Analysis
- user interaction
yes - max time kernel
1050s - max time network
1046s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
24/04/2026, 06:53
General
- Target https://ekmeowstarryoverlay.com/setup
- Sample260424-hn5bksh141
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 20 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 41 IoCs
- Loads dropped DLL 52 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 16 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 42 IoCs
- Suspicious behavior: EnumeratesProcesses 33 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ekmeowstarryoverlay.com/setup1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2c4,0x7ff834c0c188,0x7ff834c0c194,0x7ff834c0c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,10235738752092301514,8370821972778552750,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,841631285272671428,9081878298993899299,262144 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,981154275287762308,2594865865336298391,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,18021041293913371812,10970078453286815804,2097152 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,4782788619026319718,14700468637721915682,2097152 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,5138254297554961246,10621520298647115237,2097152 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,18395661076717997407,17191207264926566995,2097152 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,11332333855335755740,353330326067674684,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,10142476072778182625,12648932949540391954,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,368185071265111270,11755183401921073602,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,11961983736385587459,7320111407895289103,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,6741853911761967403,15266708689703638772,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,6741853911761967403,15266708689703638772,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,4679821320600632960,16866037065238355534,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,8061827791116746876,727580353127407951,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,16598843467838456288,11333772304843540384,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,15979712133654937632,2285856847746385611,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,6538112330753691527,8267381742642197018,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,15960301960535914833,692548806759660464,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6612,i,2104935744703667469,14985640944312198253,2097152 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,17166838560793886793,5717917508204231061,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,8467203506817779233,18341432492958535767,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,5416570972241007943,5827369827402549880,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,13002708386442562962,4105733676715048144,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,14849814034658218441,17775800740738884785,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,17540800262425852198,3263608317608686336,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,16062138533952774287,7718451021411759990,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4560,i,12479636064949486686,8185705843671313113,2097152 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,11969440771617034266,1606860281461071644,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7116,i,6739055640578631596,13520594520649314108,262144 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,2261834833188878813,15802197267771205280,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,5559251868608866419,9361598549097244855,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,1396918285501374762,629181538850127178,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,7571196886636179323,7558113135664209312,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,6349084174658924679,5401825817833372843,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5496,i,582549316790780948,7344651347792422160,2097152 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,7553018598484358074,1454971891279787531,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7276,i,12088456247900109850,5869118398381367357,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5308,i,6415951428511435455,11929486589509132840,2097152 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7376,i,10825348037827079184,17415023561953607099,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7360,i,12812587638028189337,10507638196172168564,2097152 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=4560,i,11774364038636833168,15225416469378792486,2097152 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=3996,i,9429056812050443309,17822438948140565015,2097152 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=6472,i,15126441065845277111,12037291095249493417,2097152 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7792,i,2853383676504509401,4562141129278939726,2097152 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7720,i,6179423092827897149,9039829948960673420,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7976,i,15929024960915785891,936950240729117412,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=8064 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,6713249183445509831,10963940585764247860,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,3097952346111422444,11835941325190575706,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,3575378794620446483,7598205829117321822,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,14152743703803188263,15134198901313141352,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,15690264943882359100,6633214025920205355,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=8124 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7764,i,18166382365903512173,460274378098137237,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,17653967541678917850,16907188204145043500,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7600,i,7517880409099425207,1319333674315122991,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=140 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7508,i,3287682088568479483,6244674561939711433,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=7996 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,11851311130144892704,1028724953387688980,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7748,i,14655457525767886362,6972666435850940945,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,10899977884807154202,10710501303653679802,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,14388006199531631558,335012397689508798,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,15441523277119616195,17910476316887429462,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,5111333487522593211,5178785446769077764,524288 --field-trial-handle=2360,i,8052367707122500087,15451125376313326216,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342148753185741782⤵
-
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342148753248631782⤵
-
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342148753312029832⤵
-
-
C:\Windows\System32\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1342148753550032552⤵
-
-
C:\ProgramData\chocolatey\choco.exe"C:\ProgramData\chocolatey\choco.exe" -v2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "irm https://community.chocolatey.org/install.ps1|iex"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\chocolatey\bin\choco.exe"C:\ProgramData\chocolatey\bin\choco.exe" install nodejs --version=25.9.02⤵
- Executes dropped EXE
-
C:\ProgramData\chocolatey\choco.exe"C:\ProgramData\chocolatey\choco.exe" install nodejs --version=25.9.03⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\ProgramData\chocolatey\lib\nodejs.install\tools\node-v25.9.0-x64.msi" /quiet ADDLOCAL=ALL4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /a4⤵
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D9ABE837EFE67661ADE3766454B079BF2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6AA2BC5F18437F1787A0893D76A0D39A E Global\MSI00002⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 81AFBCAB655A2604E4A071F4088188822⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\StarryOverlay\" -spe -an -ai#7zMap11820:88:7zEvent122891⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\StarryOverlay\EKmeow's Starry Overlay.vbs"1⤵
- Checks computer location settings
-
C:\Windows\System32\cmd.execmd /c where node 2>nul2⤵
-
C:\Windows\system32\where.exewhere node3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd /d "C:\Users\Admin\Downloads\StarryOverlay\" && color 0E && title EKmeow's Starry Overlay - First Time Setup && echo. && echo ============================================= && echo EKmeow's Starry Overlay - First Run && echo ============================================= && echo. && echo Installing dependencies, please wait... && echo. && npm install --no-audit --no-fund && echo. && echo Setup complete! Starting the overlay... && echo. && timeout /t 2 /nobreak >nul && start "" wscript.exe "C:\Users\Admin\Downloads\StarryOverlay\EKmeow's Starry Overlay.vbs" && exit2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"3⤵
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"4⤵
- Executes dropped EXE
-
-
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" install --no-audit --no-fund3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c node install.js4⤵
-
C:\Program Files\nodejs\node.exenode install.js5⤵
- Checks computer location settings
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\Downloads\StarryOverlay\EKmeow's Starry Overlay.vbs"3⤵
- Checks computer location settings
-
C:\Windows\system32\cmd.execmd /c where node 2>nul4⤵
-
C:\Windows\system32\where.exewhere node5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd /d "C:\Users\Admin\Downloads\StarryOverlay\" && npx electron .4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"5⤵
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"6⤵
- Executes dropped EXE
-
-
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npx-cli.js" electron .5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c electron .6⤵
-
C:\Program Files\nodejs\node.exe"node" "C:\Users\Admin\Downloads\StarryOverlay\node_modules\.bin\\..\electron\cli.js" .7⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exeC:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe .8⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1792,i,2857257380643683411,16818667831803396337,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:29⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --field-trial-handle=2308,i,2857257380643683411,16818667831803396337,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:39⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --app-path="C:\Users\Admin\Downloads\StarryOverlay" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2540,i,2857257380643683411,16818667831803396337,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:19⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --app-path="C:\Users\Admin\Downloads\StarryOverlay" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2820,i,2857257380643683411,16818667831803396337,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:19⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --app-path="C:\Users\Admin\Downloads\StarryOverlay" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3948,i,2857257380643683411,16818667831803396337,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:19⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4144,i,2857257380643683411,16818667831803396337,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:89⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --field-trial-handle=3616,i,2857257380643683411,16818667831803396337,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:89⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --field-trial-handle=4392,i,2857257380643683411,16818667831803396337,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:89⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\StarryOverlay\EKmeow's Starry Overlay.vbs"1⤵
- Checks computer location settings
-
C:\Windows\System32\cmd.execmd /c where node 2>nul2⤵
-
C:\Windows\system32\where.exewhere node3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd /d "C:\Users\Admin\Downloads\StarryOverlay\" && npx electron .2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"3⤵
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"4⤵
- Executes dropped EXE
-
-
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npx-cli.js" electron .3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c electron .4⤵
-
C:\Program Files\nodejs\node.exe"node" "C:\Users\Admin\Downloads\StarryOverlay\node_modules\.bin\\..\electron\cli.js" .5⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exeC:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe .6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1816,i,17532482248778821375,9681638474622594063,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:27⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --field-trial-handle=2264,i,17532482248778821375,9681638474622594063,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:37⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --app-path="C:\Users\Admin\Downloads\StarryOverlay" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2480,i,17532482248778821375,9681638474622594063,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:17⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --app-path="C:\Users\Admin\Downloads\StarryOverlay" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2720,i,17532482248778821375,9681638474622594063,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:17⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --app-path="C:\Users\Admin\Downloads\StarryOverlay" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3780,i,17532482248778821375,9681638474622594063,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:17⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3900,i,17532482248778821375,9681638474622594063,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:87⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --field-trial-handle=4032,i,17532482248778821375,9681638474622594063,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:87⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --field-trial-handle=4136,i,17532482248778821375,9681638474622594063,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:87⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\StarryOverlay\EKmeow's Starry Overlay.vbs"1⤵
- Checks computer location settings
-
C:\Windows\System32\cmd.execmd /c where node 2>nul2⤵
-
C:\Windows\system32\where.exewhere node3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd /d "C:\Users\Admin\Downloads\StarryOverlay\" && npx electron .2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"3⤵
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"4⤵
- Executes dropped EXE
-
-
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npx-cli.js" electron .3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c electron .4⤵
-
C:\Program Files\nodejs\node.exe"node" "C:\Users\Admin\Downloads\StarryOverlay\node_modules\.bin\\..\electron\cli.js" .5⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exeC:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe .6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1816,i,14651449203754165769,1043591881936940717,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:27⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --field-trial-handle=2260,i,14651449203754165769,1043591881936940717,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:37⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --app-path="C:\Users\Admin\Downloads\StarryOverlay" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2508,i,14651449203754165769,1043591881936940717,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:17⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --app-path="C:\Users\Admin\Downloads\StarryOverlay" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2724,i,14651449203754165769,1043591881936940717,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:17⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3488,i,14651449203754165769,1043591881936940717,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:87⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --field-trial-handle=1264,i,14651449203754165769,1043591881936940717,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:87⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe"C:\Users\Admin\Downloads\StarryOverlay\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ekmeow-starry-overlay" --field-trial-handle=3856,i,14651449203754165769,1043591881936940717,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:87⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e5d5a1c.rbs
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
Staging
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
shared.types.js
LICENSE
package.json
package.json
LICENSE
LICENSE
LICENSE.md
LICENSE.md
LICENSE
Node.js documentation.url
Node.js website.url
choco.exe
chocolatey.config.5516.update
chocolatey.config.backup
Chocolatey.PowerShell.dll-help.xml
chocolateyInstaller.psm1
Format-FileSize.ps1
Get-CheckSumValid.ps1
Get-ChocolateyConfigValue.ps1
Get-ChocolateyPath.ps1
Get-ChocolateyUnzip.ps1
Get-ChocolateyWebFile.ps1
Get-FtpFile.ps1
Get-OSArchitectureWidth.ps1
Get-PackageParameters.ps1
Get-ToolsLocation.ps1
Get-UACEnabled.ps1
Get-UninstallRegistryKey.ps1
Get-VirusCheckValid.ps1
Get-WebFile.ps1
Get-WebFileName.ps1
Get-WebHeaders.ps1
Install-BinFile.ps1
Install-ChocolateyEnvironmentVariable.ps1
Install-ChocolateyExplorerMenuItem.ps1
Install-ChocolateyFileAssociation.ps1
Install-ChocolateyInstallPackage.ps1
Install-ChocolateyPackage.ps1
Install-ChocolateyPinnedTaskBarItem.ps1
Install-ChocolateyPowershellCommand.ps1
Install-ChocolateyShortcut.ps1
Install-ChocolateyVsixPackage.ps1
Install-ChocolateyZipPackage.ps1
Install-Vsix.ps1
Set-PowerShellExitCode.ps1
Start-ChocolateyProcessAsAdmin.ps1
UnInstall-ChocolateyZipPackage.ps1
Uninstall-BinFile.ps1
Uninstall-ChocolateyEnvironmentVariable.ps1
Uninstall-ChocolateyPackage.ps1
Write-FunctionCallLogMessage.ps1
nodejs.install.nupkg
chocolateyInstall.ps1
nodejs.nuspec
choco.summary.log
chocolatey.log
chocolatey.log
chocolatey.log
chocolatey.log
chocolatey.log
choco.exe.log
powershell.exe.log
blocklist
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
settings.dat
settings.dat
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_000099
f_00009c
f_0000aa
f_0000ac
f_0000ad
f_0000ae
f_0000af
f_0000b5
f_0000b6
f_0000b7
f_0000bd
f_0000bf
f_0000c2
f_0000df
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58cd7c.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe5bebe3.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
temp-index
the-real-index
the-real-index~RFe5b9d75.TMP
index.txt
the-real-index
the-real-index~RFe5c0ebd.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
domain_actions.dll
data.txt
OperationConfig
OperationConfig~RFe595d39.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5a253c.TMP
safety_tips.pb
typosquatting_list.pb
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
keys.json
typosquatting_list.pb
well_known_domains.dll
nav_config.json
ranked_dicts
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
86055050-aed9-4ccf-aa1e-731d5d54c038.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
ModuleAnalysisCache
StartupProfileData-Interactive
49c305aa-e2d7-4d23-9db2-3816919214b0.tmp
8fe9121b-3239-45e2-992f-a26a1da12f32.tmp
__PSScriptPolicyTest_fiswmqcj.wya.ps1
nodejs.install.nuspec
node-v25.9.0-x64.msi
chocolatey.zip
CREDITS.json
CREDITS.pdf
CREDITS.txt
LICENSE.txt
choco.exe.manifest
Chocolatey.PowerShell.dll
ChocolateyTabExpansion.ps1
chocolateyProfile.psm1
chocolateyScriptRunner.ps1
RefreshEnv.cmd
choco.exe
choco.exe.ignore
7z.dll
7z.dll.manifest
7z.exe
7zip.license.txt
checksum.exe
checksum.exe.config
checksum.license.txt
shimgen.exe
shimgen.license.txt
content_new.js
0bd5ba1a-0e31-4d90-9443-ddd43af716ab.tmp
832957710ba0a9af196dafc9f8d4ec27ccb411ffd9dbfc2a56c6092feff50c0c966d30dd1e6af4f74b6842990e3a306e24f9d047fb3304172ee5767f61d6
5296f26e207d1371c8f95bf082321237691bc5e5db64b66d0ffd6ffa99ab
be90b3954e2f6e7b35b521e65a5016fd963aa11c3d6c88ccd9e0b61c069e
7f2a8bd190f22671c866441ba3c09df2b7cc1088ad65bfa1ff1f42906fe4
f3ea46b7a48d1b108681523c9e802f48f2779894068bc9b984863ca18939
c335f15c5e60271d167b8468ee446614a76a1bee37e0fcc08643dc5818a4
7d0ac147818ea1892350f9c3f49b22c27f3d1f279ead6de0f28c314c285d
09430512-14f1-465a-886b-e357884bdb0d
1d764048-c1e7-45ce-a00f-fc173be11c95
1fc15499-9f3d-4c8d-b462-c0739fb4ee17
26844f39-4746-453f-8719-b7f4e7cdd4c9
269a83ac-bbc8-4a37-af61-f9a3c5af4983
2b6fa67f-f4fd-489c-9e22-c843affb2984
2ecb9cb8-4061-4e9a-b272-74fa4ad4b937
3c8b24b9-d99b-4d3b-a0bc-758dc9b3f152
3dea2951-36f6-4cbd-b18d-c10e91dbd500
3e52ce57-acea-4fdd-aadf-02ced507def8
42f6076d-cdd4-484b-9d33-0f7f3b99e50a
56d22501-0b6c-4795-b3ca-07671034d275
5edffe05-425f-4cb2-b1bc-fc55d8d50056
668962c6-2d74-406e-a024-28cb64a2e8ac
6e28d986-3df6-43d4-85be-b1e9ba45173b
6ef6fb87-f041-40d4-9d06-d9ad975df500
7d3b42bf-8a35-4098-81eb-e7b61a2c9eec
94fc897d-05fc-478a-a930-802b872e9b55
955ac67a-d9fe-4b2a-9074-82b73a4c46a2
a1dd9e92-54f8-483d-a08c-9b317e12cdd3
a81e8b01-56c0-4081-a6f1-75c44fb62f28
ac165eb3-f318-49ec-9777-491aa69f1547
d06f827c-8f0f-4de2-9c88-f37d0361760c
d0d91e1d-87c1-449a-8194-424bf2d281cd
e447a640-3d61-4155-af9e-d5645ddcd46f
edff8ee2-99bf-418a-b6be-f292e3c34d89
f347c0e0-8a25-4278-91cd-35bd610b9836
default.dic
ConsoleHost_history.txt
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
7f1b5097-9bb4-41bb-9b4c-ad8b28817192.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe611b96.TMP
TransportSecurity
Preferences
Preferences
Preferences
config.json
config.json
config.json
config.json
config.json
config.json.tmp-7014188470dc1bf1
config.json.tmp-7014188510e4de97
config.json.tmp-7014191160a5af02
config.json.tmp-70142040337a59af
config.json.tmp-7014336674dedef7
semver
semver.ps1
semver.cmd
MSIC7BD.tmp
memory/408-2794-0x0000000000190000-0x00000000001B8000-memory.dmp
memory/1304-5300-0x000001ACEAF70000-0x000001ACEAF7C000-memory.dmp
memory/1304-5299-0x000001ACEAE30000-0x000001ACEAECB000-memory.dmp
memory/1572-8484-0x0000026BE3910000-0x0000026BE39AB000-memory.dmp
memory/1572-8394-0x0000026BE3910000-0x0000026BE39AB000-memory.dmp
memory/1844-9690-0x00000239A7240000-0x00000239A72DB000-memory.dmp
memory/2180-11695-0x000001F6F7750000-0x000001F6F775C000-memory.dmp
memory/2180-11694-0x000001F6F5D70000-0x000001F6F5E0B000-memory.dmp
memory/2392-987-0x0000020A9ED40000-0x0000020A9ED4C000-memory.dmp
memory/2392-957-0x0000020AB7550000-0x0000020AB75C6000-memory.dmp
memory/2392-983-0x0000020A9ED40000-0x0000020A9ED4C000-memory.dmp
memory/2392-948-0x0000020AB6FA0000-0x0000020AB6FC2000-memory.dmp
memory/2392-956-0x0000020AB7020000-0x0000020AB7064000-memory.dmp
memory/2616-9592-0x00007FF842EA0000-0x00007FF842EA1000-memory.dmp
memory/2616-9593-0x00007FF8431B0000-0x00007FF8431B1000-memory.dmp
memory/2744-11507-0x0000020388E90000-0x0000020388FA5000-memory.dmp
memory/2744-9718-0x0000020388E90000-0x0000020388FA5000-memory.dmp
memory/2744-9692-0x0000020388E90000-0x0000020388FA5000-memory.dmp
memory/2884-580-0x00000234C9140000-0x00000234C91DB000-memory.dmp
memory/3340-2997-0x00000271BF880000-0x00000271BF88C000-memory.dmp
memory/3340-5197-0x00000271BF880000-0x00000271BF88C000-memory.dmp
memory/3400-5303-0x00000206A36A0000-0x00000206A373B000-memory.dmp
memory/3420-11785-0x0000025C67B00000-0x0000025C67C15000-memory.dmp
memory/3484-5085-0x00000274FF380000-0x00000274FF4AA000-memory.dmp
memory/3536-5247-0x0000024B99610000-0x0000024B9961C000-memory.dmp
memory/3536-2233-0x0000024BB1E40000-0x0000024BB1E4A000-memory.dmp
memory/3536-2232-0x0000024BB1EF0000-0x0000024BB1F02000-memory.dmp
memory/3536-2418-0x0000024BB1E50000-0x0000024BB1E5E000-memory.dmp
memory/3536-2622-0x0000024B99610000-0x0000024B9961C000-memory.dmp
memory/3564-9553-0x000001A9B5D20000-0x000001A9B5D2C000-memory.dmp
memory/3564-9552-0x000001A9B5C40000-0x000001A9B5CDB000-memory.dmp
memory/4444-9551-0x00000132FAD40000-0x00000132FAE6A000-memory.dmp
memory/4544-527-0x000001DC3C600000-0x000001DC3C715000-memory.dmp
memory/4760-5298-0x000002A723BE0000-0x000002A723D0A000-memory.dmp
memory/4776-11784-0x000002A6128B0000-0x000002A61294B000-memory.dmp
memory/4784-11791-0x000001F8828D0000-0x000001F8829E5000-memory.dmp
memory/4820-9555-0x000001E20E2A0000-0x000001E20E33B000-memory.dmp
memory/5404-5086-0x00000270057A0000-0x00000270058CA000-memory.dmp
memory/5404-5080-0x00000270057A0000-0x00000270058CA000-memory.dmp
memory/5404-3264-0x00000270057A0000-0x00000270058CA000-memory.dmp
memory/5428-11693-0x00000127707B0000-0x00000127708DA000-memory.dmp
memory/5436-5306-0x0000029626030000-0x000002962615A000-memory.dmp
memory/5436-5081-0x0000029626030000-0x000002962615A000-memory.dmp
memory/5436-10577-0x0000029626030000-0x000002962615A000-memory.dmp
memory/5436-3266-0x0000029626030000-0x000002962615A000-memory.dmp
memory/5436-3267-0x00000296289E0000-0x00000296289EC000-memory.dmp
memory/5436-5244-0x0000029626030000-0x000002962615A000-memory.dmp
memory/5436-5225-0x0000029626030000-0x000002962615A000-memory.dmp
memory/5436-5200-0x0000029626030000-0x000002962615A000-memory.dmp
memory/5436-9702-0x0000029626030000-0x000002962615A000-memory.dmp
memory/5496-5279-0x0000025A05500000-0x0000025A0562A000-memory.dmp
memory/5516-2686-0x000001A72F1F0000-0x000001A72F240000-memory.dmp
memory/5516-2742-0x000001A715060000-0x000001A71506C000-memory.dmp
memory/5516-2725-0x000001A72F2B0000-0x000001A72F2CE000-memory.dmp
memory/5516-2673-0x000001A714170000-0x000001A714CE8000-memory.dmp
memory/5636-9550-0x0000018A65710000-0x0000018A6583A000-memory.dmp
memory/5696-5567-0x000002812E9A0000-0x000002812EA3B000-memory.dmp
memory/5696-9547-0x000002812E9A0000-0x000002812EA3B000-memory.dmp
memory/5716-9691-0x000001E142AF0000-0x000001E142B8B000-memory.dmp
memory/5736-5084-0x000001E02DFD0000-0x000001E02E0FA000-memory.dmp
memory/5736-3268-0x000001E02DFD0000-0x000001E02E0FA000-memory.dmp
memory/5960-9696-0x0000019A998B0000-0x0000019A999C5000-memory.dmp
memory/6120-2787-0x00000184ACB80000-0x00000184ACB8C000-memory.dmp
memory/6120-2784-0x00000184C5490000-0x00000184C5652000-memory.dmp
memory/6120-2786-0x00000184AAD60000-0x00000184AADFB000-memory.dmp
memory/6136-11729-0x00000155BFAD0000-0x00000155BFB6B000-memory.dmp
memory/7384-11851-0x000001D59C300000-0x000001D59C301000-memory.dmp
memory/7384-11850-0x000001D59C300000-0x000001D59C301000-memory.dmp
memory/7384-11849-0x000001D59C300000-0x000001D59C301000-memory.dmp
memory/7384-11855-0x000001D59C300000-0x000001D59C301000-memory.dmp
memory/8896-11676-0x000001CB05840000-0x000001CB058DB000-memory.dmp
memory/8896-11677-0x000001CB07240000-0x000001CB0724C000-memory.dmp
memory/8980-11675-0x0000021F4E120000-0x0000021F4E24A000-memory.dmp
memory/9132-11687-0x000001E63A0E0000-0x000001E63A17B000-memory.dmp
memory/9204-11783-0x000002ABC1E70000-0x000002ABC1F0B000-memory.dmp