Overview

overview

10

Static

static

10

2026-05-28...or.exe

windows10-2004-x64

10

2026-05-28...or.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    26s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/05/2026, 04:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe
  • Size 4.3MB
  • Sample260528-e49z8aft4k
  • SHA256 52c710962c92e333e7d18981d8e85186ed36d25656def164e5f2cf6b34fad042
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoveryneshtaxredpersistencespywarestealer

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detect Neshta payload 64 IoCs
  • Custom signature
    UPX dump on OEP (original entry point) 30 IoCs
  • Executes dropped EXE 59 IoCs
  • Loads dropped DLL 24 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 15 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Modifies registry class 35 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2964
      • C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2912
        • C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:5028
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2312
            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4964
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3392
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:896
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2552
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1360
            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2132
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2212
                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2836
            • C:\ProgramData\Synaptics\Synaptics.exe
              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:1768
              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:1896
                • C:\Windows\svchost.com
                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1176
                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:544
                    • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                      "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:4816
                      • C:\Windows\svchost.com
                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3252
                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:3632
                    • C:\ProgramData\Synaptics\Synaptics.exe
                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:4856
                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:900
                        • C:\Windows\svchost.com
                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                          12⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1628
                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:3968
                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                              14⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:688
                              • C:\Windows\svchost.com
                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1188
                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                  16⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:660
                            • C:\ProgramData\Synaptics\Synaptics.exe
                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:4704
                              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:2180
                                • C:\Windows\svchost.com
                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                  16⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:664
                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                    17⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious use of WriteProcessMemory
                                    PID:220
                                    • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                      "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                      18⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:3492
                                      • C:\Windows\svchost.com
                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:3720
                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                          20⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          PID:4304
                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:4828
                                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious use of WriteProcessMemory
                                        PID:4376
                                        • C:\Windows\svchost.com
                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                          20⤵
                                          • Executes dropped EXE
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:3180
                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Adds Run key to start application
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious use of WriteProcessMemory
                                            PID:1536
                                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                              22⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:1112
                                              • C:\Windows\svchost.com
                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                23⤵
                                                  PID:3520
                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                    24⤵
                                                      PID:5004
                                                • C:\ProgramData\Synaptics\Synaptics.exe
                                                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                  22⤵
                                                    PID:2320
                                                    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                      23⤵
                                                        PID:3952
                                                        • C:\Windows\svchost.com
                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                          24⤵
                                                            PID:4124
                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                              25⤵
                                                                PID:1596
                                                                • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                  "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                  26⤵
                                                                    PID:3616
                                                                    • C:\Windows\svchost.com
                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                      27⤵
                                                                        PID:2520
                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                          28⤵
                                                                            PID:5296
                                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                        26⤵
                                                                          PID:5364
                                                                          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                            27⤵
                                                                              PID:5448
                                                                              • C:\Windows\svchost.com
                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                28⤵
                                                                                  PID:5524
                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                    29⤵
                                                                                      PID:5556
                                                                                      • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                        30⤵
                                                                                          PID:5740
                                                                                          • C:\Windows\svchost.com
                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                            31⤵
                                                                                              PID:5820
                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                32⤵
                                                                                                  PID:5856
                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                              30⤵
                                                                                                PID:5140
                                                                                                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                                                  31⤵
                                                                                                    PID:5148
                                                                                                    • C:\Windows\svchost.com
                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                                                      32⤵
                                                                                                        PID:5332
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                                                          33⤵
                                                                                                            PID:1564
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate
                                                                                                              34⤵
                                                                                                                PID:5552
                                                                                                                • C:\Windows\svchost.com
                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                                                                  35⤵
                                                                                                                    PID:5988
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                                                      36⤵
                                                                                                                        PID:6064
                                                                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                                                                    34⤵
                                                                                                                      PID:5940
                                                  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                    1⤵
                                                    • Checks processor information in registry
                                                    • Enumerates system info in registry
                                                    • Suspicious behavior: AddClipboardFormatListener
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1700
                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                    C:\ProgramData\Synaptics\Synaptics.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2064
                                                    • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                      "C:\Windows\system32\._cache_Synaptics.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Windows directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1284
                                                      • C:\Windows\svchost.com
                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1104
                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          • Drops file in System32 directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2676
                                                          • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                            "C:\Windows\SysWOW64\._cache__CACHE~2.EXE"
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2468
                                                            • C:\Windows\svchost.com
                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE"
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • Drops file in Windows directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:236
                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                7⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                PID:3956
                                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Drops file in System32 directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4944
                                                            • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                              "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • Drops file in Windows directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry class
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4428
                                                              • C:\Windows\svchost.com
                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                7⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3156
                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                  8⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Adds Run key to start application
                                                                  • Drops file in System32 directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4068
                                                                  • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                    "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                    9⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry class
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1828
                                                                    • C:\Windows\svchost.com
                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                      10⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Windows directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:816
                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                        11⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        PID:4540
                                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                    9⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Drops file in System32 directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry class
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2968
                                                                    • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                      "C:\Windows\SysWOW64\._cache_Synaptics.exe" InjUpdate
                                                                      10⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Windows directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry class
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2700
                                                                      • C:\Windows\svchost.com
                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate
                                                                        11⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4516
                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate
                                                                          12⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Drops file in System32 directory
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry class
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4588
                                                                          • C:\Windows\SysWOW64\._cache__CACHE~2.EXE
                                                                            "C:\Windows\SysWOW64\._cache__CACHE~2.EXE" InjUpdate
                                                                            13⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1488
                                                                            • C:\Windows\svchost.com
                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate
                                                                              14⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Windows directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:132
                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE
                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate
                                                                                15⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                PID:4748
                                                  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                    1⤵
                                                    • Checks processor information in registry
                                                    • Enumerates system info in registry
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4692
                                                  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                    1⤵
                                                    • Checks processor information in registry
                                                    • Enumerates system info in registry
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2452
                                                  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                    1⤵
                                                    • Checks processor information in registry
                                                    • Enumerates system info in registry
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2708
                                                  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                    1⤵
                                                    • Checks processor information in registry
                                                    • Enumerates system info in registry
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2088
                                                  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                    1⤵
                                                      PID:2924
                                                    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                      1⤵
                                                        PID:5456
                                                      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                        1⤵
                                                          PID:5276
                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                          1⤵
                                                            PID:6088

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Persistence

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Event Triggered Execution

                                                                1
                                                                T1546

                                                                Change Default File Association

                                                                1
                                                                T1546.001

                                                                Privilege Escalation

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Event Triggered Execution

                                                                1
                                                                T1546

                                                                Change Default File Association

                                                                1
                                                                T1546.001

                                                                Defense Evasion

                                                                Modify Registry

                                                                2
                                                                T1112

                                                                Credential Access

                                                                Credentials from Password Stores

                                                                1
                                                                T1555

                                                                Credentials from Web Browsers

                                                                1
                                                                T1555.003

                                                                Unsecured Credentials

                                                                1
                                                                T1552

                                                                Credentials In Files

                                                                1
                                                                T1552.001

                                                                Discovery

                                                                Query Registry

                                                                2
                                                                T1012

                                                                System Information Discovery

                                                                3
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                Lateral Movement

                                                                Collection

                                                                Data from Local System

                                                                1
                                                                T1005

                                                                Command and Control

                                                                Exfiltration

                                                                Impact

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                ACROBR~1.EXE
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
                                                                • Size 328KB
                                                                • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ACROTE~1.EXE
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
                                                                • Size 86KB
                                                                • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ADOBEC~1.EXE
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
                                                                • Size 5.7MB
                                                                • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ADelRCP.exe
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
                                                                • Size 175KB
                                                                • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                RdrCEF.exe
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
                                                                • Size 9.4MB
                                                                • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AcroRd32.exe
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
                                                                • Size 2.4MB
                                                                • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                WCCHRO~1.EXE
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
                                                                • Size 183KB
                                                                • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Eula.exe
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
                                                                • Size 131KB
                                                                • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                FULLTR~1.EXE
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
                                                                • Size 254KB
                                                                • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                LOGTRA~1.EXE
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
                                                                • Size 386KB
                                                                • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                READER~1.EXE
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
                                                                • Size 92KB
                                                                • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                WOW_HE~1.EXE
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
                                                                • Size 147KB
                                                                • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                arh.exe
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
                                                                • Size 125KB
                                                                • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                32BITM~1.EXE
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
                                                                • Size 142KB
                                                                • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                64BITM~1.EXE
                                                                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
                                                                • Size 278KB
                                                                • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ADOBEA~1.EXE
                                                                • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
                                                                • Size 454KB
                                                                • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AdobeARM.exe
                                                                • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
                                                                • Size 1.2MB
                                                                • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                jaureg.exe
                                                                • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
                                                                • Size 555KB
                                                                • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                VSTOIN~1.EXE
                                                                • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
                                                                • Size 121KB
                                                                • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                java.exe
                                                                • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
                                                                • Size 325KB
                                                                • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                javaw.exe
                                                                • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
                                                                • Size 325KB
                                                                • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                javaws.exe
                                                                • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
                                                                • Size 505KB
                                                                • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                DISABL~1.EXE
                                                                • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
                                                                • Size 5.7MB
                                                                • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ie_to_edge_stub.exe
                                                                • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\BHO\ie_to_edge_stub.exe
                                                                • Size 562KB
                                                                • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                cookie_exporter.exe
                                                                • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\cookie_exporter.exe
                                                                • Size 155KB
                                                                • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                elevation_service.exe
                                                                • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\elevation_service.exe
                                                                • Size 2.2MB
                                                                • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                identity_helper.exe
                                                                • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\identity_helper.exe
                                                                • Size 1.5MB
                                                                • SHA256 a892a9a4833cf97e3308b16ae510338532849c104dfbe5a987a1d055b7a9b482
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                msedge_proxy.exe
                                                                • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge_proxy.exe
                                                                • Size 1.5MB
                                                                • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                msedge_pwa_launcher.exe
                                                                • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge_pwa_launcher.exe
                                                                • Size 1.8MB
                                                                • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                msedgewebview2.exe
                                                                • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedgewebview2.exe
                                                                • Size 3.4MB
                                                                • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                notification_click_helper.exe
                                                                • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\notification_click_helper.exe
                                                                • Size 1.6MB
                                                                • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                pwahelper.exe
                                                                • Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\pwahelper.exe
                                                                • Size 1.4MB
                                                                • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                msedge.exe
                                                                • Path C:\PROGRA~2\MICROS~1\Edge\Application\msedge.exe
                                                                • Size 4.0MB
                                                                • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                RCX8076.tmp
                                                                • Path C:\ProgramData\Synaptics\RCX8076.tmp
                                                                • Size 753KB
                                                                • SHA256 386a4529238ef17cf37f62f571907e0ca9eca3394a05b4f41c27428e6013642d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Synaptics.exe
                                                                • Path C:\ProgramData\Synaptics\Synaptics.exe
                                                                • Size 3.9MB
                                                                • SHA256 c7c59a07381d3e03f7d2c8977cba829bdc856732c4974eb089d485a1c7be14fb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Synaptics.exe
                                                                • Path C:\ProgramData\Synaptics\Synaptics.exe
                                                                • Size 4.3MB
                                                                • SHA256 52c710962c92e333e7d18981d8e85186ed36d25656def164e5f2cf6b34fad042
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ._cache_._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe
                                                                • Size 2.8MB
                                                                • SHA256 be4c8a75477ecd737899555ec182c0b5cad6821cf37dbead57bdd3c84dcfe7c9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe
                                                                • Size 3.6MB
                                                                • SHA256 e9824a3c526f1aacd4cbe4e46661d72a8f00bd949d5f18ff5ab353817b18c705
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                29A85E00
                                                                • Path C:\Users\Admin\AppData\Local\Temp\29A85E00
                                                                • Size 23KB
                                                                • SHA256 4708ad2ae8deb86061fd7795477d7ac536ec144cd8ce0e0aa47633b329648f6b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ._cache_._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe
                                                                • Size 2.7MB
                                                                • SHA256 0bb88564a22bfd6d9ad6e4d8efa9077792a7b6094c2a0f865d70c43e11507352
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-05-28_7e68ca52540e0880a71c51c0e2499aa6_amadey_dark-comet_darkgate_datper_elex_gcleaner_glasswor.exe
                                                                • Size 3.5MB
                                                                • SHA256 7f28ded2eb0e8548200c0c8525b24b98e328bdddd71a11b183987f6c8fc802e3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                A2195E00
                                                                • Path C:\Users\Admin\AppData\Local\Temp\A2195E00
                                                                • Size 23KB
                                                                • SHA256 632a4d3560732cc9c8276d3441cb75cd088460c44516aacb069559d815fad34e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                TGwuyCjG.xlsm
                                                                • Path C:\Users\Admin\AppData\Local\Temp\TGwuyCjG.xlsm
                                                                • Size 17KB
                                                                • SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                directx.sys
                                                                • Path C:\Windows\directx.sys
                                                                • Size 57B
                                                                • SHA256 998e1546bc98d29ffccb70e81ed00a01f3dbd3015e947d1aabca4cb01775ce28
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                directx.sys
                                                                • Path C:\Windows\directx.sys
                                                                • Size 57B
                                                                • SHA256 e0a7bae2a9ac263cff5d725922e40272d8854278d901233a93a5267859c00a3c
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                directx.sys
                                                                • Path C:\Windows\directx.sys
                                                                • Size 57B
                                                                • SHA256 84ba3f2b07e112efaff6ee034b84db960521db9e504a4ac77a5e8e5e988d86d9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                svchost.com
                                                                • Path C:\Windows\svchost.com
                                                                • Size 40KB
                                                                • SHA256 54e205f4226b555ea049429663d1773e258b04466c7492067760a9df0b91b41d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                memory/132-741-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/220-894-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/236-551-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/544-651-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/664-823-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/688-740-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/816-662-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/896-837-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/896-654-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/900-809-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/1104-405-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/1176-560-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/1188-742-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/1284-331-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/1360-512-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/1488-734-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/1628-678-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/1700-190-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp
                                                                Download

                                                                memory/1700-189-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp
                                                                Download

                                                                memory/1700-188-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp
                                                                Download

                                                                memory/1700-187-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp
                                                                Download

                                                                memory/1700-198-0x00007FFAAEC70000-0x00007FFAAEC80000-memory.dmp
                                                                Download

                                                                memory/1700-236-0x00007FFAAC690000-0x00007FFAAC6A0000-memory.dmp
                                                                Download

                                                                memory/1700-227-0x00007FFAAC690000-0x00007FFAAC6A0000-memory.dmp
                                                                Download

                                                                memory/1768-568-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/1828-661-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/1896-553-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/2064-282-0x0000000000400000-0x0000000000850000-memory.dmp
                                                                Download

                                                                memory/2132-525-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/2180-821-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/2212-539-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/2312-312-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/2468-550-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/2552-255-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/2676-559-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/2700-687-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/2836-712-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                Download

                                                                memory/2912-183-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/2964-593-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/2964-825-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/2968-714-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/3156-592-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/3180-919-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/3252-649-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/3392-352-0x0000000000400000-0x0000000000850000-memory.dmp
                                                                Download

                                                                memory/3392-116-0x0000000000400000-0x0000000000850000-memory.dmp
                                                                Download

                                                                memory/3492-901-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/3632-826-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                Download

                                                                memory/3720-902-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/3956-732-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                Download

                                                                memory/3968-808-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/4068-663-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/4316-104-0x0000000000400000-0x0000000000850000-memory.dmp
                                                                Download

                                                                memory/4316-0-0x0000000000B00000-0x0000000000B01000-memory.dmp
                                                                Download

                                                                memory/4316-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
                                                                Download

                                                                memory/4376-918-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/4428-584-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/4516-688-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/4540-904-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                Download

                                                                memory/4588-751-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/4704-828-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/4816-586-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download

                                                                memory/4828-922-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/4856-713-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/4944-569-0x0000000000400000-0x000000000078A000-memory.dmp
                                                                Download

                                                                memory/4964-903-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                Download

                                                                memory/4964-664-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                Download

                                                                memory/5028-251-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                Download