Analysis
- user interaction
yes - max time kernel
420s - max time network
421s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 04:36
General
- Target https://github.com/throneproj/Throne
- Sample260723-e8epwadq71
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 17 IoCs
- Loads dropped DLL 28 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to get system information.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 9 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 8 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 48 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/throneproj/Throne1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffde936c188,0x7ffde936c194,0x7ffde936c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,9738928390250506865,15654822152883062357,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,6847405306353726698,12750269262508721500,262144 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,1001294637728843381,13644351410072453023,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,12585480593496770572,17323555880448119068,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,3157054785150677868,11944263201355042244,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,4569959439829208944,13953497742380115763,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,9782760867215078814,17006081988121001128,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,14633696281600906396,5731559637327008769,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,15620494677089974233,15304457695931185325,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,15315634532049370062,1794468148408534092,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,15315634532049370062,1794468148408534092,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4796,i,767992274067475190,16280090030764534550,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3588,i,5447312381272221333,1456179548556779100,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,18233945011890444589,5572439017936055618,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,1874164244051503443,12371704518084335658,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,9371675369737490789,14855279535114894625,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4992,i,5521026517397853534,2243789440806194227,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,14490497620335082217,8153533288193133548,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5484,i,16305926513465741409,8129652110929817904,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4748,i,15363655533075861195,2146325538850614137,262144 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,9107904881238329600,1532284550744733068,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1056,i,1937155659836663205,12279046240989836439,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,7529447904560659856,6931527505107142475,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7040,i,162661169748825679,16094051145126777856,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,7792946021380038910,17871471383375173576,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6876,i,11551776896940743353,18444117740907944875,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4896,i,3124613051524776248,17866724890784258484,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6484,i,9887771650911701249,14822415529897837527,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7252,i,6095065131688825351,6202581346970581522,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7736,i,16934656447520835936,192746469683792021,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7752,i,11132251937188520914,1626064365831065482,2097152 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,11789160793144272399,16496355954157785261,524288 --field-trial-handle=2508,i,8618368398124140399,9181226877582627590,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7ffde936c188,0x7ffde936c194,0x7ffde936c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,16987968103029375040,16351702609261900575,262144 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,10746544837957307642,14041751466149294680,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,2989182169049195171,17024362344340249781,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,9263425877362570948,7467154842226055289,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,9263425877362570948,7467154842226055289,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,17725235787314697650,3025972748207983500,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,10240005498194730149,11851070240625515572,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,18223028787149256708,2200560691599318977,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,14858200796953512877,11289015587925907006,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,17739327714087412286,4916218398100142316,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,4161838132218905814,15144339501841445914,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,3888790061534149497,4581662895639038718,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,6339185309872401954,10768267293700455416,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,2529700792504048514,6370120711861978990,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,16037889817315164153,7142131351099286006,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,11616559990386890667,12965918033219676275,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,15383413458117687531,10403619666651570275,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1472,i,14846713691940805240,7603171699767251958,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5512,i,18415673437908629034,1977323710312423201,262144 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3292,i,16858169822983172627,11037832368761029955,524288 --field-trial-handle=2608,i,8405379890098735577,8946911542795827916,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:143⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Koala.Clash_x64-setup.exe"C:\Users\Admin\Downloads\Koala.Clash_x64-setup.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Program Files\Koala Clash', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Koala Clash\Koala Clash.exe"C:\Program Files\Koala Clash\Koala Clash.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "%SystemRoot%\System32\schtasks.exe /create /tn "koala-clash-run" /xml "C:\Users\Admin\AppData\Roaming\koala-clash\tasks\koala-clash-run.xml" /f"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /tn "koala-clash-run" /xml "C:\Users\Admin\AppData\Roaming\koala-clash\tasks\koala-clash-run.xml" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Koala Clash\Koala Clash.exe"C:\Program Files\Koala Clash\Koala Clash.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\koala-clash" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1772,i,16450749462829456875,12843253258443625523,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Koala Clash\Koala Clash.exe"C:\Program Files\Koala Clash\Koala Clash.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\koala-clash" --field-trial-handle=1772,i,16450749462829456875,12843253258443625523,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:112⤵
- Executes dropped EXE
-
-
C:\Program Files\Koala Clash\resources\files\sparkle-service.exe"C:\Program Files\Koala Clash\resources\files\sparkle-service.exe" sysproxy disable2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Koala Clash\Koala Clash.exe"C:\Program Files\Koala Clash\Koala Clash.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\koala-clash" --app-user-model-id=koala-clash.app --app-path="C:\Program Files\Koala Clash\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1772,i,16450749462829456875,12843253258443625523,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Koala Clash\resources\sidecar\mihomo.exe"C:\Program Files\Koala Clash\resources\sidecar\mihomo.exe" -t -f C:\Users\Admin\AppData\Roaming\koala-clash\work\config.yaml -d C:\Users\Admin\AppData\Roaming\koala-clash\test2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where mihomo"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere mihomo3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where clash"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere clash3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where scoop"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere scoop3⤵
-
-
-
C:\Program Files\Koala Clash\resources\sidecar\mihomo.exe"C:\Program Files\Koala Clash\resources\sidecar\mihomo.exe" -d C:\Users\Admin\AppData\Roaming\koala-clash\work -ext-ctl-pipe \\.\pipe\Koala-Clash\mihomo2⤵
- Executes dropped EXE
-
-
C:\Program Files\Koala Clash\resources\files\sparkle-service.exe"C:\Program Files\Koala Clash\resources\files\sparkle-service.exe" sysproxy disable2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\koala-clash\tasks\koala-clash-run.exe"C:\Users\Admin\AppData\Roaming\koala-clash\tasks\koala-clash-run.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Koala Clash\Koala Clash.exe"C:\Program Files\Koala Clash\Koala Clash.exe"1⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "%SystemRoot%\System32\schtasks.exe /create /tn "koala-clash-run" /xml "C:\Users\Admin\AppData\Roaming\koala-clash\tasks\koala-clash-run.xml" /f"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /tn "koala-clash-run" /xml "C:\Users\Admin\AppData\Roaming\koala-clash\tasks\koala-clash-run.xml" /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Koala Clash\Koala Clash.exe"C:\Program Files\Koala Clash\Koala Clash.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\koala-clash" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1776,i,1402531307109502173,1618870976445495734,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Koala Clash\Koala Clash.exe"C:\Program Files\Koala Clash\Koala Clash.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\koala-clash" --field-trial-handle=1776,i,1402531307109502173,1618870976445495734,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:112⤵
- Executes dropped EXE
-
-
C:\Program Files\Koala Clash\resources\files\sparkle-service.exe"C:\Program Files\Koala Clash\resources\files\sparkle-service.exe" sysproxy disable2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Koala Clash\Koala Clash.exe"C:\Program Files\Koala Clash\Koala Clash.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\koala-clash" --app-user-model-id=koala-clash.app --app-path="C:\Program Files\Koala Clash\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1784780786895005 --launch-time-ticks=969562592 --field-trial-handle=1776,i,1402531307109502173,1618870976445495734,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Koala Clash\resources\sidecar\mihomo.exe"C:\Program Files\Koala Clash\resources\sidecar\mihomo.exe" -t -f C:\Users\Admin\AppData\Roaming\koala-clash\work\config.yaml -d C:\Users\Admin\AppData\Roaming\koala-clash\test2⤵
- Executes dropped EXE
-
-
C:\Program Files\Koala Clash\resources\sidecar\mihomo.exe"C:\Program Files\Koala Clash\resources\sidecar\mihomo.exe" -d C:\Users\Admin\AppData\Roaming\koala-clash\work -ext-ctl-pipe \\.\pipe\Koala-Clash\mihomo2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where mihomo"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere mihomo3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where clash"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere clash3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where scoop"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere scoop3⤵
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /query /tn koala-clash2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /query /tn koala-clash2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
settings.dat
settings.dat
2e4b4ce2-7b31-4164-826d-ebc3e8c2fa91.tmp
LOG.old
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
data_0
data_1
f_000055
f_000056
f_000057
f_000058
f_000059
f_00005a
f_00005b
f_00005c
f_00005d
f_00005e
f_000060
f_000061
f_000062
f_000063
f_000064
f_000065
f_000066
f_000067
f_000068
f_000069
f_00006a
f_00006b
f_00006c
f_000077
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe59e313.TMP
SiteList-Enterprise.json
Edge Profile.ico
000003.log
LOG
Favicons
data_1
History
000003.log
MANIFEST-000001
000003.log
LOG
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
the-real-index
the-real-index
the-real-index~RFe5d08bd.TMP
the-real-index
the-real-index
the-real-index~RFe5d9974.TMP
the-real-index
the-real-index
index.txt
index.txt
000003.log
LOG
the-real-index
the-real-index~RFe5d7ded.TMP
000003.log
LOG
000003.log
LOG
sync_diagnostic.log
CURRENT
MANIFEST-000001
ccf38733-081c-4dcf-8406-fb4670babbf2.tmp
default_cloud_config.json
bdec1834-acf0-408e-bd2e-25c36dbbc0f6.tmp
data_1
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
campaign_history
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
data_1
Variations
metadata.json
metadata.json
metadata.json
metadata.json
b6b102b0-cc56-4d17-a988-6bd4c55a7904.tmp
292bbfeb-6a5d-485d-a8ba-6815c3de679c.tmp.ico
__PSScriptPolicyTest_g00qgz2q.1mk.ps1
b7c620c2-a0a2-44e1-b378-b6e63f340cac.tmp.ico
e97494cf-f01f-4641-b3a1-cc951b7b4c8e.tmp
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app-update.yml
LICENSE
package.json
tailwindcss-oxide.win32-x64-msvc.node
LICENSE
FileIconInfo.exe
FileIconInfo.exe.config
file-icon-info.js
index.js
package.json
file-icon
index.js
license
package.json
LICENSE
lightningcss.win32-x64-msvc.node
package.json
elevate.exe
7za.exe
ASN.mmdb
country.mmdb
enableLoopback.exe
geoip.dat
geoip.metadb
geosite.dat
koala-clash-run.exe
sparkle-service.exe
mihomo-alpha.exe
mihomo.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
WinShell.dll
nsExec.dll
content_new.js
default.exc
ccba5a5986c77e43.customDestinations-ms
data_0
data_2
data_3
Network Persistent State
Network Persistent State~RFe5f119d.TMP
bcb9b735-dae8-45d9-968b-d23e1a8c96bc.tmp
memory/2356-2903-0x0000000070220000-0x000000007057B000-memory.dmp
memory/2356-2900-0x000000006FFF0000-0x000000007003C000-memory.dmp
memory/2932-2879-0x0000000007050000-0x000000000706A000-memory.dmp
memory/2932-2877-0x0000000006FA0000-0x0000000007043000-memory.dmp
memory/2932-2883-0x0000000070170000-0x00000000704CB000-memory.dmp
memory/2932-2872-0x0000000006C90000-0x0000000006CC6000-memory.dmp
memory/2932-2881-0x0000000007260000-0x000000000728A000-memory.dmp
memory/2932-2880-0x00000000070C0000-0x00000000070CA000-memory.dmp
memory/2932-2866-0x00000000057B0000-0x0000000005816000-memory.dmp
memory/2932-2871-0x0000000005D30000-0x0000000005D7C000-memory.dmp
memory/2932-2870-0x0000000005960000-0x000000000597E000-memory.dmp
memory/2932-2873-0x000000006FFF0000-0x000000007003C000-memory.dmp
memory/2932-2878-0x00000000076D0000-0x0000000007D4C000-memory.dmp
memory/2932-2882-0x0000000007290000-0x00000000072B4000-memory.dmp
memory/2932-2865-0x0000000005740000-0x00000000057A6000-memory.dmp
memory/2932-2864-0x0000000004F20000-0x0000000004F42000-memory.dmp
memory/2932-2876-0x0000000006CD0000-0x0000000006CF0000-memory.dmp
memory/2932-2869-0x00000000059D0000-0x0000000005D2B000-memory.dmp
memory/2932-2863-0x0000000005040000-0x000000000568A000-memory.dmp
memory/2932-2862-0x0000000002480000-0x00000000024B6000-memory.dmp
memory/3360-2893-0x0000000007C50000-0x0000000007CE6000-memory.dmp
memory/3360-2890-0x000000006FFF0000-0x000000007003C000-memory.dmp
memory/3360-2894-0x0000000007A30000-0x0000000007A41000-memory.dmp
memory/3360-2889-0x00000000060A0000-0x00000000063FB000-memory.dmp