                                                              • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge_pwa_launcher.exe
                                                              • Size 1.8MB
                                                              • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              notification_click_helper.exe
                                                              • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\notification_click_helper.exe
                                                              • Size 1.6MB
                                                              • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              pwahelper.exe
                                                              • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\pwahelper.exe
                                                              • Size 1.4MB
                                                              • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              MSEDGE~1.EXE
                                                              • Path C:\PROGRA~2\MICROS~1\Edge\Application\MSEDGE~1.EXE
                                                              • Size 1.5MB
                                                              • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              msedge.exe
                                                              • Path C:\PROGRA~2\MICROS~1\Edge\Application\msedge.exe
                                                              • Size 4.0MB
                                                              • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Synaptics.exe
                                                              • Path C:\ProgramData\Synaptics\Synaptics.exe
                                                              • Size 2.8MB
                                                              • SHA256 7ccaef1aa761703a6e95a74632a259773ff5583c723a31dc3ac69c00a190a658
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ._cache_._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
                                                              • Size 1.3MB
                                                              • SHA256 5a81e3368b002c8dd5cefec6af8b86ff9797b1bb06bd56fc04530e70ac9e90c7
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
                                                              • Size 2.1MB
                                                              • SHA256 23d57e5edd8fe57a7ebc91125d99659d16a282921aa46cfc3ba05265125ba3a6
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ._cache_._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
                                                              • Size 1.3MB
                                                              • SHA256 ef9104409fa45b5bd3221e5c08648a47a1848b9435495072506ab8e44910f50c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_3f0dd36f4c1c9f75fd0bfb7892323317_dark-comet_darkgate_elex_gcleaner_glassworm_neshta_wannacry.exe
                                                              • Size 2.0MB
                                                              • SHA256 d3dbadbb8ae160db5f70593c13c70d28146ed15373641e02397ac386d40c2e80
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ._cache__CACHE~3.EXE
                                                              • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~3.EXE
                                                              • Size 488KB
                                                              • SHA256 a3596035af9ac517f109f920bde188f2bc80ac1c5b6f282187d8cd5aa5e2e4ea
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              directx.sys
                                                              • Path C:\Windows\directx.sys
                                                              • Size 57B
                                                              • SHA256 998e1546bc98d29ffccb70e81ed00a01f3dbd3015e947d1aabca4cb01775ce28
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              directx.sys
                                                              • Path C:\Windows\directx.sys
                                                              • Size 57B
                                                              • SHA256 84ba3f2b07e112efaff6ee034b84db960521db9e504a4ac77a5e8e5e988d86d9
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              directx.sys
                                                              • Path C:\Windows\directx.sys
                                                              • Size 57B
                                                              • SHA256 e0a7bae2a9ac263cff5d725922e40272d8854278d901233a93a5267859c00a3c
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              directx.sys
                                                              • Path C:\Windows\directx.sys
                                                              • Size 57B
                                                              • SHA256 b05c3f4f45330685414a7c36e192ff16060e4bdccdadf09ed1eccc3ab249a0b8
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              svchost.com
                                                              • Path C:\Windows\svchost.com
                                                              • Size 40KB
                                                              • SHA256 0f3cbae1521639abef0d0bd6741ad99ecbd67bbc52cf16a623a6acdd971c8562
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              memory/228-737-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/228-722-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/228-686-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/228-728-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/228-733-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/228-716-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/1200-712-0x0000000000400000-0x000000000060D000-memory.dmp
                                                              Download

                                                              memory/1200-719-0x0000000000400000-0x000000000060D000-memory.dmp
                                                              Download

                                                              memory/1260-516-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/1264-711-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/1264-723-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/1324-708-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/1408-699-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/1440-656-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/1472-340-0x0000000000400000-0x00000000006D3000-memory.dmp
                                                              Download

                                                              memory/1748-659-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/1752-707-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/1804-630-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/2092-700-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/2372-692-0x0000000000400000-0x0000000000546000-memory.dmp
                                                              Download

                                                              memory/2380-628-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/2532-599-0x0000000000400000-0x000000000060D000-memory.dmp
                                                              Download

                                                              memory/2664-218-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/2924-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
                                                              Download

                                                              memory/2924-111-0x0000000000400000-0x00000000006D3000-memory.dmp
                                                              Download

                                                              memory/2924-0-0x00000000009B0000-0x00000000009B1000-memory.dmp
                                                              Download

                                                              memory/3152-455-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/3160-300-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/3224-629-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/3260-621-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/3448-269-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/3560-614-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/3752-649-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/3756-710-0x0000000000400000-0x0000000000546000-memory.dmp
                                                              Download

                                                              memory/3756-717-0x0000000000400000-0x0000000000546000-memory.dmp
                                                              Download

                                                              memory/4004-499-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/4044-636-0x0000000000400000-0x000000000060D000-memory.dmp
                                                              Download

                                                              memory/4188-251-0x0000000000400000-0x000000000060D000-memory.dmp
                                                              Download

                                                              memory/4284-522-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/4308-660-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/4472-709-0x0000000000400000-0x0000000000546000-memory.dmp
                                                              Download

                                                              memory/4616-714-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/4616-720-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/4616-726-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/4616-661-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/4616-731-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/4616-736-0x0000000000400000-0x000000000041B000-memory.dmp
                                                              Download

                                                              memory/4640-715-0x0000000000400000-0x0000000000546000-memory.dmp
                                                              Download

                                                              memory/4640-761-0x0000000000400000-0x0000000000546000-memory.dmp
                                                              Download

                                                              memory/5016-341-0x0000000000400000-0x00000000006D3000-memory.dmp
                                                              Download

                                                              memory/5112-447-0x0000000000400000-0x000000000060D000-memory.dmp
                                                              Download