Overview

overview

10

Static

static

10

2026-08-17...ac.exe

windows10-2004-x64

10

2026-08-17...ac.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 03:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijac.exe
  • Size 1.0MB
  • Sample260817-d19plssekf
  • SHA256 7055d4a8119376b44d406afefbf3c98312d6f380e82cbcc54c5d94177c3011ff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoveryneshtaxredpersistencespywarestealer

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detect Neshta payload 63 IoCs
  • Executes dropped EXE 6 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijac.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijac.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5288
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijac.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijac.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4480
      • C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijac.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijac.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2904
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3576
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1672
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2772
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1064
  • C:\ProgramData\Synaptics\Synaptics.exe
    C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2820

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Modify Registry

        2
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ACROBR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
        • Size 328KB
        • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ACROTE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
        • Size 86KB
        • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEC~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
        • Size 5.7MB
        • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADelRCP.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
        • Size 175KB
        • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RdrCEF.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
        • Size 9.4MB
        • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AcroRd32.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
        • Size 2.4MB
        • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WCCHRO~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
        • Size 183KB
        • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Eula.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
        • Size 131KB
        • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FULLTR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
        • Size 254KB
        • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LOGTRA~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
        • Size 386KB
        • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        READER~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
        • Size 92KB
        • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WOW_HE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
        • Size 147KB
        • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        arh.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
        • Size 125KB
        • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        32BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
        • Size 142KB
        • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        64BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
        • Size 278KB
        • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEA~1.EXE
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
        • Size 454KB
        • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AdobeARM.exe
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
        • Size 1.2MB
        • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaureg.exe
        • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
        • Size 555KB
        • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOIN~1.EXE
        • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
        • Size 121KB
        • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
        • Size 325KB
        • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
        • Size 325KB
        • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
        • Size 505KB
        • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DISABL~1.EXE
        • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
        • Size 5.7MB
        • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MID1AD~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE
        • Size 342KB
        • SHA256 2a0f2d58ec7a361586b7c85ea0fa2be0c8b60660defce6e776b8477c287a28d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdgeUpdate.exe
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe
        • Size 282KB
        • SHA256 f4e39e3be182a8380334523f75926ff6c9986622e7d2097c46aa41ebc7097f0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MIA062~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MIA062~1.EXE
        • Size 1.7MB
        • SHA256 44bd746b05371e4bb5b19a09de5aa32c283e1de5a48d037803c659223d7e33ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MICROS~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~1.EXE
        • Size 242KB
        • SHA256 03044d2ffe2c87ce479dbdb722183cb7f806510a5b27460153ef9b3906a0f7ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MICROS~4.EXE
        • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~4.EXE
        • Size 223KB
        • SHA256 2b29cceb8d78c397f9be4f35f54752078e1d1d51653a8cbddbd06f7ccc860602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ie_to_edge_stub.exe
        • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\122023~1.106\BHO\ie_to_edge_stub.exe
        • Size 553KB
        • SHA256 7b2d809ff4b2691c04855f4bb3d89b88fa4d1d65c8c35d3941a26f015947cde9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\122023~1.106\INSTAL~1\setup.exe
        • Size 6.8MB
        • SHA256 78e1d1e4460914eb8be59bb96d9897562a0ac65a5fbce63349f43ee56ba5e83b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\122023~1.106\elevation_service.exe
        • Size 1.7MB
        • SHA256 2177d0e64ef5cd4d3ad386606feb8d45ae0a7d070f19583b67eea9407272b9f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\122023~1.106\msedge.exe
        • Size 4.0MB
        • SHA256 e23b6687248a700bc5743390871b926150f70e68e0d3cb3f4c60e2ec244df101
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_proxy.exe
        • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\122023~1.106\msedge_proxy.exe
        • Size 1.2MB
        • SHA256 6f3f49143cab7ee4c239f74f6649241ddd527040ea390a3a214b1d7b8f113fc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgewebview2.exe
        • Path C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\122023~1.106\msedgewebview2.exe
        • Size 3.5MB
        • SHA256 8388af9aa4d7a65860f3bb239098697a4abab602f33fdc5db55c1ac5b960c14c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cookie_exporter.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe
        • Size 157KB
        • SHA256 3ecafed639ffb272e758902d1baa0b399c044bfb744cedd6bda1ed40516ca132
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        identity_helper.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe
        • Size 1.2MB
        • SHA256 d2decf24ecc69018df3da6dde66ca81e168dbcea91c6d4ceb428a1929778b39e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        COOKIE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\COOKIE~1.EXE
        • Size 195KB
        • SHA256 b7f133ecf56727c90e3174c96f3dbcc0b787690f7719d9da82b4e6d58f79573e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ELEVAT~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\ELEVAT~1.EXE
        • Size 3.8MB
        • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\INSTAL~1\setup.exe
        • Size 7.1MB
        • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\MSEDGE~1.EXE
        • Size 3.4MB
        • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~2.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\MSEDGE~2.EXE
        • Size 1.5MB
        • SHA256 e4f485ec226392e461bc5987bf168bb986c7394465c4fd8588ccc5977e44ca4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~3.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\MSEDGE~3.EXE
        • Size 1.8MB
        • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PWAHEL~1.EXE
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\PWAHEL~1.EXE
        • Size 1.4MB
        • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\139034~1.125\msedge.exe
        • Size 4.0MB
        • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ie_to_edge_stub.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
        • Size 603KB
        • SHA256 c83ee895847570d2e215eb82731342ca6e569118000a2b06938887dde611dcaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
        • Size 2.2MB
        • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        identity_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
        • Size 1.4MB
        • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_helper.exe
        • Size 1.7MB
        • SHA256 f1e65e27e2cdc6003fb5cb4c1dbfee5215066d0980fd1c8434c9774e5657ea58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Synaptics.exe
        • Path C:\ProgramData\Synaptics\Synaptics.exe
        • Size 753KB
        • SHA256 5e6ba1b757aca87ffa6fbfdf2d0f5b97ae840d2106bf3168d801d13da86c6593
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijac.exe
        • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijac.exe
        • Size 251KB
        • SHA256 79b46b477cd182188115ba2384ecbaa4194e46db914fee81bc5f663b047a7436
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijac.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijac.exe
        • Size 211KB
        • SHA256 be3bfa8fcfaab4f361445bfc522829356d77229a517edd08153a50d3de0333c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijac.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-17_a11b778d0b490b84c8415bfde93e2445_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hijac.exe
        • Size 1005KB
        • SHA256 1a578149d8b2b8f637f48de54e121ad1f8d66552ef0c6f82078c799c90e772ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        5CC95E00
        • Path C:\Users\Admin\AppData\Local\Temp\5CC95E00
        • Size 26KB
        • SHA256 c8e525c2af114b8eef582b2c716538831e0f0ab618b495f3d97ed0bfc93b5644
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        svchost.com
        • Path C:\Windows\svchost.com
        • Size 40KB
        • SHA256 aa912ac7f01fa1163da25e0d33efb735c4b59f219579ca193ebd1a795a21c648
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1064-277-0x00007FFBEF230000-0x00007FFBEF240000-memory.dmp
        Download

        memory/1064-198-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp
        Download

        memory/1064-199-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp
        Download

        memory/1064-205-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp
        Download

        memory/1064-268-0x00007FFBEF230000-0x00007FFBEF240000-memory.dmp
        Download

        memory/1064-200-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp
        Download

        memory/1064-179-0x00007FFBF1D80000-0x00007FFBF1D90000-memory.dmp
        Download

        memory/2772-378-0x0000000000400000-0x00000000004C2000-memory.dmp
        Download

        memory/2772-365-0x0000000000400000-0x00000000004C2000-memory.dmp
        Download

        memory/2772-341-0x0000000000400000-0x00000000004C2000-memory.dmp
        Download

        memory/2772-338-0x0000000000400000-0x00000000004C2000-memory.dmp
        Download

        memory/2820-282-0x0000000000400000-0x00000000004C2000-memory.dmp
        Download

        memory/2904-337-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2904-344-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2904-358-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2904-353-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/2904-340-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/3576-303-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/4480-10-0x00000000023C0000-0x00000000023C1000-memory.dmp
        Download

        memory/4480-11-0x00000000004A0000-0x00000000004A1000-memory.dmp
        Download

        memory/4480-130-0x0000000000400000-0x0000000000501000-memory.dmp
        Download

        memory/5288-343-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/5288-336-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/5288-352-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/5288-339-0x0000000000400000-0x000000000041B000-memory.dmp
        Download

        memory/5288-357-0x0000000000400000-0x000000000041B000-memory.dmp
        Download