Overview

overview

10

Static

static

10

2026-08-10..._n.exe

windows10-2004-x64

10

2026-08-10..._n.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 17:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_3b5ef6680becec7677869c6c5bbb4578_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
  • Size 1.5MB
  • Sample260810-v3cw4atgma
  • SHA256 d2e9e026df4d19fa058584ed39ad7b22359a9176e32957fe4c24e55bfa9da9ad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoverybabylonratneshtaxredpersistencespywarestealertrojan

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat
  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Babylon RAT payload 12 IoCs
  • Detect Neshta payload 64 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 12 IoCs
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_3b5ef6680becec7677869c6c5bbb4578_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_3b5ef6680becec7677869c6c5bbb4578_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-10_3b5ef6680becec7677869c6c5bbb4578_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-10_3b5ef6680becec7677869c6c5bbb4578_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-08-10_3b5ef6680becec7677869c6c5bbb4578_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-08-10_3b5ef6680becec7677869c6c5bbb4578_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4292
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 540
          4⤵
          • Program crash
          PID:3528
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4500
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3204
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3212
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 540
              6⤵
              • Program crash
              PID:3244
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4292 -ip 4292
    1⤵
      PID:2096
    • C:\ProgramData\Synaptics\Synaptics.exe
      C:\ProgramData\Synaptics\Synaptics.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Windows\SysWOW64\._cache_Synaptics.exe
        "C:\Windows\system32\._cache_Synaptics.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4716
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3296
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2140
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 512
              5⤵
              • Program crash
              PID:4844
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1932
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3212 -ip 3212
      1⤵
        PID:3592
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2140 -ip 2140
        1⤵
          PID:2544

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Change Default File Association

              1
              T1546.001

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Change Default File Association

              1
              T1546.001

              Defense Evasion

              Modify Registry

              2
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Query Registry

              3
              T1012

              System Information Discovery

              4
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ACROBR~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
              • Size 328KB
              • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ACROTE~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
              • Size 86KB
              • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ADOBEC~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
              • Size 5.7MB
              • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ADelRCP.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
              • Size 175KB
              • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RdrCEF.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
              • Size 9.4MB
              • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AcroRd32.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
              • Size 2.4MB
              • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WCCHRO~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
              • Size 183KB
              • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Eula.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
              • Size 131KB
              • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FULLTR~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
              • Size 254KB
              • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LOGTRA~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
              • Size 386KB
              • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              READER~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
              • Size 92KB
              • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              arh.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
              • Size 125KB
              • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              32BITM~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
              • Size 142KB
              • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              64BITM~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
              • Size 278KB
              • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AdobeARM.exe
              • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
              • Size 1.2MB
              • SHA256 42716ea8beca9e555cef3b78a2fbf836c9da034318d625262810290309d955db
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jaureg.exe
              • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
              • Size 595KB
              • SHA256 ee2236d13bbde89936decef22282b8378ac56610b90749944baa3a690d7acb5b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOIN~1.EXE
              • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
              • Size 121KB
              • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
              • Size 325KB
              • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
              • Size 325KB
              • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaws.exe
              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
              • Size 505KB
              • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DISABL~1.EXE
              • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
              • Size 5.7MB
              • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IE_TO_~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
              • Size 557KB
              • SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ELEVAT~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE
              • Size 1.8MB
              • SHA256 47eb0dc0cd08f4faa389621c43d6407283e3c315012ef1078a6018c117f195b2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IDENTI~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE
              • Size 1.1MB
              • SHA256 94c99d3284962585c15fdb061e0685287df11c872ef930263e251d8d3084d5b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe
              • Size 6.6MB
              • SHA256 4ea8adca8a7f73fc71c7e45ef98f8c422a8b161ca6b6fcd912aec701bebd08a5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSEDGE~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~1.EXE
              • Size 3.2MB
              • SHA256 fc0701d5c47cbd883929abfccf5f6ba88f76a4d0ebfa2d28160cf6c28f018e26
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSEDGE~2.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE
              • Size 1.1MB
              • SHA256 550e6ad6b5fb0dabd28d9009c790b22e9444fc9fc30e952210727f6ac4a00389
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSEDGE~3.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~3.EXE
              • Size 1.5MB
              • SHA256 eb9bbc44c181ddef0d8b53b69bd7327f5c150c0b72d92805a9f3a9ba333f0575
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NOTIFI~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\NOTIFI~1.EXE
              • Size 1.3MB
              • SHA256 447a7ccfbece37792dfd82e6cf4e644e261dbe0f3e23a13c475276e8e4fa3561
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PWAHEL~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\PWAHEL~1.EXE
              • Size 1.1MB
              • SHA256 c57f8707c1fda09d33efc6b615c0d48174253e9869772841446302748f1f9016
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe
              • Size 3.8MB
              • SHA256 6773bf49098b9fa85725651bc789ec2bcef5dd563a356043468c1f7b235defef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ie_to_edge_stub.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
              • Size 562KB
              • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
              • Size 7.1MB
              • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cookie_exporter.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
              • Size 155KB
              • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
              • Size 3.8MB
              • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
              • Size 2.2MB
              • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              identity_helper.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
              • Size 1.4MB
              • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe
              • Size 4.0MB
              • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge_proxy.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe
              • Size 1.5MB
              • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedgewebview2.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
              • Size 3.4MB
              • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_helper.exe
              • Size 1.7MB
              • SHA256 f1e65e27e2cdc6003fb5cb4c1dbfee5215066d0980fd1c8434c9774e5657ea58
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PWAHEL~1.EXE
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
              • Size 1.4MB
              • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Synaptics.exe
              • Path C:\ProgramData\Synaptics\Synaptics.exe
              • Size 1.5MB
              • SHA256 d2e9e026df4d19fa058584ed39ad7b22359a9176e32957fe4c24e55bfa9da9ad
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ._cache_2026-08-10_3b5ef6680becec7677869c6c5bbb4578_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
              • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-10_3b5ef6680becec7677869c6c5bbb4578_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
              • Size 768KB
              • SHA256 9a722613f807af7d7d2c108f324b728852233fc15a9eeed1906e5bbcb33f9616
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ._cache_2026-08-10_3b5ef6680becec7677869c6c5bbb4578_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
              • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-08-10_3b5ef6680becec7677869c6c5bbb4578_dark-comet_darkgate_elex_gcleaner_glassworm_manuscrypt_n.exe
              • Size 727KB
              • SHA256 cb1c1dec2980acb674da9b9cb077fda38cfc035a600f65c6fdc84cb8636eddb0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              47885E00
              • Path C:\Users\Admin\AppData\Local\Temp\47885E00
              • Size 26KB
              • SHA256 1713c66a89e071a331325a339ccd6c645398dc36fda945a01fad965402aab309
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              svchost.com
              • Path C:\Windows\svchost.com
              • Size 40KB
              • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/436-0-0x0000000002300000-0x0000000002301000-memory.dmp
              Download

              memory/436-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
              Download

              memory/436-102-0x0000000000400000-0x0000000000582000-memory.dmp
              Download

              memory/1136-412-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1136-366-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1136-421-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1136-428-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1136-424-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1932-176-0x00007FFC27C90000-0x00007FFC27CA0000-memory.dmp
              Download

              memory/1932-238-0x00007FFC25A80000-0x00007FFC25A90000-memory.dmp
              Download

              memory/1932-175-0x00007FFC27C90000-0x00007FFC27CA0000-memory.dmp
              Download

              memory/1932-177-0x00007FFC27C90000-0x00007FFC27CA0000-memory.dmp
              Download

              memory/1932-174-0x00007FFC27C90000-0x00007FFC27CA0000-memory.dmp
              Download

              memory/1932-202-0x00007FFC25A80000-0x00007FFC25A90000-memory.dmp
              Download

              memory/1932-178-0x00007FFC27C90000-0x00007FFC27CA0000-memory.dmp
              Download

              memory/2244-194-0x0000000000400000-0x0000000000582000-memory.dmp
              Download

              memory/3204-292-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/3212-201-0x0000000000E40000-0x0000000000EFE000-memory.dmp
              Download

              memory/3296-339-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4292-114-0x0000000000980000-0x0000000000A3E000-memory.dmp
              Download

              memory/4500-411-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4500-429-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4500-426-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4500-414-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4500-423-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4716-243-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4864-103-0x0000000000400000-0x0000000000582000-memory.dmp
              Download

              memory/4864-413-0x0000000000400000-0x0000000000582000-memory.dmp
              Download

              memory/4864-407-0x0000000000400000-0x0000000000582000-memory.dmp
              Download

              memory/4864-438-0x0000000000400000-0x0000000000582000-memory.dmp
              Download

              memory/4864-439-0x0000000000400000-0x0000000000582000-memory.dmp
              Download