hxxps://anticheat[.]ac/dl/ocean/L5E8V8P3

Analysis

user interaction
yes
max time kernel
95s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://anticheat.ac/dl/ocean/L5E8V8P3
Sample260626-tsk92scy2y

Score

8^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
22	5052	msedge.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ocean-L5E8V8P3.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Ocean-L5E8V8P3.exe

Executes dropped EXE 2 IoCs

pid	Process
3968	Ocean-L5E8V8P3.exe
5572	OceanGraper.sys

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ocean-L5E8V8P3.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\R:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\V:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\X:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\Q:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\E:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\J:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\N:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\O:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\P:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\Y:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\A:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\H:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\I:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\L:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\S:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\T:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\W:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\Z:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\B:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\K:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\M:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\U:	Ocean-L5E8V8P3.exe
File opened (read-only)	\??\F:	Ocean-L5E8V8P3.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
123	ifconfig.me
124	ifconfig.me
125	ifconfig.me

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3968 set thread context of 6036	3968	Ocean-L5E8V8P3.exe	141

Launches sc.exe 26 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5524	sc.exe
5584	sc.exe
4740	sc.exe
3804	sc.exe
5460	sc.exe
4736	sc.exe
1528	sc.exe
5180	sc.exe
5684	sc.exe
1736	sc.exe
868	sc.exe
2804	sc.exe
4224	sc.exe
4780	sc.exe
3408	sc.exe
5528	sc.exe
6060	sc.exe
2192	sc.exe
4512	sc.exe
5620	sc.exe
5540	sc.exe
992	sc.exe
5636	sc.exe
4844	sc.exe
5184	sc.exe
4988	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Ocean-L5E8V8P3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Ocean-L5E8V8P3.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5052	msedge.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	Ocean-L5E8V8P3.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Configuration Data	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Ocean-L5E8V8P3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\FeatureSet	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\VendorIdentifier	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\VendorIdentifier	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Update Revision	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Configuration Data	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Identifier	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Update Revision	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Identifier	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Component Information	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Ocean-L5E8V8P3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\VendorIdentifier	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Component Information	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Ocean-L5E8V8P3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\FeatureSet	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Update Revision	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Configuration Data	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Identifier	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Component Information	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Identifier	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Update Revision	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Component Information	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Configuration Data	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Identifier	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\VendorIdentifier	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\FeatureSet	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Ocean-L5E8V8P3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Ocean-L5E8V8P3.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Ocean-L5E8V8P3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Capabilities	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	Ocean-L5E8V8P3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\Configuration Data	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemMemorySlots	Ocean-L5E8V8P3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\PreferredProfile	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Ocean-L5E8V8P3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	Ocean-L5E8V8P3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Component Information	Ocean-L5E8V8P3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Ocean-L5E8V8P3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Ocean-L5E8V8P3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	Ocean-L5E8V8P3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Ocean-L5E8V8P3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Ocean-L5E8V8P3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Ocean-L5E8V8P3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Ocean-L5E8V8P3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Ocean-L5E8V8P3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Ocean-L5E8V8P3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Ocean-L5E8V8P3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Configuration Data	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Component Information	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Identifier	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Ocean-L5E8V8P3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Ocean-L5E8V8P3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Ocean-L5E8V8P3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Configuration Data	Ocean-L5E8V8P3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Ocean-L5E8V8P3.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269643613630751"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{390B05AE-792D-492B-92A1-906AC520ED7B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe

Modifies system certificate store 2 TTPs 7 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Ocean-L5E8V8P3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E	Ocean-L5E8V8P3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 040000000100000010000000d5e98140c51869fc462c8975620faa780f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a52000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	Ocean-L5E8V8P3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 5c0000000100000004000000000800001900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df1040000000100000010000000d5e98140c51869fc462c8975620faa782000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c	Ocean-L5E8V8P3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Ocean-L5E8V8P3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Ocean-L5E8V8P3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Ocean-L5E8V8P3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeDebugPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeLoadDriverPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeLoadDriverPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeLoadDriverPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeLoadDriverPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeLoadDriverPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeLoadDriverPrivilege	5376	fltMC.exe
Token: SeLoadDriverPrivilege	3968	Ocean-L5E8V8P3.exe
Token: 33	3968	Ocean-L5E8V8P3.exe
Token: SeIncBasePriorityPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeIncreaseQuotaPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeSecurityPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeTakeOwnershipPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeLoadDriverPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeSystemProfilePrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeSystemtimePrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeProfSingleProcessPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeIncBasePriorityPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeCreatePagefilePrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeBackupPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeRestorePrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeShutdownPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeDebugPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeSystemEnvironmentPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeRemoteShutdownPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeUndockPrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeManageVolumePrivilege	3968	Ocean-L5E8V8P3.exe
Token: 33	3968	Ocean-L5E8V8P3.exe
Token: 34	3968	Ocean-L5E8V8P3.exe
Token: 35	3968	Ocean-L5E8V8P3.exe
Token: 36	3968	Ocean-L5E8V8P3.exe
Token: SeSystemtimePrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeSystemtimePrivilege	3968	Ocean-L5E8V8P3.exe
Token: SeIncreaseQuotaPrivilege	6036	cmd.exe
Token: SeSecurityPrivilege	6036	cmd.exe
Token: SeTakeOwnershipPrivilege	6036	cmd.exe
Token: SeLoadDriverPrivilege	6036	cmd.exe
Token: SeSystemProfilePrivilege	6036	cmd.exe
Token: SeSystemtimePrivilege	6036	cmd.exe
Token: SeProfSingleProcessPrivilege	6036	cmd.exe
Token: SeIncBasePriorityPrivilege	6036	cmd.exe
Token: SeCreatePagefilePrivilege	6036	cmd.exe
Token: SeBackupPrivilege	6036	cmd.exe
Token: SeRestorePrivilege	6036	cmd.exe
Token: SeShutdownPrivilege	6036	cmd.exe
Token: SeDebugPrivilege	6036	cmd.exe
Token: SeSystemEnvironmentPrivilege	6036	cmd.exe
Token: SeChangeNotifyPrivilege	6036	cmd.exe
Token: SeRemoteShutdownPrivilege	6036	cmd.exe
Token: SeUndockPrivilege	6036	cmd.exe
Token: SeManageVolumePrivilege	6036	cmd.exe
Token: SeImpersonatePrivilege	6036	cmd.exe
Token: SeCreateGlobalPrivilege	6036	cmd.exe
Token: 33	6036	cmd.exe
Token: 34	6036	cmd.exe
Token: 35	6036	cmd.exe
Token: 36	6036	cmd.exe
Token: 35	3968	Ocean-L5E8V8P3.exe
Token: 35	3968	Ocean-L5E8V8P3.exe
Token: 35	3968	Ocean-L5E8V8P3.exe
Token: 35	3968	Ocean-L5E8V8P3.exe
Token: 35	3968	Ocean-L5E8V8P3.exe
Token: 35	3968	Ocean-L5E8V8P3.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3968	Ocean-L5E8V8P3.exe
3968	Ocean-L5E8V8P3.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 4392	3504	msedge.exe	87
PID 3504 wrote to memory of 5052	3504	msedge.exe	88
PID 3504 wrote to memory of 4488	3504	msedge.exe	89
PID 3504 wrote to memory of 4488	3504	msedge.exe	89
PID 3504 wrote to memory of 4488	3504	msedge.exe	89
PID 3504 wrote to memory of 2268	3504	msedge.exe	90
PID 3504 wrote to memory of 2268	3504	msedge.exe	90
PID 3504 wrote to memory of 772	3504	msedge.exe	91
PID 3504 wrote to memory of 772	3504	msedge.exe	91
PID 3504 wrote to memory of 772	3504	msedge.exe	91
PID 3504 wrote to memory of 4856	3504	msedge.exe	92
PID 3504 wrote to memory of 4856	3504	msedge.exe	92
PID 3504 wrote to memory of 4856	3504	msedge.exe	92
PID 3504 wrote to memory of 3332	3504	msedge.exe	94
PID 3504 wrote to memory of 4636	3504	msedge.exe	95
PID 3504 wrote to memory of 3332	3504	msedge.exe	94
PID 3504 wrote to memory of 3332	3504	msedge.exe	94
PID 3504 wrote to memory of 4636	3504	msedge.exe	95
PID 3504 wrote to memory of 4636	3504	msedge.exe	95
PID 3504 wrote to memory of 3796	3504	msedge.exe	98
PID 3504 wrote to memory of 3796	3504	msedge.exe	98
PID 3504 wrote to memory of 3796	3504	msedge.exe	98
PID 3504 wrote to memory of 4912	3504	msedge.exe	100
PID 3504 wrote to memory of 4912	3504	msedge.exe	100
PID 3504 wrote to memory of 4912	3504	msedge.exe	100
PID 3504 wrote to memory of 3812	3504	msedge.exe	101
PID 3504 wrote to memory of 3812	3504	msedge.exe	101
PID 3504 wrote to memory of 3812	3504	msedge.exe	101
PID 3504 wrote to memory of 4260	3504	msedge.exe	104
PID 3504 wrote to memory of 4264	3504	msedge.exe	105
PID 3504 wrote to memory of 4260	3504	msedge.exe	104
PID 3504 wrote to memory of 4264	3504	msedge.exe	105
PID 3504 wrote to memory of 2852	3504	msedge.exe	107
PID 3504 wrote to memory of 1680	3504	msedge.exe	109
PID 3504 wrote to memory of 1680	3504	msedge.exe	109
PID 3504 wrote to memory of 1680	3504	msedge.exe	109
PID 3504 wrote to memory of 3864	3504	msedge.exe	110
PID 3504 wrote to memory of 3864	3504	msedge.exe	110
PID 3504 wrote to memory of 3384	3504	msedge.exe	111
PID 3504 wrote to memory of 3384	3504	msedge.exe	111
PID 3504 wrote to memory of 3384	3504	msedge.exe	111
PID 3504 wrote to memory of 4596	3504	msedge.exe	115
PID 3504 wrote to memory of 568	3504	msedge.exe	124
PID 3504 wrote to memory of 3012	3504	msedge.exe	125
PID 3504 wrote to memory of 4156	3504	msedge.exe	126
PID 3968 wrote to memory of 5376	3968	Ocean-L5E8V8P3.exe	127
PID 3968 wrote to memory of 5460	3968	Ocean-L5E8V8P3.exe	130
PID 3968 wrote to memory of 5528	3968	Ocean-L5E8V8P3.exe	132
PID 3968 wrote to memory of 5588	3968	Ocean-L5E8V8P3.exe	135
PID 3968 wrote to memory of 5636	3968	Ocean-L5E8V8P3.exe	137
PID 3968 wrote to memory of 5684	3968	Ocean-L5E8V8P3.exe	139
PID 3968 wrote to memory of 6036	3968	Ocean-L5E8V8P3.exe	141
PID 3968 wrote to memory of 6036	3968	Ocean-L5E8V8P3.exe	141
PID 3968 wrote to memory of 6036	3968	Ocean-L5E8V8P3.exe	141
PID 3968 wrote to memory of 6036	3968	Ocean-L5E8V8P3.exe	141
PID 3968 wrote to memory of 6036	3968	Ocean-L5E8V8P3.exe	141
PID 3968 wrote to memory of 6036	3968	Ocean-L5E8V8P3.exe	141
PID 3968 wrote to memory of 6036	3968	Ocean-L5E8V8P3.exe	141
PID 3968 wrote to memory of 6036	3968	Ocean-L5E8V8P3.exe	141
PID 3968 wrote to memory of 6036	3968	Ocean-L5E8V8P3.exe	141
PID 3504 wrote to memory of 5228	3504	msedge.exe	147
PID 3504 wrote to memory of 5228	3504	msedge.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://anticheat.ac/dl/ocean/L5E8V8P3
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff95b98c188,0x7ff95b98c194,0x7ff95b98c1a0
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,12371979300389494815,9235715577676648503,524288 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,4465964314981081187,1015406418302618499,262144 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,17520060282294276265,16510963114255597461,524288 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,16645007426587800926,10247657555036923792,2097152 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,9627137474974849487,215517904061669767,2097152 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,8259502340883325491,7509128400542313919,2097152 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,9348293178443250586,14383870955292180972,2097152 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5064,i,735207229841277275,6077266725487650727,2097152 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5208,i,4563991264425124296,8743448786653935658,2097152 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5360,i,420607998350988639,12521154600253807018,2097152 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,8625845987916839713,18074311284596603404,524288 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,1620410312540511271,10283297948387120955,524288 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,14923050387279902786,508981170260027853,524288 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,14923050387279902786,508981170260027853,524288 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5320,i,5756637316280620740,11558510805028296580,2097152 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,6955047205377736301,14340180244179043671,524288 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4292,i,8384775019213893288,15158049640794313669,2097152 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,2790575044793979042,3156635696830939777,524288 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,17828651720817412449,4001279769665123497,524288 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,18016588911708426780,6133045685221881815,524288 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,398664014540639540,14673389075492706632,524288 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,12203678574339116893,3809280059619217527,524288 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=1640 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3680,i,15196113573250769872,5791770216328639953,262144 --field-trial-handle=2248,i,14673345313966313105,17697914615921371466,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4516

C:\Users\Admin\Downloads\Ocean-L5E8V8P3.exe
"C:\Users\Admin\Downloads\Ocean-L5E8V8P3.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies trusted root certificate store through registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload OceanGraper
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5376
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop OceanGraper
  2⤵
  - Launches sc.exe
  PID:5460
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete OceanGraper
  2⤵
  - Launches sc.exe
  PID:5528
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload Ocean service grapper
  2⤵
  PID:5588
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop Ocean service grapper
  2⤵
  - Launches sc.exe
  PID:5636
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete Ocean service grapper
  2⤵
  - Launches sc.exe
  PID:5684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6036
- C:\Windows\System32\logman.exe
  "C:\Windows\System32\logman.exe" create trace autosession\Microsoft-Windows-DXGI -p Microsoft-Windows-DXGI 0x1 0x80 -o C:\Windows\System32\LogFiles\WMI\DXGI.etl -max 4096 -f bincirc
  2⤵
  PID:4540
- C:\Windows\System32\tracefmt.exe
  C:\Windows\System32\tracefmt.exe C:\Windows\System32\LogFiles\WMI\DXGI.etl -displayonly
  2⤵
  PID:672
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="NTKernelLoggerService", ExecutablePath="cmd.exe", CommandLineTemplate="/c logman create trace \"NT Kernel Logger\" -ets -o \"C:\Windows\system32\Logfiles\WMI\NT Kernel Logger.etl\" -p \"Windows Kernel Trace\" 0x4 -bs 4 -ft 3 -mode circular -max 500"
  2⤵
  PID:3548
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\subscription PATH __EventFilter CREATE Name="NTKernelTrigger", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 60 AND TargetInstance.SystemUpTime < 120"
  2⤵
  PID:6048
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"NTKernelTrigger\"", Consumer="CommandLineEventConsumer.Name=\"NTKernelLoggerService\""
  2⤵
  PID:6108
- C:\Windows\System32\tracefmt.exe
  C:\Windows\System32\tracefmt.exe "C:\Windows\system32\Logfiles\WMI\NT Kernel Logger.etl" -displayonly
  2⤵
  PID:6128
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="NTKernelLoggerService", ExecutablePath="cmd.exe", CommandLineTemplate="/c logman create trace \"NT Kernel Logger\" -ets -o \"C:\Windows\system32\Logfiles\WMI\NT Kernel Logger.etl\" -p \"Windows Kernel Trace\" 0x4 -bs 4 -ft 3 -mode circular -max 500"
  2⤵
  PID:3192
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\subscription PATH __EventFilter CREATE Name="NTKernelTrigger", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 60 AND TargetInstance.SystemUpTime < 120"
  2⤵
  PID:5464
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"NTKernelTrigger\"", Consumer="CommandLineEventConsumer.Name=\"NTKernelLoggerService\""
  2⤵
  PID:5460
- C:\Windows\System32\tracefmt.exe
  C:\Windows\System32\tracefmt.exe "C:\Windows\system32\Logfiles\WMI\NT Kernel Logger.etl" -displayonly
  2⤵
  PID:5500
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload OceanDrv
  2⤵
  PID:3612
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop OceanDrv
  2⤵
  - Launches sc.exe
  PID:4736
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete OceanDrv
  2⤵
  - Launches sc.exe
  PID:4844
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload OceanGraper
  2⤵
  PID:4448
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop OceanGraper
  2⤵
  - Launches sc.exe
  PID:1736
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete OceanGraper
  2⤵
  - Launches sc.exe
  PID:868
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload Ocean service grapper
  2⤵
  PID:1660
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop Ocean service grapper
  2⤵
  - Launches sc.exe
  PID:5184
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete Ocean service grapper
  2⤵
  - Launches sc.exe
  PID:4988
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:1528
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:2804
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "OceanGraper"
  2⤵
  PID:3896
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:6060
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:4512
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "Ocean service grapper"
  2⤵
  PID:6048
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:5180
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:2192
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "OceanGraper"
  2⤵
  PID:5372
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:5524
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:5620
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "Ocean service grapper"
  2⤵
  PID:5496
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:5540
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:5584
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "OceanGraper"
  2⤵
  PID:5516
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:4224
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:4780
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "Ocean service grapper"
  2⤵
  PID:4692
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:3408
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:4740
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "OceanGraper"
  2⤵
  PID:2252
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:3804
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:992
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "Ocean service grapper"
  2⤵
  PID:5944

C:\Users\Admin\.oceancache\OceanGraper.sys
C:\Users\Admin\.oceancache\OceanGraper.sys
1⤵
- Executes dropped EXE
PID:5572

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

OceanGraper.sys

Path C:\Users\Admin\.oceancache\OceanGraper.sys
Size 23KB
SHA256 4f412f9aa89994cda45422d23d6d961809225de9a4f5a8bfbfb9ac0e8725917e
MD5 3ee985c5fd1f5784e15a4d11b3ca70a1
SHA1 33148c93465908ddad71cf189e22091dc0058ac4
SHA512 65fa049521fd659debd7986b80a3ab67f20281b2ed8f37213a46fce1495c1d2391c42e93ac8b1c0c593bbeb284c867a8484b99cfea20a889c30e37febed32981
SSDEEP 384:0OaLMjdtjzvWPkgnrJrc8c5oQiWKx1ah3liYlORR9zu3:PaYjwkgn23Y23lBK9zA
TLSH
T171B25BC1C56810C2CA6A7C78C3A4EA53BD3D739713219ADB06A9D6650F533C9BB3861E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TEMP5.bin

Path C:\Users\Admin\.oceancache\TEMP5.bin
Size 10.0MB
SHA256 9bbf4e9a95e4601cac55f2d6b9332f863ffe2d2a75e34d94338a5d45fe832323
MD5 10b4e55c67e126039a79f9d3dd50e035
SHA1 2d94befc54e4ee7307de54c7be4abb9fd7d3b86d
SHA512 dccd46676efe8b721969b50070313e5a8c3833e208057d5250f87f30e9d587889b816b9a166fa8f1e4face698867c8a9222487078f472aaddb31f55090d31e03
SSDEEP 98304:EH8XtBT7RsCyXcm2QxiU8wAYDuuG4ydGFxWX:EH89BXRi2UW
TLSH
T14CB62F00BFD5D5D4F2A64A329CBACF855A32FD51AD214A0F33D4330F8DFAA81A917625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TEMP6.bin

Path C:\Users\Admin\.oceancache\TEMP6.bin
Size 10.0MB
SHA256 6b97a8adba4dc44eb4824e6ba0bd459cca2de9068f5e944f23c4ae701e06c512
MD5 650e019ce29e0b4ee0184ea233d51a6f
SHA1 7cd66120e11a78356abc86841cce9619374ec7f8
SHA512 d286e7ec3b762ae4b8a9f8fe75aa74f2a590db9ebb2f8f6ede460fdc0cbfca62e0c3495aa73b094b5daa0d2ee28fbca9efd77ff2ee87a6c852f6f80bbb1ff10d
SSDEEP 98304:b9xpp4479oqsp82kevmIg6gklsEGcuHEnHBT:b9x34I9akcB
TLSH
T1A4B62E00BFD5D5C4F1A64A329CBADF855A32FD51AD614A0F33D4330F8DFAA81A913626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6bc2585543556246085780ccbf18171d3387d1c337fdf7550cbff13e96d8bfca
MD5 72f4a509cc5c2ba06742fab9d9df3b45
SHA1 5b3a254383eb80177fd14a1ab8442b6e8a446a13
SHA512 23256f13855beee9623c4c070e103b9ad92509b4e207ecf52768c9f422336541315308a4b0dbe8ce4925a597e66ca1ea00665718a28f69c38c04baaaa078648d
SSDEEP 96:hOWoJL3kp7kniqTiIpEMOq09F36WzwTrwl58KtJ1/:gWG3kp7kzpzOquRKnK8KtJJ
TLSH
T177917E369CB00F92EFD445BF18E3E640367644D5F2130FBBD860773E2A1E79802A6852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a62e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a62e.TMP
Size 3KB
SHA256 0e2e3e855326e942c12aad05981d84986a8803987f6a436332090ebe25a860b5
MD5 13802cc1b11e84c1e0d1b9ca6b7f2d44
SHA1 7a4d29e4346501d9ac36a9c9c934c2f219d70b39
SHA512 594537e97cd624a3ef74ed7bb102156d2b7362a178f60fe98a3da51eda99ac14f1d2a680df24f0c77dc1c0692db9a99e50f294f8cf097c7568938b8907a0fd37
TLSH
T168717C350D314F42EBD401BF65E3F210717A85D8FA131E79C960AB3E2B1C7A802ABC56
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4f51f5af1c16cd63e0b71cb3bda2026ee80b3c00a8938dd5aced5d23df6a0ff4
MD5 2c60abe4d5c979c4ef43c33383fa83aa
SHA1 555cdd4ab41133a4767ddb8bb078477ac6017c5e
SHA512 cda4cd65b1749d9aceec32a732567d3994d9bfbb0b9fc9e42ceba751943c3cefd128bb7670f71d158c3a31154bb083e244e778a263ff92578e33beb21b1c58b0
TLSH
T18F6181E3D2E49B2DCD2252F5AF24BE1BCD29091842293D26C9D5FF5F93E2071E10155E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a2c2eb759904299e2c661cbb4ac08ca68720373ff1be5ffac4bce8e779c2c85f
MD5 c230a7d1e226d27086dffda5af765c73
SHA1 a4a66c5aa94b7fe41feae1712a9fc7b6fdf4fe2b
SHA512 be1ce7e2869ba725bb92cc859173e0e7c2337a506f3d63deb54255ccf0f309b1d36368a82c2255f366e856a8da5794b1c60b487d7c2137f1e49a82387e091eb6
SSDEEP 192:sxZyR9yM/jK1Ml8Mk8/fjsG88IdpKi1HW6+WNfuE/YC2PrKEIgrJ:sxZyLM8/fjsG8lHHb9/S19
TLSH
T1F052C8126A389977CCCBD209FA51BF53D6F91572A2940D44AAFCCA1C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c931c5b15b45627495ebe5526b230481338e244648788f76d5977d52addc3491
MD5 9fdebb88974651933d212b9c5843e906
SHA1 a31112208db517a639c40cfd17ba639d0ebece32
SHA512 5d4d090378e54026f176cdcaaabfe7883a34a5e3517192e85902483f2de3dcaae3294b276c67b9cbb5b1ead8118eda2a7045ffa850f84dcb204c76aba63a373f
SSDEEP 192:sxZkR9yM/jK1Ml8UQ698/fjser8IdpkaYoi1HW6+WNfuE/YCoAWrKEIg5EJ:sxZkLqM8/fjserl7YFHb9/61+
TLSH
T13262C8126A385977CCCBD21AFA51BF53D6F51472A2D00E44AAFCCA1C04E6AED6217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a32a2db07352a460bef04717cad2cedc7304b222113825087c247b0a3c2a4126
MD5 a967dbf4ee9a17c681013e9ae2699942
SHA1 ca84d7e4a854c69b2f4c1d6d0e065e07e61ea191
SHA512 cd1eccfd6a2f8bcec19c5b49bfcd013e7691a9c4d3fcea893906e325b45c8e94b4de25d114cb4f27d7a39ed8db326b72a0f322bc5b487c083476d3257d5fac44
SSDEEP 192:sxZkR9yM/jK1Ml8M98/fjse88IdpeaYoi1HW6+WNfuE/YC2PrKEIg5CJ:sxZkL18/fjse8ltYFHb9/S1w
TLSH
T13B52C8126A385977CCCBD21AFA51BF57D6F51472A2D00E44DAFC8A1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 14aa04172c46c398408e7c94e9ab2e1ece0275cf8c00962d36d6f9b066a80376
MD5 4f8d7c81632a0b43bfab092c19b99d84
SHA1 dfaa757e1075116c79e4a9b88373a1ea237bbca0
SHA512 bb64d098a89250074ab1ad3bf1ec1f9f92f44c7446d893dde8c132a8011068de971fa3db16a5bd0c18f26a7d2681fefb1d35b6c36022a3fbf05818769be2c33d
SSDEEP 768:xm8bqn+WvSC368F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVmroM:xm8bqn+WvSC36u1jaCZLbWVdM
TLSH
T1E8E20A3B280CCB7E4F845E5DDC26AF962DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f2e018a7a192ce3b27793258559461228352f6de\dc2cb139-ec45-4feb-9265-d455f129799b\index-dir\the-real-index
Size 120B
SHA256 8f0f3d473a250765d945956f62127cbe57f44dc2eb6e7c2c066597ecf818e054
MD5 5b3a30ba27478735c2adb1cd5791f543
SHA1 effd95c8b96df4c6fde31069fe678ac67fcc6f7a
SHA512 b4cd665babd005fd25e16e07babf1cafd1cee8811df049fdf80acb3a5b0d00c2a42532503eb943ed8781f6c5048aadd0ac6caf141e41d58d9c901b1e3a1a315b
TLSH
T1D1B02228BC030E0EE803C2B0338A2020B8008CF0230C2B0B83FE000EEF333A00E83088
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5894c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f2e018a7a192ce3b27793258559461228352f6de\dc2cb139-ec45-4feb-9265-d455f129799b\index-dir\the-real-index~RFe5894c9.TMP
Size 48B
SHA256 ffdd0bca162bdab684cf3314417d441a97ac1532ad8ceda4db5700c84b877b25
MD5 092f464b8351445ec9332a4d94a3fa4f
SHA1 5ed3a68d6a98f1efe7bd0f02d9237bc140edf2d2
SHA512 4f32d58cb3e73f106f359c1c78786b84db98760c8d25f13d5935c44efe7e2e4f00750816193ad74b192ebbe303853a52a5ea994b0d5484d044bdbfb937a0fa07
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f2e018a7a192ce3b27793258559461228352f6de\index.txt
Size 126B
SHA256 524f6d0c2a068921b51e3f2ae9f2335b63932f59be563a5acfbf167d56a4c741
MD5 a119b5e317c76f0525a2ceb7139fdf39
SHA1 1a84c938852ee7bc68f42b2a71179184b2fac113
SHA512 739c502d422c7f6003bfc5660466b028d7fc66a5e9d27f577e7da30e9c0604fb5b1e368bad355b95ce2941769ff4eb7d8d52e051c72cb1afa11c9ac021f9f655
TLSH
T182B09B7771C60174AD5591A515D495A4F40D6D748595C40C4154D35EC5C04B44585801
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5894f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f2e018a7a192ce3b27793258559461228352f6de\index.txt~RFe5894f8.TMP
Size 131B
SHA256 203cda4bb36e628707c3e2ac6cc352136b6026e10fada66bd3c7429de2c860d3
MD5 2d2a15a56810bb9edbf21ff1e37fdc31
SHA1 6cf045ae0709b774d66414745eb5059701bdc71a
SHA512 eba3a332c537ba8d6320089297bf7d86279b8b0a35f2f0426725385978a396423342e2d23f27a3c2c4120f379c581e05f8b867015b0c758d21fdbfb1b6659054
TLSH
T195C092BB71C60234AE5291A258A4A9E8F81E6EB88A94C40C8155F39AD5F04B98A8A801
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 113919d0b48f690fb0b7effa62f6fa7e1e4834463f818e3420f79e298bdcf887
MD5 f2114894bcd318fefbdd83ae45eb035d
SHA1 357c16d12215cdf7e195b90c2b81b7db05dd9aae
SHA512 86c9fd8944f077f2edbe34680e49d57bf8018700755bcc511d825fad9baf1439a733757317c2a589808930a4a03eabb626431511a3c56fb4c9405b6720c81786
TLSH
T1B0A0026903A41481C00497F0D4630B99BAB4591081015327C5F422559C553416996404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5892c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5892c5.TMP
Size 48B
SHA256 74c9bf9afb598e88a981070039b5f67111480aff208ddb10dc296f8711dcfc4e
MD5 73dd53ec5bc4b360d32b4d433b6805fd
SHA1 e4f99eb3678c5a78fcf811c125e41b4f10ef5d9b
SHA512 b9d07376b54af3af84c79e8a132c2a8ac83300e7e0b5cd50cf9d61849fb93dcd069746a68a503ac37c1070e5f2c01c5aa306a976ad926a2f6c71b12321173f64
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b446b0a51d75d08541a92ad666307e538dca0fd8e3379996a4912456ac5def4a
MD5 3ebfb9a496e231d38f0d8c0a9a93efa3
SHA1 7456ef11087fb43b747e9701d99ca2301589a5f6
SHA512 45f8bf91285c53753edd2a626ea44f4e1de561b1ac83a4ba07f7552bd24ea085643268c00fd84c938ec57cf4be10f1b45fbd849da2d90e5360d587b2543b49be
SSDEEP 96:KcOUKnqCKAwKxqmhZsLfZb7xG/2sEnxK84E5xoBJenP:invrhZsLfZb7o/2Ln94E5OBJenP
TLSH
T1CB917802713B238238FE2908926385768E4272633814A46F7FF914961D7AF515EFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57d6b171-88f0-405f-8757-fa1cbb82a4ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\57d6b171-88f0-405f-8757-fa1cbb82a4ca.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0a84a80aa5eaf1c672ef5d937c6ce278ce56b5c5ce2c61a2a009a914fb77fc97
MD5 1f84d21e72d150e442094be8b2e51f36
SHA1 c3d529a96b2f2945d646394ca6e20797edd3a1eb
SHA512 ff595f71f98a40c039368b41f2a255fd4f50e7c7e116db0124603a1d00891db1f9d6b334fd9402721ae48447a39b19cbcdfd2e4354faebb9fe7b0dacf9ca326b
SSDEEP 192:uDLsNKsQC7htBbiRaQmiU1ugd4Ea+j9OmaftmHXFgEVamHqEU8:0sNKsF7haAByEa+5OHfaXFj3jU8
TLSH
T15932293278389C775EA2A585F4473B13AFB45067DA8A2F95D6DC5F0C01DF6AC130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3e1cc6341825d64a1983110b24b475806124c0b8e313365b7898902fad7c1f00
MD5 17764a99e6a3ac583c3ed27689d4f208
SHA1 7060ced686bcabed9ea21fe84bcc3761779f0fba
SHA512 807fc640dac4c67321da2a3d778fcadfa45b31d3dd967b63a51aa0dae541be30804ec6994edcdecedac94500d91298640f0993402a5a3f7668ec1f4839c7fcd3
SSDEEP 384:eiF0tNn/s3n9SVpsNS8TUNTUlIlBF7hamqXyEa+5OHfaXFjSjmn15wbAjEJ:1F0j+9oPwgRVK5aYOH89Sjmn12bfJ
TLSH
T1BCC219F258DB8936D9AE4B87B77E2E065EBCC067B5852950B3884A0CCCD61BFD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1bb39fd9aa5294d92c14fcb82d6cb267b73a2182bc5fab6bebd430c497054576
MD5 28ed205a9102cc2a7f7004b40a2c75b9
SHA1 a7d9040ba2e27c71161937969c4d15db3b3d474a
SHA512 986bae0d711ecead3c75c120f17057897abf89ebef0925d4d3a630d433667c037100097e1ac97164b71e749ed4d4fca8df933e23629b7dda04d79e786bc57de5
SSDEEP 192:vONm6Db6QmiUy7THBa+j9OmaftmH+RgB6U6:vONm6u6HBa+5OHfalUU6
TLSH
T12402D93569786CB79EB26E49F48B3B27AF94107BEA552F84DAD81F0C00D765C2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 da7fbef754dd087190c0746db7ccdef203a6c890c0868f37c594b5a93dcd8df9
MD5 f0b0ed321a877af96d62a98ef83eb397
SHA1 d5a6d6628a1992396dcb1a8c97a3b927e85b3c4c
SHA512 b1d2be6d0375b2f4f5700ee0ddaebd5b5da9d723aea7017f66de22af101c56fd6766b3e0b5a622feff82e24ca15ba17d971aaff22c4ba0042faba60e262e81c7
SSDEEP 384:PtNn/s3n9SdsNKEF7hamByEa+5OHfaXFj3jmn15wbAjEJ:Pj+9maVl5aYOH893jmn12bfJ
TLSH
T16B927C32683C5C731DA39589F54B370BAFA880BB96C92E94D5EC9F0D05DB79C130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0899101130954fb77e5957be890aa23e73148aeee413d1445aa35c34df16c1cb
MD5 89fc6a5a3b4d5b4ed5344cfa9bdcba27
SHA1 92bdb4ab30bc12ca074a342f17cc2807ee7af656
SHA512 ec64840cfed7875fee966524fb9e0bf0713f4cddb5d99f53c03eb3dc1ed0e35915ff9130c10e51b175505a000d245bd73d680a0a8d83fefcc20fbfcd7ef806d3
SSDEEP 192:SONz6DblQmiUy3TuBa+j9OmaftmHXFgEsNzHqEU6:SONz6bwuBa+5OHfaXFjsjU6
TLSH
T117122A3278789C775EA2A585F48736179FA45167DA8A7F81D6CC2F0C01DFA9C230EC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 dc75144b6b44ce72326391d9ffc97d8c8f0f3fc41366cc2c8bcc464c42e5dd3a
MD5 e064f60d473bfcc7c24028fcbd0ec1e9
SHA1 ccbde141341e241124449548ed5a909cabe1ab13
SHA512 ff4e744b378cd9a48c10656812a43c74aaf2a1801c34f274d2b5d74453547183fbccdd7ceea992b468954fec2e449964b90c35a5c1ce7404c8103cb2f1fd2a05
SSDEEP 384:5tNn/s3n9SdsNKBF7hamByEa+5OHfaXFj3jmn15wbAjEJ:5j+9mhVl5aYOH893jmn12bfJ
TLSH
T14A927C32683C4C731DA39589F54A370BAFA880BB96C92E94D5EC9F0D05DB79C130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 750537e3154100ce4e99a64691d85762422403719ca4fb8d305a4e209f00da16
MD5 866c0ac0c85e0602d1691cdee975d493
SHA1 c538cdc3d73c701e9cec4c0518012519db6cd445
SHA512 3a80c4883011061ef88eddedb449edb40660dade3ced2343554400bbd56b7a7b460f15909e4864d0d8effedb573e9c0b9940f9ffbbe63c41b2d72c963124a729
TLSH
T17B41E958A6EA1158B3B37E46ABF6686E847FB8772E06D5AE10010E4F0622B41C871777
MD5 SHA1 SHA512 TLSH

Submit Download

Ocean-L5E8V8P3.exe

Path C:\Users\Admin\Downloads\Ocean-L5E8V8P3.exe
Size 44.4MB
SHA256 d7c0543e29311b1d3be7ee7faabb2e337c740e644a5e564a1478b01882389a62
MD5 5e95119bff94ac0ad991593646f8bd20
SHA1 69cceb6df22231771ec2642eecb25b47d5604b2d
SHA512 ea8b50d8485a2da0299e416a1b10118178d28aa63e74bf7339611b643cc34d74d4ed04e1d523d2c3a4e4ed0cec5bd297070498d9093988e459e7fe41a3cedcb5
SSDEEP 786432:dh/XlOpDrlCGKQFiViaK3lJjtRWd/sW2w/hsWML54b7V+QF0yzt+jIYBfYS:/yDrpQiagztgz2w/hBwwV/F0b
TLSH
T13BA7339775C364E8C86CA7BDC60CEF2EF2483EC94C3A004A2549B950DAF5DA5FD64B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tracefmt.exe

Path C:\Windows\System32\tracefmt.exe
Size 672KB
SHA256 2319e56a7465c50e0ddb8add40d0328fb9ec4a9425021532d9786a65a54de1ee
MD5 2a3d8a335d96365e15bf14332af1f6bc
SHA1 dc02404bd74283275312ad9b980b2979ebe319fc
SHA512 ce52be8bf0186e3efec2dd47eea8dd0f968204e8f6b36b8e25f267b7d820420ee7563ad9db41498bc463f48b470ac37443284dc09bd73117ec8cd62064eb4217
SSDEEP 12288:oGQsrIT/flYCi8YAEPDSND/fqYQXGQxUYenF3:otsrIT/flYChYAEPDSND/fqYQXDUYeR
TLSH
T176E4FB41BA45BBE5E442E039E6730B825DE45E152324E23FA1ECE9366D77942AC30FF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3968-500-0x0000000059BB0000-0x0000000059C62000-memory.dmp

Download

memory/3968-559-0x000000004E410000-0x000000004E418000-memory.dmp

Download

memory/3968-376-0x00007FF9779D0000-0x00007FF9779D2000-memory.dmp

Download

memory/3968-377-0x00007FF9779E0000-0x00007FF9779E2000-memory.dmp

Download

memory/3968-378-0x0000000140000000-0x0000000141000000-memory.dmp

Download

memory/3968-572-0x000000004D5F0000-0x000000004D5FC000-memory.dmp

Download

memory/3968-568-0x000000004D5E0000-0x000000004D5EB000-memory.dmp

Download

memory/3968-566-0x000000004E410000-0x000000004E41A000-memory.dmp

Download

memory/3968-563-0x000000004E410000-0x000000004E419000-memory.dmp

Download

memory/3968-561-0x000000004E410000-0x000000004E421000-memory.dmp

Download

memory/3968-557-0x000000004E410000-0x000000004E41C000-memory.dmp

Download

memory/3968-543-0x0000000047850000-0x0000000047855000-memory.dmp

Download

memory/3968-537-0x0000000059CF0000-0x0000000059D4A000-memory.dmp

Download

memory/3968-416-0x000000004C630000-0x000000004C633000-memory.dmp

Download

memory/3968-509-0x0000000059CF0000-0x0000000059E45000-memory.dmp

Download

memory/3968-508-0x000000005C6D0000-0x000000005CA49000-memory.dmp

Download

memory/3968-497-0x000000004EEC0000-0x000000004EEDF000-memory.dmp

Download

memory/3968-498-0x000000004EA90000-0x000000004EABA000-memory.dmp

Download

memory/3968-503-0x0000000047850000-0x000000004785A000-memory.dmp

Download

memory/3968-501-0x000000004EEE0000-0x000000004EF3A000-memory.dmp

Download

memory/6036-445-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-463-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-482-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-446-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-464-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-454-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-457-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-459-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-462-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-452-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-453-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-455-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-460-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-461-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-451-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-456-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download

memory/6036-458-0x00007FF65BEB0000-0x00007FF65BFA2000-memory.dmp

Download