Overview

overview

10

Static

static

10

2026-08-10..._n.exe

windows10-2004-x64

10

2026-08-10..._n.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 22:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
  • Size 1.5MB
  • Sample260810-2b1bmsaq9t
  • SHA256 160e664017d807cf822652990778789272305630f0249dd649ef978e482c903c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoverybabylonratneshtaxredpersistencespywarestealertrojan

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat
  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Babylon RAT payload 5 IoCs
  • Detect Neshta payload 64 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 5 IoCs
  • Executes dropped EXE 6 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5852
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3132
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2384
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5916
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 604
              6⤵
              • Program crash
              PID:2072
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3844
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:5496
  • C:\ProgramData\Synaptics\Synaptics.exe
    C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1592
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5916 -ip 5916
    1⤵
      PID:3632

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          2
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ACROBR~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
          • Size 328KB
          • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ACROTE~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
          • Size 86KB
          • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ADOBEC~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
          • Size 5.7MB
          • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ADelRCP.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
          • Size 175KB
          • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RdrCEF.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
          • Size 9.4MB
          • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AcroRd32.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
          • Size 2.4MB
          • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WCCHRO~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
          • Size 183KB
          • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Eula.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
          • Size 131KB
          • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FULLTR~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
          • Size 254KB
          • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LOGTRA~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
          • Size 386KB
          • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          READER~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
          • Size 92KB
          • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WOW_HE~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
          • Size 147KB
          • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          arh.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
          • Size 125KB
          • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          32BITM~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
          • Size 142KB
          • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          64BITM~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
          • Size 278KB
          • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ADOBEA~1.EXE
          • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
          • Size 454KB
          • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AdobeARM.exe
          • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
          • Size 1.2MB
          • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jaureg.exe
          • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
          • Size 555KB
          • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VSTOIN~1.EXE
          • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
          • Size 121KB
          • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java.exe
          • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
          • Size 325KB
          • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javaw.exe
          • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
          • Size 325KB
          • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javaws.exe
          • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
          • Size 505KB
          • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DISABL~1.EXE
          • Path C:\PROGRA~2\Google\GOOGLE~1\141073~1.0\DISABL~1.EXE
          • Size 5.7MB
          • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MICROS~1.EXE
          • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE
          • Size 223KB
          • SHA256 fe2d4359da69b28aa924ea8e144c8cb12250be7f8ab41485b4b86fe40ab49e14
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MICROS~2.EXE
          • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~2.EXE
          • Size 242KB
          • SHA256 e1680751388c4af523a769ce4e16ae013c7d8b7a1b03e56b97525bbb918b647b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge_pwa_launcher.exe
          • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\122023~1.106\msedge_pwa_launcher.exe
          • Size 1.6MB
          • SHA256 c3f6a5111276371edf9e46fcb05869f993cb17cac5f8033ee5707ecddc244f5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ie_to_edge_stub.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe
          • Size 553KB
          • SHA256 7b2d809ff4b2691c04855f4bb3d89b88fa4d1d65c8c35d3941a26f015947cde9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe
          • Size 6.8MB
          • SHA256 78e1d1e4460914eb8be59bb96d9897562a0ac65a5fbce63349f43ee56ba5e83b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cookie_exporter.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe
          • Size 157KB
          • SHA256 3ecafed639ffb272e758902d1baa0b399c044bfb744cedd6bda1ed40516ca132
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe
          • Size 1.7MB
          • SHA256 2177d0e64ef5cd4d3ad386606feb8d45ae0a7d070f19583b67eea9407272b9f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          identity_helper.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe
          • Size 1.2MB
          • SHA256 d2decf24ecc69018df3da6dde66ca81e168dbcea91c6d4ceb428a1929778b39e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe
          • Size 3.9MB
          • SHA256 39cf8228fc39959bcd27f64512c81e5049eeed843387016d4c733982b622706d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge_proxy.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe
          • Size 1.2MB
          • SHA256 6f3f49143cab7ee4c239f74f6649241ddd527040ea390a3a214b1d7b8f113fc7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgewebview2.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe
          • Size 3.5MB
          • SHA256 47df542ec5d28a6c75c2d815e9b700c65f587186c02c8f1a2566fdab9e3b5d01
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          notification_helper.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe
          • Size 1.4MB
          • SHA256 964abff6df613e4f987fa1615a0f7963d177c3c7418b4a719c3121e9752b5a00
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pwahelper.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe
          • Size 1.2MB
          • SHA256 07b4d83c273dd032f6a763951adc1196ca00568ce2cef2cd9c3a310788fbcd78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ie_to_edge_stub.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
          • Size 562KB
          • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
          • Size 7.1MB
          • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cookie_exporter.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
          • Size 155KB
          • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevated_tracing_service.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
          • Size 3.8MB
          • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
          • Size 2.2MB
          • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          identity_helper.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
          • Size 1.4MB
          • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge_pwa_launcher.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
          • Size 1.8MB
          • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgewebview2.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
          • Size 3.4MB
          • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          notification_click_helper.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
          • Size 1.6MB
          • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSEDGE~1.EXE
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
          • Size 1.5MB
          • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PWAHEL~1.EXE
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
          • Size 1.4MB
          • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
          • Size 4.0MB
          • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Synaptics.exe
          • Path C:\ProgramData\Synaptics\Synaptics.exe
          • Size 753KB
          • SHA256 fad8ee5c511c7118e6260d1e4cc0eabd1028a7081a9a414405cdaa87f018acb6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ._cache_2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
          • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
          • Size 768KB
          • SHA256 9a722613f807af7d7d2c108f324b728852233fc15a9eeed1906e5bbcb33f9616
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2B695E00
          • Path C:\Users\Admin\AppData\Local\Temp\2B695E00
          • Size 21KB
          • SHA256 869807977c2f7d58e2f357954821568c3daebad264a8a6bb989ef3b837c098fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ._cache_2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
          • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
          • Size 727KB
          • SHA256 cb1c1dec2980acb674da9b9cb077fda38cfc035a600f65c6fdc84cb8636eddb0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
          • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-10_672a6527baa90b0b2037ca9f6bc186a9_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
          • Size 1.5MB
          • SHA256 d2e9e026df4d19fa058584ed39ad7b22359a9176e32957fe4c24e55bfa9da9ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          svchost.com
          • Path C:\Windows\svchost.com
          • Size 40KB
          • SHA256 71da51fd4d49fa54fb9223c18b0cf117e3ef952ad191772c01d3e4c091eae7df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1592-224-0x0000000000400000-0x00000000004C2000-memory.dmp
          Download

          memory/1928-125-0x0000000000400000-0x0000000000582000-memory.dmp
          Download

          memory/1928-11-0x00000000004A0000-0x00000000004A1000-memory.dmp
          Download

          memory/1928-10-0x0000000002340000-0x0000000002341000-memory.dmp
          Download

          memory/2384-278-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3132-328-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3132-323-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3132-320-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3132-317-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3132-314-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3132-304-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3844-321-0x0000000000400000-0x00000000004C2000-memory.dmp
          Download

          memory/3844-306-0x0000000000400000-0x00000000004C2000-memory.dmp
          Download

          memory/3844-347-0x0000000000400000-0x00000000004C2000-memory.dmp
          Download

          memory/3844-315-0x0000000000400000-0x00000000004C2000-memory.dmp
          Download

          memory/3844-332-0x0000000000400000-0x00000000004C2000-memory.dmp
          Download

          memory/5496-179-0x00007FFF925A0000-0x00007FFF925B0000-memory.dmp
          Download

          memory/5496-244-0x00007FFF8F9C0000-0x00007FFF8F9D0000-memory.dmp
          Download

          memory/5496-186-0x00007FFF8F9C0000-0x00007FFF8F9D0000-memory.dmp
          Download

          memory/5496-182-0x00007FFF925A0000-0x00007FFF925B0000-memory.dmp
          Download

          memory/5496-177-0x00007FFF925A0000-0x00007FFF925B0000-memory.dmp
          Download

          memory/5496-175-0x00007FFF925A0000-0x00007FFF925B0000-memory.dmp
          Download

          memory/5496-176-0x00007FFF925A0000-0x00007FFF925B0000-memory.dmp
          Download

          memory/5852-313-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5852-322-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5852-319-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5852-325-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5852-329-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5852-316-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5852-292-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/5916-155-0x0000000000910000-0x00000000009CE000-memory.dmp
          Download