Overview

overview

10

Static

static

10

2026-08-20...ht.exe

windows10-2004-x64

10

2026-08-20...ht.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 22:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe
  • Size 3.1MB
  • Sample260820-19jacawfpd
  • SHA256 ea47671c0fd907384b6f9507f46815b9ebe5558d28f948ea9b49704a4340db35
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoveryneshtaxredpersistencespywarestealer

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detect Neshta payload 64 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 5 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 31 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4652
      • C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:268
        • C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1100
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3088
            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1016
              • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3388
                • C:\8a42fec569aa98238ccc04\Setup.exe
                  C:\8a42fec569aa98238ccc04\\Setup.exe /x86 /x64 /ia64 /web
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Checks processor information in registry
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:6060
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2100
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2568
  • C:\ProgramData\Synaptics\Synaptics.exe
    C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1836

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Change Default File Association

        1
        T1546.001

        Defense Evasion

        Modify Registry

        2
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ACROBR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
        • Size 328KB
        • SHA256 be151d598b9be8b520d2c1c548c92176ce35da4138f2f27fcf5c1ebbc3cb6223
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ACROTE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
        • Size 86KB
        • SHA256 18dcc8fae245869d02b7db0edbe22ec57a30bdd51a64090452118a79ba194052
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEC~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
        • Size 5.7MB
        • SHA256 e5f45c850387ca729724da4882d28684ae490440d3041eb66242bc3236793f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADelRCP.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
        • Size 175KB
        • SHA256 9b0126769d9b6b85904daba1177643acad94f233c203a70c5074418badff14df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RdrCEF.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
        • Size 9.4MB
        • SHA256 d13d2cd776ee4847d8db558668af55e38e43aaec73ffd1748e4038e5b5430206
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AcroRd32.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
        • Size 2.4MB
        • SHA256 3a80a34a759ac761bfc2aec2f5517c5b2cb118bb99da0d8c0132613b4a63d9b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WCCHRO~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
        • Size 183KB
        • SHA256 d63b573af5ab4f22d3bfdd63d59ef879b9910620abb1def89a65ed42080cdd48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Eula.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
        • Size 131KB
        • SHA256 5d9a886a092843fc50143ad567635496dc1057463a5d527c228334cde83e6e74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FULLTR~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
        • Size 254KB
        • SHA256 7e35f178ca0bcfdc588ec787fcd68ab394d7d5c6158397a5b187bcafd67dfa62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LOGTRA~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
        • Size 386KB
        • SHA256 9fe4c58a6a80ea679ad0d1d9ed98fc5784faed44162f1717ec8e82ff7c1fc43f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        READER~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
        • Size 92KB
        • SHA256 e64629ff1f0441fbd1c5c1b871fdf1809b3986855996588b9284fb3801e9a84c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WOW_HE~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
        • Size 147KB
        • SHA256 074082237bc7ac1873384c9a764aa3472582ed9d8fb570b5a47a7094136895ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        arh.exe
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
        • Size 125KB
        • SHA256 84a567c83706330084641739b26ee8875bf8e48c0a7ddcd18965fd15bf9f878f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        32BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
        • Size 142KB
        • SHA256 18e2b49f3424837903ee2145507f755b4a7735401cef580f3054bae841b468d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        64BITM~1.EXE
        • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
        • Size 278KB
        • SHA256 bd0a76cf15e688c105f9d11a42ae613921b7a9f7db4fda80565608a02949bcc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ADOBEA~1.EXE
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
        • Size 454KB
        • SHA256 dc8d5c3dd7cbad8f5cee36cc16ef9a281100a4065a159defef1e26966ffd3943
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AdobeARM.exe
        • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
        • Size 1.2MB
        • SHA256 bd62388949011e1d6acc96aacb0474ae9ac7b870f284dc3901cabe4a50740f60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jaureg.exe
        • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
        • Size 555KB
        • SHA256 f8092b83608a0983861ea139cd0edc4e60313054e8addf3d2f14fdb893bc2bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOIN~1.EXE
        • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
        • Size 121KB
        • SHA256 4d90f14ffe32c1325f19cafd7a49bdd9ebe6b2ea10d9bb8afacdb393a75cf959
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
        • Size 325KB
        • SHA256 104041ff4b1f594bc070e62eac0cd791ff0083ef5d19a924408dff2dc9147944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
        • Size 325KB
        • SHA256 06d5159ece06d9dbd2e388bbd018fdfe20e61e559c1e22a9737c874ab3086e8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
        • Size 505KB
        • SHA256 656b36e3222f4c632cbeadd55beb96ee4a012d277dfac55b8b6e748978c18457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DISABL~1.EXE
        • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
        • Size 5.7MB
        • SHA256 66daa34deec34e08c9669af7a653436cc2e0d6c5672a925c7c883fd3247ad453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ie_to_edge_stub.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe
        • Size 553KB
        • SHA256 66082faf80d388963e0cd4aeb2aa15838c60e41284ab2f33809e25d6a7328edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe
        • Size 6.8MB
        • SHA256 7f8b69ba64e30425de76066c297e7e66e9428e6a50af11aef15d0b5c33e514a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cookie_exporter.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe
        • Size 157KB
        • SHA256 df01b74898a6cbd34978f6ea1cf41cebece96dc7ce4e48dc4381fdea5250e469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe
        • Size 1.7MB
        • SHA256 9d88061b13585b4e515af270175ecc530a83a116631df8212e0ea94969e92829
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        identity_helper.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe
        • Size 1.2MB
        • SHA256 bc2efd7b587ec79fd55019f3d6aeea18cf2386121a473bb1466cb673e93a3a39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe
        • Size 3.9MB
        • SHA256 75611ed66adafe3c30777f98788951b531f847363453bc19f346ae671a47c7b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_proxy.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe
        • Size 1.2MB
        • SHA256 b4672567e773f6fbfbafe54e357aee43741a2977cf7ea66001eddef4cd6793ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_pwa_launcher.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe
        • Size 1.6MB
        • SHA256 134170b726506a9e01dab9a7ae891883d889dc827cb1025fa1e9331dcd991e08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgewebview2.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe
        • Size 3.5MB
        • SHA256 d3c1b1e7e0fb6198cdec05532e761e44734565ecd46a5b2765eb4f4473a8deb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe
        • Size 1.4MB
        • SHA256 b677a37fb6616c635a0f1a993afcb9891d0b48cee940c360e295d907400c92f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ie_to_edge_stub.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
        • Size 562KB
        • SHA256 d315eef3c897d32490e06eeec042fc92895930225d55e9203fb09d2340c4bc75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
        • Size 7.1MB
        • SHA256 e1fa804d18525f14aebb653e4da24567cd581e51a7cb8bb9a6590d90d0eefebe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cookie_exporter.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
        • Size 155KB
        • SHA256 706d0d861643950d199f07ea28a8567bff528573e43e057b0a78312e0c3cb5ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
        • Size 3.8MB
        • SHA256 489b216269e96aba7a98dd6a67caf3ad5106d98923f511143d6f8230cbc6a3b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
        • Size 2.2MB
        • SHA256 f101fb2b7bf2c6ad7b87e0004b1ce3870de4d653a66874e7e8c26994d9356215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        identity_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
        • Size 1.4MB
        • SHA256 24bedc00c0b17fb6fcb87bae0042cbd74cb48b4244d08808f7c1a9e770bb4b7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_pwa_launcher.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
        • Size 1.8MB
        • SHA256 008eb43cdbd5df09e906cb3bd9913e1950a534a74f213e1c163771e11781e074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgewebview2.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
        • Size 3.4MB
        • SHA256 c78036f9c989c84ed97f7dd2e41857b57485e5aabfd3d7ee108bd5202628b8bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_click_helper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
        • Size 1.6MB
        • SHA256 1377e7a461c2ef9a95c4effe5ddce95bd2b2aa978f5a8de16d0806d8599df186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pwahelper.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe
        • Size 1.4MB
        • SHA256 4dc274c7e6b2cf08a2e4464b288e660720eda97baf72807160a8b8b9089236c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSEDGE~1.EXE
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
        • Size 1.5MB
        • SHA256 f1023799b71e06601f14f399f94dce66ab2341eeb84f1d66ac41f38b7e5e6513
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
        • Size 4.0MB
        • SHA256 8380e9cefcf4f4cfacb9a08c457b82d0144184b6e1ca0bb30e7b42e499aab922
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Synaptics.exe
        • Path C:\ProgramData\Synaptics\Synaptics.exe
        • Size 753KB
        • SHA256 14487df946bb1bff496d5d595c4865cebb03f9704c8769dac000d18e8c7d92a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe
        • Path C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe
        • Size 1.6MB
        • SHA256 489c0909465ffd070a7a0bfc8fbe67515e3b85317b3e0677918b8699b8c83b06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe
        • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe
        • Size 2.4MB
        • SHA256 e7199c61c48eb89dae35885e76c5bb87a9ffa2a99bdfae70bc95f80c53dc503c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache__CACHE~2.EXE
        • Path C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
        • Size 868KB
        • SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe
        • Size 1.6MB
        • SHA256 f8c39a8b1e229d775328bffa40493c830607a6755fd7e77a875e13845b96302a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-08-20_053a844cedc7ac30419f34bc24e225d7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_nesht.exe
        • Size 2.4MB
        • SHA256 c4a12efd93e5eb642aedfdeb111ccf9cdfeeb23a03183baff348b59da59f9efb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        D4495E00
        • Path C:\Users\Admin\AppData\Local\Temp\D4495E00
        • Size 21KB
        • SHA256 00603cb68296096b64b1d38eea8a8664c3916df152fd494cbe957923427dad0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EPOjxgeY.xlsm
        • Path C:\Users\Admin\AppData\Local\Temp\EPOjxgeY.xlsm
        • Size 17KB
        • SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        HFI3DCB.tmp.html
        • Path C:\Users\Admin\AppData\Local\Temp\HFI3DCB.tmp.html
        • Size 63KB
        • SHA256 de04c192f4edab0e3aebfbffb378bd9c64569d940aa45967f4e2453861e6fe85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        svchost.com
        • Path C:\Windows\svchost.com
        • Size 40KB
        • SHA256 6dae57184ff6d2f70736cb793de9312e8c617991637797c3907eba08f1c52c37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/268-164-0x0000000000400000-0x0000000000662000-memory.dmp
        Download

        memory/1016-396-0x0000000000400000-0x000000000059B000-memory.dmp
        Download

        memory/1100-640-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/1100-660-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/1100-656-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/1100-653-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/1100-650-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/1100-637-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/1100-636-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/1836-115-0x0000000000400000-0x00000000004C2000-memory.dmp
        Download

        memory/2100-635-0x0000000000400000-0x00000000004C2000-memory.dmp
        Download

        memory/2100-677-0x0000000000400000-0x00000000004C2000-memory.dmp
        Download

        memory/2100-639-0x0000000000400000-0x00000000004C2000-memory.dmp
        Download

        memory/2568-103-0x00007FFD924A0000-0x00007FFD924B0000-memory.dmp
        Download

        memory/2568-108-0x00007FFD924A0000-0x00007FFD924B0000-memory.dmp
        Download

        memory/2568-105-0x00007FFD924A0000-0x00007FFD924B0000-memory.dmp
        Download

        memory/2568-117-0x00007FFD90100000-0x00007FFD90110000-memory.dmp
        Download

        memory/2568-116-0x00007FFD90100000-0x00007FFD90110000-memory.dmp
        Download

        memory/2568-111-0x00007FFD924A0000-0x00007FFD924B0000-memory.dmp
        Download

        memory/2568-104-0x00007FFD924A0000-0x00007FFD924B0000-memory.dmp
        Download

        memory/2836-0-0x00000000025F0000-0x00000000025F1000-memory.dmp
        Download

        memory/2836-101-0x0000000000400000-0x0000000000728000-memory.dmp
        Download

        memory/2836-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
        Download

        memory/3088-333-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/4652-645-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/4652-651-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/4652-654-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/4652-638-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/4652-658-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/4652-35-0x0000000000400000-0x000000000042B000-memory.dmp
        Download

        memory/4652-633-0x0000000000400000-0x000000000042B000-memory.dmp
        Download