Analysis
- user interaction
yes - max time kernel
489s - max time network
481s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 11:32
General
- Target view[1].html
- Size 72KB
- Sample260804-nnnaysad33
- SHA256 86244a1411e20e62f0642f76d0e8ff40c05bbcd2b8da77fd9e1741bc526a06b9
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 24 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to get system information.
- Drops file in Program Files directory 64 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 11 IoCs
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious behavior: LoadsDriver 7 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 22 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\view[1].html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffa3ab4c188,0x7ffa3ab4c194,0x7ffa3ab4c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,17114183749683167309,9560658516364722198,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,13576005744699154891,9474204841617090887,262144 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,8383145440545965451,4197049203129673626,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,9429306973201508705,17591231548279269220,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,3132488025828325515,170747180548392333,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,8167353324698539906,1715332210938055272,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,4531468068903501501,767250472749501069,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3720,i,4901853948363158473,18032825344214035459,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,2138195021171994032,18435732198415593164,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,8482694135107970160,14892966124965959432,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,10262022311655048847,5492654467022032642,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,10262022311655048847,5492654467022032642,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,1014754831932473283,17835441000421636938,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,1014754831932473283,17835441000421636938,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,9491964791332864267,3896424785985678100,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4456,i,3171738186186996812,8413060014455009561,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6620,i,5397632308834886700,6195377551722375614,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,7261168890137644765,11833184111710457483,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,16095886961354566353,9058487340100989177,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,11448486419692996742,1077335948172214138,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7180,i,9325531309536650418,6524927599237980003,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3328,i,5651207732223072683,13339838403885369515,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=2340,i,2592046627082543370,2840895348258478345,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7428,i,4205883241108496199,10071095657547190665,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5176,i,14147773425343425147,7939534015847668762,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7928,i,12703624925369812933,5929930996425718326,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7680,i,10516231974536875492,18072677423114816126,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7492,i,17679343554163049674,9623591783981813655,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4052,i,7304182217098422290,13051015216277658429,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=8408 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5428,i,13870423505405498240,13891452929514087367,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,12870125923425321494,930039956005233727,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,9547734049412710309,10641226537034867335,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6680,i,15279817040106922387,12559081856497030445,2097152 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,7639362852545447886,13079678678030737662,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8436,i,12466497084922662228,4657978927155452096,262144 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=8568 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,10887042471853112113,8337255310303312306,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8456,i,14942430656586508713,2497911397262376448,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=8288 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8448,i,10275374958403803473,8414931461373768575,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,719833158015985127,5870407585707187939,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,1411380030166330491,16783042573011722044,524288 --field-trial-handle=2164,i,6983656899928233567,2530368927520285349,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D41⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Project-Ocean-Setup-1.0.1.exe"C:\Users\Admin\Downloads\Project-Ocean-Setup-1.0.1.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Program Files\Project Ocean', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Project Ocean\Project Ocean.exe"C:\Program Files\Project Ocean\Project Ocean.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Project Ocean\Project Ocean.exe"C:\Program Files\Project Ocean\Project Ocean.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project-ocean" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1752,i,2839031151779156693,1373659103066145121,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Project Ocean\Project Ocean.exe"C:\Program Files\Project Ocean\Project Ocean.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\project-ocean" --field-trial-handle=2204,i,2839031151779156693,1373659103066145121,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:112⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Project Ocean\Project Ocean.exe"C:\Program Files\Project Ocean\Project Ocean.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\project-ocean" --app-path="C:\Program Files\Project Ocean\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2384,i,2839031151779156693,1373659103066145121,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Project Ocean\Project Ocean.exe"C:\Program Files\Project Ocean\Project Ocean.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\project-ocean" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2928,i,2839031151779156693,1373659103066145121,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:102⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
LOG.old
LOG.old
f_000071
f_000074
f_000079
f_00007a
f_00007d
f_00007f
f_000080
f_000084
f_000086
f_00008a
f_0000be
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe59bf01.TMP
SiteList-Enterprise.json
Edge Profile.ico
MANIFEST-000001
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe59c5a8.TMP
the-real-index
the-real-index~RFe5cc7bc.TMP
the-real-index
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
index.txt
index.txt
index.txt
ba23d8ecda68de77_0
the-real-index
the-real-index~RFe5a60fd.TMP
sync_diagnostic.log
sync_diagnostic.log
CURRENT
MANIFEST-000001
OperationConfig
OperationConfig~RFe5a441f.TMP
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe59e507.TMP
8bceb3db-0fcb-4604-a1a3-0bb8830d1da2.tmp
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_xaks0voo.wxx.ps1
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app.asar
LICENSE.txt
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.exp
koffi.lib
koffi.node
koffi.exp
koffi.lib
koffi.node
koffi.exp
koffi.lib
koffi.node
benchmarks.md
callbacks.md
contribute.md
functions.md
index.md
input.md
migration.md
misc.md
output.md
packaging.md
platforms.md
pointers.md
start.md
unions.md
variables.md
index.js
base.hh
crc.inc
crc_gen.py
mimetypes.inc
mimetypes_gen.py
tower.hh
unicode.inc
unicode_gen.py
package.json
README.md
FindCNoke.cmake
toolchains.json
win_delay_hook.c
cnoke.js
package.json
builder.js
index.js
tools.js
CMakeLists.txt
abi_arm32_asm.S
abi_arm64_asm.S
abi_arm64_asm.asm
abi_loong64_asm.S
abi_riscv64_asm.S
abi_x64_sysv_asm.S
abi_x64_win_asm.S
abi_x64_win_asm.asm
abi_x86_asm.S
abi_x86_asm.asm
call.hh
errno.inc
ffi.hh
init.js
parser.hh
util.hh
uv.def
uv.hh
win32.hh
write_trampolines.js
LICENSE.md
README.md
napi-inl.deprecated.h
napi-inl.h
napi.h
LICENSE
README.md
js_native_api.def
node_api.def
js_native_api.h
js_native_api_types.h
node_api.h
node_api_types.h
uv.h
aix.h
bsd.h
darwin.h
errno.h
linux.h
os390.h
posix.h
sunos.h
threadpool.h
tree.h
unix.h
version.h
win.h
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
UAC.dll
WinShell.dll
nsDialogs.dll
nsExec.dll
nsis7z.dll
default.exc
data_1
data_0
data_2
data_3
Network Persistent State
Network Persistent State~RFe5e0945.TMP
memory/1044-1720-0x000000006FE00000-0x000000007015B000-memory.dmp
memory/1044-1660-0x0000000005300000-0x0000000005336000-memory.dmp
memory/1044-1707-0x0000000007780000-0x00000000077B6000-memory.dmp
memory/1044-1716-0x0000000007D10000-0x0000000007D3A000-memory.dmp
memory/1044-1677-0x00000000067F0000-0x000000000683C000-memory.dmp
memory/1044-1711-0x0000000006DA0000-0x0000000006DC0000-memory.dmp
memory/1044-1715-0x0000000007B70000-0x0000000007B7A000-memory.dmp
memory/1044-1712-0x0000000007A50000-0x0000000007AF3000-memory.dmp
memory/1044-1713-0x0000000008180000-0x00000000087FC000-memory.dmp
memory/1044-1676-0x0000000006790000-0x00000000067AE000-memory.dmp
memory/1044-1714-0x0000000007B00000-0x0000000007B1A000-memory.dmp
memory/1044-1661-0x0000000005990000-0x0000000005FDA000-memory.dmp
memory/1044-1708-0x000000006FC80000-0x000000006FCCC000-memory.dmp
memory/1044-1717-0x0000000007D40000-0x0000000007D64000-memory.dmp
memory/1044-1666-0x0000000006090000-0x00000000060B2000-memory.dmp
memory/1044-1667-0x00000000061B0000-0x0000000006216000-memory.dmp
memory/1044-1668-0x0000000006220000-0x0000000006286000-memory.dmp
memory/1044-1673-0x0000000006400000-0x000000000675B000-memory.dmp
memory/1876-1798-0x0000000007810000-0x00000000078A6000-memory.dmp
memory/1876-1743-0x0000000005CA0000-0x0000000005FFB000-memory.dmp
memory/1876-1769-0x000000006FC80000-0x000000006FCCC000-memory.dmp
memory/1876-1811-0x0000000007770000-0x0000000007781000-memory.dmp
memory/3460-3146-0x000001C765B60000-0x000001C765B61000-memory.dmp
memory/3460-3137-0x000001C765B60000-0x000001C765B61000-memory.dmp
memory/3460-3139-0x000001C765B60000-0x000001C765B61000-memory.dmp
memory/3460-3148-0x000001C765B60000-0x000001C765B61000-memory.dmp
memory/3460-3147-0x000001C765B60000-0x000001C765B61000-memory.dmp
memory/3460-3145-0x000001C765B60000-0x000001C765B61000-memory.dmp
memory/3460-3144-0x000001C765B60000-0x000001C765B61000-memory.dmp
memory/3460-3143-0x000001C765B60000-0x000001C765B61000-memory.dmp
memory/6960-1820-0x0000000005F60000-0x00000000062BB000-memory.dmp
memory/6960-1822-0x000000006FC80000-0x000000006FCCC000-memory.dmp
memory/6960-1825-0x000000006FEE0000-0x000000007023B000-memory.dmp