Analysis
- max time kernel
48s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/11/2026, 01:49
General
- Target 2026-11-08_714eb88eae10b290e73c21b4bae7c649_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
- Size 1.5MB
- Sample261109-b8p9tsbf99
- SHA256 4956ae67ac270a8b1554580ecf44d30aaecf7eb43a17fb3bad41174cc0717f20
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
sality
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Family: Sality
Sality is backdoor written in C++, first discovered in 2003.
- Family: Xred
Xred is backdoor written in Delphi.
- Modifies firewall policy service 3 TTPs 6 IoCs
- UAC bypass 3 TTPs 2 IoCs
- Custom signatureDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 47 IoCs
- Custom signatureUPX dump on OEP (original entry point) 50 IoCs
- Executes dropped EXE 3 IoCs
- Windows security bypass 2 TTPs 12 IoCs
- Windows security modification 2 TTPs 14 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 47 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 3 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-11-08_714eb88eae10b290e73c21b4bae7c649_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-08_714eb88eae10b290e73c21b4bae7c649_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_2026-11-08_714eb88eae10b290e73c21b4bae7c649_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2026-11-08_714eb88eae10b290e73c21b4bae7c649_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Executes dropped EXE
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ni.com/rteFinder?dest=lvrte&version=15.0&platform=Win7_32&lang=en5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe7610c188,0x7ffe7610c194,0x7ffe7610c1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,865241612346249910,4128002006922054214,262144 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,15043676334341164637,14131039726220282408,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:116⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,7484971933646102106,1397348157515320130,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:136⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,13663261672213262229,6798669272093623364,2097152 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,4911689560295137492,10498364928143110549,2097152 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,6240881144251897110,8707437100516548639,2097152 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,1570853643215927148,12797825688786107162,2097152 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:96⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3992,i,1620118344556738913,16675869034268755792,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5372,i,17917751652004033870,946031814003066893,2097152 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,13520487285259989081,9797113365794027349,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,5838720571537264963,6741304128848548628,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5784,i,877109565488158789,1996602794055081912,2097152 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,3625134979993288418,5633237143655493583,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,3625134979993288418,5633237143655493583,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3032,i,1037361126105612728,10473448381044367441,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,468062156925207437,9103699946667654950,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,15596207193049561797,2778556986364373382,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,5414699592100849295,13066608086810719406,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2828,i,12639293211362134191,14486042230120922274,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,14615423901193078178,13540738568905826040,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,18161392289934542585,16387452952534769829,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,15803364917945031594,8100687679854070694,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,6526617494503932700,6786297096143239585,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,12830604743056285541,11716918217554035983,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,13975328339722346520,18307279382726404957,524288 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3048,i,13081120803067582674,16062319853173015277,262144 --field-trial-handle=2260,i,8694255437335868606,9687051736159107051,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:106⤵
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate4⤵
- Modifies firewall policy service
- UAC bypass
- Executes dropped EXE
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
msedge.exe
Synaptics.exe
2d870e4e-ba44-47db-a5f0-0f1c5157f602.tmp
3be526c2-56ec-41bd-b906-83024cd10e14.tmp
522d7d5d-82b5-479d-91c3-cd14f2b76e37.tmp
75f09ce0-ed2a-4ec8-b8fe-a12237a7cf1a.tmp
settings.dat
settings.dat
078077e7-6297-4fc0-880b-4b3dbc689910.tmp
37f7dbb4-1195-4ffd-9dbe-8fe295d496fa.tmp
temp-index
the-real-index
927b8127-c3c8-4551-afd3-e984fb7cf611.tmp
dasherSettingSchema.json
36cda95f-3dba-4e1f-ada9-a081c76df748.tmp
6f4ea266-3dac-4c1d-a7d5-6076fae3b788.tmp
b8bf4b18-d279-46f0-b561-ea3e1b4b0f8d.tmp
sync_diagnostic.log
ca520d46-3b2c-437b-a984-566d31efc695.tmp
d3da5b28-17f8-474c-b0aa-7013bf65465a.tmp
e494b854-635c-47d9-ad0b-2bc9adcf4ba0.tmp
f4f634f9-9ae2-44fc-9daa-c896e8a8e749.tmp
f9c5e5a5-453c-41ce-846f-ed1388c7064d.tmp
45d206fc-6be5-49c8-a0c3-47229494e428.tmp
OperationConfig
aa675931-f72f-4870-a3b9-f7b82416315d.tmp
0c0e83be-3438-461f-a418-87999f2105d5.tmp
dd9020a7-8ec0-4384-acc6-402a2833d616.tmp
fec535eb-5a0e-40a8-8307-c4ff027c2dea.tmp
d1fa6370-543e-4697-a9bf-5b9b1ddbc0ed.tmp
dade2887-6594-487d-a919-104db0db4620.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
aa206310-b4e0-4fbb-94f2-76c42f77d477.tmp
cf664182-11da-42f6-99f9-b2a1c7e906a2.tmp
f2551be4-4f7a-4e37-83f4-17e14a78ad59.tmp
._cache_2026-11-08_714eb88eae10b290e73c21b4bae7c649_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
1F2oraDz.xlsm
aecd32e6-d2e3-4f73-b597-49e4ea88701e.tmp
b994a812-2da7-4fb0-91b8-668a8367eb03.tmp
messages.json
content.js
winnofinu.exe
SYSTEM.INI
manifest.json
manifest.json
manifest.json
kfdtth.exe
memory/964-158-0x00007FFE5D600000-0x00007FFE5D610000-memory.dmp
memory/964-156-0x00007FFE5F9A0000-0x00007FFE5F9B0000-memory.dmp
memory/964-152-0x00007FFE5F9A0000-0x00007FFE5F9B0000-memory.dmp
memory/964-153-0x00007FFE5F9A0000-0x00007FFE5F9B0000-memory.dmp
memory/964-157-0x00007FFE5D600000-0x00007FFE5D610000-memory.dmp
memory/964-154-0x00007FFE5F9A0000-0x00007FFE5F9B0000-memory.dmp
memory/964-155-0x00007FFE5F9A0000-0x00007FFE5F9B0000-memory.dmp
memory/2420-151-0x0000000000400000-0x00000000004C3000-memory.dmp
memory/4136-133-0x0000000003460000-0x0000000003462000-memory.dmp
memory/4136-148-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4136-142-0x0000000003460000-0x0000000003462000-memory.dmp
memory/4136-134-0x00000000035B0000-0x00000000035B1000-memory.dmp
memory/4136-0-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4136-1-0x0000000002260000-0x0000000002261000-memory.dmp
memory/4136-2-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/4136-138-0x0000000003460000-0x0000000003462000-memory.dmp
memory/4536-159-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-174-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-137-0x00000000037F0000-0x00000000037F2000-memory.dmp
memory/4536-119-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-130-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-185-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-136-0x00000000054B0000-0x00000000054B1000-memory.dmp
memory/4536-160-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-69-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-165-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-170-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-172-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-171-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-72-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-181-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/4536-131-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-129-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-128-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-132-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-182-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-71-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-67-0x0000000002530000-0x00000000035EA000-memory.dmp
memory/4536-66-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/4536-60-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/4536-202-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/4536-190-0x00000000037F0000-0x00000000037F2000-memory.dmp
memory/4600-248-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-530-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-531-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-532-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-533-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-529-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-500-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-497-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-541-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-449-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-414-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-406-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-383-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-363-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-362-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-359-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-299-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-265-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-263-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-264-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-262-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-258-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-257-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-256-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-249-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-247-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-241-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-220-0x0000000005D30000-0x0000000006DEA000-memory.dmp
memory/4600-212-0x0000000000400000-0x00000000004C3000-memory.dmp
memory/4600-169-0x0000000000400000-0x00000000004C3000-memory.dmp
memory/4600-168-0x0000000002330000-0x0000000002332000-memory.dmp
memory/4600-167-0x00000000037D0000-0x00000000037D1000-memory.dmp
memory/4600-145-0x0000000000400000-0x00000000004C3000-memory.dmp