c37ac379f7614de0382c60dee8470067c15397a0679cff1f6e4b7f6b40f029b6

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$(LSTR_76).exe
Size

12.7MB
MD5

2d73627f749ae3deed81002bc9c1219c
SHA1

cad7735a7356be93704ad92a1b909c132810090b
SHA256

25f9c485d17e1666e959c4d98cd29fc9cf833fe163ab80537a411ce5973938dc
SHA512

be174fa33322ebde4405287ac9ed80b376cd5b1654fbe6f6473623922d2fdda264992d5a64b9a9a6faff811611291285bafa101a18a181741b495d9c3f865caa
SSDEEP

98304:DjiNb9NQk8//YB9tDDD8888xBKKiiqqqqnnT0bUDcuT3eXHV9LsI47uxCKYtLUG+:DbcYhRok0EHEYqgeXST

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4288	$(LSTR_76).exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	$(LSTR_76).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	$(LSTR_76).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	$(LSTR_76).exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1184	msedge.exe
1184	msedge.exe
8	identity_helper.exe
8	identity_helper.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4288	$(LSTR_76).exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4288	$(LSTR_76).exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4288	$(LSTR_76).exe
4288	$(LSTR_76).exe
4288	$(LSTR_76).exe
4288	$(LSTR_76).exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4988	4288	$(LSTR_76).exe	85
PID 4288 wrote to memory of 4988	4288	$(LSTR_76).exe	85
PID 4288 wrote to memory of 4988	4288	$(LSTR_76).exe	85
PID 4288 wrote to memory of 1184	4288	$(LSTR_76).exe	86
PID 4288 wrote to memory of 1184	4288	$(LSTR_76).exe	86
PID 1184 wrote to memory of 1932	1184	msedge.exe	87
PID 1184 wrote to memory of 1932	1184	msedge.exe	87
PID 4288 wrote to memory of 1488	4288	$(LSTR_76).exe	88
PID 4288 wrote to memory of 1488	4288	$(LSTR_76).exe	88
PID 4288 wrote to memory of 1488	4288	$(LSTR_76).exe	88
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 3800	1184	msedge.exe	89
PID 1184 wrote to memory of 1276	1184	msedge.exe	90
PID 1184 wrote to memory of 1276	1184	msedge.exe	90
PID 1184 wrote to memory of 2756	1184	msedge.exe	91
PID 1184 wrote to memory of 2756	1184	msedge.exe	91
PID 1184 wrote to memory of 2756	1184	msedge.exe	91
PID 1184 wrote to memory of 2756	1184	msedge.exe	91
PID 1184 wrote to memory of 2756	1184	msedge.exe	91
PID 1184 wrote to memory of 2756	1184	msedge.exe	91
PID 1184 wrote to memory of 2756	1184	msedge.exe	91
PID 1184 wrote to memory of 2756	1184	msedge.exe	91
PID 1184 wrote to memory of 2756	1184	msedge.exe	91
PID 1184 wrote to memory of 2756	1184	msedge.exe	91
PID 1184 wrote to memory of 2756	1184	msedge.exe	91
PID 1184 wrote to memory of 2756	1184	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\$(LSTR_76).exe
"C:\Users\Admin\AppData\Local\Temp\$(LSTR_76).exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\popup.exe
  "C:\Users\Admin\AppData\Local\Temp\popup.exe" /product=gomplayer /lang=eng /build=
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://playinfo.gomlab.com/ending_browser.gom?product=GOMPLAYER
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe8b2046f8,0x7ffe8b204708,0x7ffe8b204718
    3⤵
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,18009337943620052557,9229922429544847428,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3868
- C:\Users\Admin\AppData\Local\Temp\GrLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\GrLauncher.exe" "<GRLAUNCHER_PARAM Command='checkversion' Lang='eng' AgentName='GOMPlayer 2, 3, 47, 5309 (ENG).Q10' ProgramID='GOMPLAYER' ForceCheck='0' CheckMinorVersion='1' CheckBuildVersion='0' CheckDisabled='1' RetWindowHandle='0' />"
  2⤵
  PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

Filesize
1KB

MD5
20e76ffb49f1f7b9fd47f31556acd542

SHA1
c125ae7921fc77b86ad20dd668812e0940f4f81f

SHA256
42bf36fd2192ee6139c9f58831e850c832478fb4cc9b26437148d5d0d72a4901

SHA512
f22979cc3d3c2f28463140d48846c13fe773fa2d692defc96b72e7a4e92056253aac9711b6496b77b05e4f373216dea1fd7b18cbbfde09f14e913d6d248c66b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
2KB

MD5
5916d83e22df7948ad1cc304797cc810

SHA1
55add3dee50a7777bbbfc1770743e5eec3c0a37e

SHA256
85f79d1c9b204c04fddf0c622d89c578d77a3b071e12f8c39637d1ca4e6fa335

SHA512
28aa387e1318a61ae5de8f882ccac8242962f0c8e447e1239a9ea14107b693b7840a8c8fe3eaeec1399fe4f54883c67fc6d6f23ed320f400bb772658c3920c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
1KB

MD5
d7eced648022a5f16b5d77900c0929ea

SHA1
8f2f7597f442ace758cc2e63de82ef76431bfd97

SHA256
a54fa8c2926d8114bbfd13dbf10eb5b66d9441efbdabcd55ca18cb2a69545757

SHA512
6c6127dd631a8fc5b42e198da4787af79e3abc399f24c98aded718e4dd6c1f2a80f1ae124b0b3d2000abaec506e06fcacea2c0453d8a4a8201c71cd2bf012e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

Filesize
434B

MD5
71b87c5f66479ca7bca7f7530e189da6

SHA1
3c7e48370fb8690c2ce65bc71fb16fb060d26079

SHA256
f26b7a97888dd7a1a0d4016b90d774de97d6cc461ca50091e20e58f7bac7b158

SHA512
f6b520e94cd1f9804a234a35ecd7927d497df90ff63b98b612aa494a0f1622564d28e6092a80bb1a377085caaa1d7581bd5e6a0f17d8a59100ffb5133c9db18a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
458B

MD5
74d6171bddb41162655b61f74f1298c1

SHA1
b5802941e89ad2d00d97253b2713b5151dc67f13

SHA256
ad3f8fcd4ea65e26a481cf336e67be5d9de37c8c122e5f253ea961ecad4efb79

SHA512
d77252f350b23747d8aef32c1a56e55234af5768446c414c05009ad71821b60feab193078d55bdde1d1aef4ebbbfad68a4994cd90c9fe79d17e73812d9c96011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
432B

MD5
8c1f6d65294796cd10b97eb49258c9b7

SHA1
eca4df4f97d1ee67d8631b79efadc78e18d1accb

SHA256
2db196f2b49a7d2511dbcd6d492b501a5637c52d46b370c3117303d957a04361

SHA512
d469cfbf00ca70f98c79e1b254a7d8d5ed45d7d00ba650f15da3005c8ed8a3e132370f783ea7bbd23bc9963bc72d07c8dd36079c427e78c50f525b0b0df05677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
dc977ca9144bb5cba63eab9c5dcd8573

SHA1
b6b6a2be16f603c48c85a824a06efc5df61de20e

SHA256
2fa4d63aa0ad1ae1182d4589dc80d3c7c5c869754e069d453ccd4ff66573d0ba

SHA512
0b2bd942a7e494dc7efa3454af41ce1c63d9ed280d880df792a0600b5975687d42e4ae22419bba4759b2f1ea637d255020be23088942824bfa956a28c38c257a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
795cafb9bf974d9b5fb8e3b4b04314b9

SHA1
87398737df8b6edc22a2812e36fe611222d4a610

SHA256
3197cec233beeb5bff415128d16566e52f8ce0b5409e3ef0f946208fd0ff2a32

SHA512
ee838bf1b504f62162e5c828e341403382bcaf9e74bd0d98daa651f2d1b6e13d22776f59ce1de7538997c53bd76d053335a300cfa105a563603b1b8010f665dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05a0f94c2af0e2974195796566a32b8c

SHA1
02b77b8bbf9edf7e0ac0e9a344464472a8c411fe

SHA256
f023335cfbfb00427d6c6750e7116afd634ba2525615052bd3940a69528b081f

SHA512
f3eedcb4f79760f22e8db4604759b4f98acdd28c8a3dcab18f84340b7c63e735c826a1229a425669f45c2a5b79bae53d47482018e33320e21c84080afa9b5750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
70ebe23356139f73c48b969453359eaf

SHA1
f5e615f40564bb0ffdb34b5f928d14e79f737ca9

SHA256
97227e72ab398b90c53fdd5d0580d22debe332946902ac9816c7506f3b7a0eb9

SHA512
23adc4237ab9e6abaef01775594ad542ccf7aea49876860172bd2e2e93e12b6c711deb0e9c586f67c94da9853411c3b2c894d14914ab352549536305c6f2a54e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a3340a7ac2ae701f381837ff6cc075e8

SHA1
cf0ed42044b72754b7261463827f89f564b77d86

SHA256
fbc00647c23a2ffcf1247efd9fb2a368b83b2e5e95725ae17fa99632bedb74ad

SHA512
e2e6bd7115397910fc82174c98d9f6d5dc1e6acb2af556c4cead1ca8c313addd9ca16feedca3eb9d5f6680ac37876e42265a81afe3afe982cff61e5c74f58c14

Download Submit
memory/4288-1-0x0000000072AC0000-0x0000000073E87000-memory.dmp

Filesize
19.8MB

Download
memory/4288-33-0x0000000074390000-0x0000000074494000-memory.dmp

Filesize
1.0MB

Download
memory/4288-0-0x0000000072AC1000-0x00000000732D5000-memory.dmp

Filesize
8.1MB

Download
memory/4288-34-0x0000000074010000-0x0000000074389000-memory.dmp

Filesize
3.5MB

Download
memory/4288-37-0x0000000072A30000-0x0000000072ABF000-memory.dmp

Filesize
572KB

Download
memory/4288-35-0x0000000073EA0000-0x000000007400C000-memory.dmp

Filesize
1.4MB

Download