redline | 4acfbea2a0c4f806c303ab7875cbdb0a8fe60d3df9a67d063f7170e01615ed0b

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2024, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe
Size 313KB
Sample240205-bv85sahdfm
SHA256 715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9
MD5 6754d3c831c2392dd5a35b5768df4c37
SHA1 3a1bac47966c643c1587b734f19e7963c56e8dee
SHA512 2d373f936746f2bf962dbac09779d1b7c7f93dec7d8728f2c3db8bda36da290539e49b8d3bdcbeef28ab1d6e126f8632c009f5583ebb1b2d3cba4ba18e6245dd
SSDEEP 3072:QA0UpT1W+9dAoDc0ib8fy+8EnelxlmyxkMRqfjDv/YUeqiOL2bBOJ:4sHdGjb8KNxADMRqfjD4aL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline 1 discovery infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

92.222.212.74:1450

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/2380-0-0x0000000000410000-0x0000000000464000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2380	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe
432	msedge.exe
432	msedge.exe
220	msedge.exe
220	msedge.exe
4204	msedge.exe
4204	msedge.exe
3716	identity_helper.exe
3716	identity_helper.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 4204	2380	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe	94
PID 2380 wrote to memory of 4204	2380	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe	94
PID 4204 wrote to memory of 1612	4204	msedge.exe	93
PID 4204 wrote to memory of 1612	4204	msedge.exe	93
PID 2380 wrote to memory of 3924	2380	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe	95
PID 2380 wrote to memory of 3924	2380	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe	95
PID 3924 wrote to memory of 1396	3924	msedge.exe	96
PID 3924 wrote to memory of 1396	3924	msedge.exe	96
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 1596	4204	msedge.exe	98
PID 4204 wrote to memory of 220	4204	msedge.exe	97
PID 4204 wrote to memory of 220	4204	msedge.exe	97
PID 3924 wrote to memory of 3616	3924	msedge.exe	101
PID 3924 wrote to memory of 3616	3924	msedge.exe	101
PID 3924 wrote to memory of 3616	3924	msedge.exe	101
PID 3924 wrote to memory of 3616	3924	msedge.exe	101
PID 3924 wrote to memory of 3616	3924	msedge.exe	101
PID 3924 wrote to memory of 3616	3924	msedge.exe	101
PID 3924 wrote to memory of 3616	3924	msedge.exe	101
PID 3924 wrote to memory of 3616	3924	msedge.exe	101
PID 3924 wrote to memory of 3616	3924	msedge.exe	101
PID 3924 wrote to memory of 3616	3924	msedge.exe	101
PID 3924 wrote to memory of 3616	3924	msedge.exe	101
PID 3924 wrote to memory of 3616	3924	msedge.exe	101
PID 3924 wrote to memory of 3616	3924	msedge.exe	101
PID 3924 wrote to memory of 3616	3924	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe
"C:\Users\Admin\AppData\Local\Temp\715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.slotvip365.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
    3⤵
    PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4996 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.com/19eWD4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffcee346f8,0x7fffcee34708,0x7fffcee34718
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7802736798284712997,4954926371887304747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7802736798284712997,4954926371887304747,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffcee346f8,0x7fffcee34708,0x7fffcee34718
1⤵
PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfaf6313fd293f6013f58fb6790fd38ca2f04931403267b7a6aef7bfa81d50bb
MD5 8a1d28b5eda8ec0917a7e1796d3aa193
SHA1 5604a535bf3e5492b9bf3ade78ca7d463a4bfdb2
SHA512 51b5bec82ff9ffb45fee5c9dd1d51559c351253489ea83a66e290459975d8ca899cde4f3bb5afbaa7a3f0b169f87a7514d8df88baaeec5bd72d190fd6d3e041b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
MD5 1386433ecc349475d39fb1e4f9e149a0
SHA1 f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA512 fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 b96a872ddc812886aa079a35883ae7e29066072009036afa4c05d54dd34c64b5
MD5 0355d61dd69bd337ad0917cd1eaa7bf0
SHA1 d2ca3b5ee15912d6d2adb7702278add23d8a2335
SHA512 abbb4a44ebb8ee9a52f1c05047a8c86ef41bab0c8ceac97b82d727d2597d18186efc6a496694914bf4f17ce370394911144bce124ee73b69a770d1e51f833fb4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 770B
SHA256 2003128141bbc13ded8f2caa3406f65217af6f7c1ee967609a29f6fee20ab75a
MD5 0ae3dd2e9400c06e160b916ad3599966
SHA1 4241e2baeae97568fdd0251e56e50c6145766d97
SHA512 d3eafd83347a79709a4bd915b40eca18cb9fb1d08b5a4131a57031bd62b87307f99cc12440efd4983e30f5b11c47b2dc627077cc77f546351bd78ca4322deabc
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9a5729cd24325c1aa957a55649ca483565adc53cd651ffbbb4412dedd0673514
MD5 afe40ed4f07b0855f4109b6299a23188
SHA1 4811f9d53b71f02fd59ec53bbaa90f1260f1e30a
SHA512 9c32a2e1482d0f23cbe3e01555eedb3b3019ca9efd1a828cbb989cc8576351b58ed6de430a264251da75fe6b7f463e2765f188c8ec0fb9833a9279d5d0f218c0
SSDEEP 96:nSwAk+Lie1VD/aO5wpYDwGWMoiVmdeP7uVS1Nu0S1j8P8uUWQyV+VD7AiEwb:nfAkqjDt595WMjuM/ubhe8urg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cdc29a582a96d16c7e2c57c4da0f54749418599f742891038d1971cf897d58c0
MD5 c893adc41f7bcb1a6c5a960db9182ee7
SHA1 4b6b3f743c4e535610c96ebea80857c927505e5c
SHA512 d89fb264411929c6356f0ae7f788fcdb3a4870dc7b84f55ef968e93bc70907399f2a203b9f8b9ab152e80fd3c720ad1fb638562c6e9ab53e4093c9ba9dc9324f
SSDEEP 96:nSwAk7ie1VD/aO5wpYDwGWMoiVmdeP7uVS1Nu0S1j8P84UWQyV+VD7AiEwb:nfAkpjDt595WMjuM/ubhe84rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d61ff5b969692701f648dfecc9aaa3d4678e8de19531a5e82a795f95b0655a89
MD5 468e2a6e84a6e59fd3198d6f21b61d70
SHA1 8064407abbbe27b7a23ec9ae24a2f7307ffc8322
SHA512 49932d898a9044b972544343775dd31da65452078debf7cdfbb1812f0a56016608c2748050d0db90f5fc35cff75f2509757a198d60503a4a55765c8da3783837
SSDEEP 96:nSwWkAie1Vv/aO5wpvWMoiVmdeH8P8xUWQyV+VDCzia:nfWkgjvt5GWMXe8xrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617
MD5 e664066e3aa135f185ed1c194b9fa1f8
SHA1 358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5
SHA512 58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e
SSDEEP 768:n/MWlx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvLlJorUlrIffY:n/MWlxu1jaaL7lrGY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 540B
SHA256 cbdb01d72c57a0cf8bf63b5e82af2da99732c7518e93f5f4654c72b0eae8c1ad
MD5 78c33bbf2f89ae03b1d2357a24fccde2
SHA1 dade811d73291dde76cac34ed33123e04780a0a2
SHA512 efb327db2d2ef54932fc38de5b198949305c728cb7375773401ff5b3a199e8a5c3d6bf44168699dc64e19948342bea9c88607781d47378a2d4a5d0ab18f32fe8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 540B
SHA256 745ca534cca1aed60b49b14668d1be7bc758a22fb78449ef5c929697a8f55a8c
MD5 a4fa403fa9a14f46c2b354863a9354c4
SHA1 de08e0995ff20e992dab615295b4d58a74ff8575
SHA512 545121ccc51b3fb4ba8fb83bfebb025014dc219412d13de655d1dff753d1d87329a1c9a6bc48838ff2b8c8509bee6a51b4ff5245140a1b4544835218482ad2b4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 540B
SHA256 40cfb9e19eb73221c36ee6db9cbcdee808b873a852899bb3a0e58b2e40e7139e
MD5 7f1594dcb96b346b487ebd3ba0e63ee2
SHA1 bbda33dd9720a729c526653bf21bc6de57d46fac
SHA512 d088f108a970e162df7363ebd75ad08056ba5fbe0ba67e837eeeb6529c34bd6198e942ef9fd0e8de81c418abb23124c8787db0a92b3ebf967f6a52b1087c5922
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 540B
SHA256 efae92f310c20b42d3b432fc2cdefe31521e130d90bd83efa89360e20635e8f9
MD5 9ab71df4de1f5443f5cf2220cc6a25a5
SHA1 f7e5646eff178f168952f02c9e79086fff94ff7c
SHA512 87a0bf368905bccc36f409a255c31259ad4b76005d2e95bd7b46d92cabe1ba8411c8e8425b00e411674a551c281d07e13c79b95058c2abedc9bb23ffa87138d6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 540B
SHA256 e94abb5890f41c077beeb60b9f01f13f0e3b4fb89ac06470b72ccdae46e9339e
MD5 f4d2c93e91470c9362f76ccc5c872c7f
SHA1 a20d7fcc7b769cd3bc5e732cac0b3711bdcfcae3
SHA512 163ad18de625a95648588ae3e57d868a15f6fcf2e5742afa138beb3b01e3c0e569c6f07047567da67edcd0e8cfad5ab6de3de52e6f7d765000a9178b8e194135
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 372B
SHA256 0f8f7021c6a34147779b2521651714aa81440da7aadb11b5a022ac4c25cbb396
MD5 43ad097a5c4d541a0a264a5d87a42d19
SHA1 18cedd045e36191b63e9005415520d743e075dca
SHA512 f18d500ea08736fe951016a7d2428413cf46ecaf9cc34047eb8d3f734034b2bb2d169c773b5a53d0d2ca13f3f46ac464013aeb3e293edb1733538b2af51458c6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 540B
SHA256 118873f7ad25f93c1e4da3da616d7b1bff31b762009dfde7a701566251eacf60
MD5 a0b620401426d29b776daae4ede6d48b
SHA1 18b86d8ad208c852abc8271c6865dbe4a2cbda99
SHA512 4972b10e48bf7d112e6da24dffb49bed522462926048d4000d527702ddcfdd34588d8e5437d45a47654881db2dafc29dc357f6aeb34bb5767d63cc9712054af8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 540B
SHA256 d844e4f4b78757d705c7072372f91ab201343f7568d4f7011467d56972ca2e38
MD5 3cdf41e7cba76ab1bf4d20a3897da44b
SHA1 818ffb40ed0266e11644a3c402afea1c6ada5017
SHA512 90652d823ba904a9e2cd6c8cabfd8918bdf8da3ea32ce13dfc1269d2514e9d4e200aabb90d016756c3e67704c224f2a289a160cc62e91a051de32558986b6176
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c18b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c18b.TMP
Size 372B
SHA256 cb4d778fccd305555ab0ec16a9438ffa8ee0d44f21c597938e64e815c59f5970
MD5 ebc510b9e25634c8a2ef1ff4e0c38178
SHA1 31c9aca3bf3400eb04273468092b8fe103f96d3e
SHA512 6d15793008caa69832933f04058fb428a9127e129856c22b23eeb907175b080827ba73782053c0b9c51516aba3869f28f1d349180c563d1b8a8af239f4ee1b0d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 128c7e3f51a350abf659624ea32a920086584b5859882ba174fbdf50e7691d38
MD5 28971660a1469c1e1c9166c8d2756a97
SHA1 b210c5d95f5c01415bc183885b7f693cddab82f2
SHA512 68a59c0e75f552a701ba303a9724d276fe6d358acfcf4d019f96be8eafe56238d8fc49691a3b98673239303db61138ab91f958f630b4ab1234dc757d6dcfc0a4
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e80f339fb709a7bd19f7c234517b36a77b8dc35711733fcc07ccfa8da0ad6e63
MD5 05cdd0591fb72083ddcdd07395290bb7
SHA1 024d2dc4527957ff26d6a31f8fb89c8dde17ed74
SHA512 7845a41d0d870946a8abb979c103eee950464a334df799637534b65c03f9f2de26888e31eb075eb2560779e1023e39bbe7acd3f17c1246d8d06806e1d7df1465
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupMKe2RUFSBb8JhTw8AftwKn:N9iIxuERzA83h09RZxYMEqPc86W2P
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2380-4-0x0000000004E50000-0x0000000004E60000-memory.dmp

Download

memory/2380-8-0x0000000005100000-0x0000000005112000-memory.dmp

Download

memory/2380-46-0x0000000074F60000-0x0000000075710000-memory.dmp

Download

memory/2380-1-0x0000000074F60000-0x0000000075710000-memory.dmp

Download

memory/2380-6-0x0000000006090000-0x00000000066A8000-memory.dmp

Download

memory/2380-3-0x0000000004E60000-0x0000000004EF2000-memory.dmp

Download

memory/2380-5-0x0000000005020000-0x000000000502A000-memory.dmp

Download

memory/2380-10-0x00000000052E0000-0x000000000532C000-memory.dmp

Download

memory/2380-2-0x00000000054C0000-0x0000000005A64000-memory.dmp

Download

memory/2380-0-0x0000000000410000-0x0000000000464000-memory.dmp

Download

memory/2380-7-0x00000000051D0000-0x00000000052DA000-memory.dmp

Download

memory/2380-9-0x0000000005160000-0x000000000519C000-memory.dmp

Download

memory/2380-12-0x0000000006900000-0x0000000006950000-memory.dmp

Download

memory/2380-11-0x0000000005B10000-0x0000000005B76000-memory.dmp

Download