redline | 4acfbea2a0c4f806c303ab7875cbdb0a8fe60d3df9a67d063f7170e01615ed0b

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2024 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe
Size

313KB
MD5

6754d3c831c2392dd5a35b5768df4c37
SHA1

3a1bac47966c643c1587b734f19e7963c56e8dee
SHA256

715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9
SHA512

2d373f936746f2bf962dbac09779d1b7c7f93dec7d8728f2c3db8bda36da290539e49b8d3bdcbeef28ab1d6e126f8632c009f5583ebb1b2d3cba4ba18e6245dd
SSDEEP

3072:QA0UpT1W+9dAoDc0ib8fy+8EnelxlmyxkMRqfjDv/YUeqiOL2bBOJ:4sHdGjb8KNxADMRqfjD4aL

Score

10^/10

redline 1 discovery infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

92.222.212.74:1450

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2380-0-0x0000000000410000-0x0000000000464000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2380	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe
432	msedge.exe
432	msedge.exe
220	msedge.exe
220	msedge.exe
4204	msedge.exe
4204	msedge.exe
3716	identity_helper.exe
3716	identity_helper.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe

description pid process

Token: SeDebugPrivilege 2380 715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe

description	pid	process
Token: SeDebugPrivilege	2380	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exemsedge.exemsedge.exe

description	pid	process	target process
PID 2380 wrote to memory of 4204	2380	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe	msedge.exe
PID 2380 wrote to memory of 4204	2380	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe	msedge.exe
PID 4204 wrote to memory of 1612	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1612	4204	msedge.exe	msedge.exe
PID 2380 wrote to memory of 3924	2380	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe	msedge.exe
PID 2380 wrote to memory of 3924	2380	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe	msedge.exe
PID 3924 wrote to memory of 1396	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 1396	3924	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 1596	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 220	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 220	4204	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe
PID 3924 wrote to memory of 3616	3924	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe
"C:\Users\Admin\AppData\Local\Temp\715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.slotvip365.com/
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
3⤵
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
3⤵
PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
3⤵
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
3⤵
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
3⤵
PID:868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
3⤵
PID:2588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
3⤵
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
3⤵
PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
3⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
3⤵
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
3⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
3⤵
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
3⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
3⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8804624799049381404,3468608930010844581,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4996 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.com/19eWD4
2⤵
- Suspicious use of WriteProcessMemory
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffcee346f8,0x7fffcee34708,0x7fffcee34718
3⤵
PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7802736798284712997,4954926371887304747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7802736798284712997,4954926371887304747,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
3⤵
PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffcee346f8,0x7fffcee34708,0x7fffcee34718
1⤵
PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8a1d28b5eda8ec0917a7e1796d3aa193

SHA1
5604a535bf3e5492b9bf3ade78ca7d463a4bfdb2

SHA256
dfaf6313fd293f6013f58fb6790fd38ca2f04931403267b7a6aef7bfa81d50bb

SHA512
51b5bec82ff9ffb45fee5c9dd1d51559c351253489ea83a66e290459975d8ca899cde4f3bb5afbaa7a3f0b169f87a7514d8df88baaeec5bd72d190fd6d3e041b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1386433ecc349475d39fb1e4f9e149a0

SHA1
f04f71ac77cb30f1d04fd16d42852322a8b2680f

SHA256
a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc

SHA512
fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
384B

MD5
0355d61dd69bd337ad0917cd1eaa7bf0

SHA1
d2ca3b5ee15912d6d2adb7702278add23d8a2335

SHA256
b96a872ddc812886aa079a35883ae7e29066072009036afa4c05d54dd34c64b5

SHA512
abbb4a44ebb8ee9a52f1c05047a8c86ef41bab0c8ceac97b82d727d2597d18186efc6a496694914bf4f17ce370394911144bce124ee73b69a770d1e51f833fb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
770B

MD5
0ae3dd2e9400c06e160b916ad3599966

SHA1
4241e2baeae97568fdd0251e56e50c6145766d97

SHA256
2003128141bbc13ded8f2caa3406f65217af6f7c1ee967609a29f6fee20ab75a

SHA512
d3eafd83347a79709a4bd915b40eca18cb9fb1d08b5a4131a57031bd62b87307f99cc12440efd4983e30f5b11c47b2dc627077cc77f546351bd78ca4322deabc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
afe40ed4f07b0855f4109b6299a23188

SHA1
4811f9d53b71f02fd59ec53bbaa90f1260f1e30a

SHA256
9a5729cd24325c1aa957a55649ca483565adc53cd651ffbbb4412dedd0673514

SHA512
9c32a2e1482d0f23cbe3e01555eedb3b3019ca9efd1a828cbb989cc8576351b58ed6de430a264251da75fe6b7f463e2765f188c8ec0fb9833a9279d5d0f218c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
c893adc41f7bcb1a6c5a960db9182ee7

SHA1
4b6b3f743c4e535610c96ebea80857c927505e5c

SHA256
cdc29a582a96d16c7e2c57c4da0f54749418599f742891038d1971cf897d58c0

SHA512
d89fb264411929c6356f0ae7f788fcdb3a4870dc7b84f55ef968e93bc70907399f2a203b9f8b9ab152e80fd3c720ad1fb638562c6e9ab53e4093c9ba9dc9324f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
468e2a6e84a6e59fd3198d6f21b61d70

SHA1
8064407abbbe27b7a23ec9ae24a2f7307ffc8322

SHA256
d61ff5b969692701f648dfecc9aaa3d4678e8de19531a5e82a795f95b0655a89

SHA512
49932d898a9044b972544343775dd31da65452078debf7cdfbb1812f0a56016608c2748050d0db90f5fc35cff75f2509757a198d60503a4a55765c8da3783837

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
540B

MD5
78c33bbf2f89ae03b1d2357a24fccde2

SHA1
dade811d73291dde76cac34ed33123e04780a0a2

SHA256
cbdb01d72c57a0cf8bf63b5e82af2da99732c7518e93f5f4654c72b0eae8c1ad

SHA512
efb327db2d2ef54932fc38de5b198949305c728cb7375773401ff5b3a199e8a5c3d6bf44168699dc64e19948342bea9c88607781d47378a2d4a5d0ab18f32fe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
540B

MD5
a4fa403fa9a14f46c2b354863a9354c4

SHA1
de08e0995ff20e992dab615295b4d58a74ff8575

SHA256
745ca534cca1aed60b49b14668d1be7bc758a22fb78449ef5c929697a8f55a8c

SHA512
545121ccc51b3fb4ba8fb83bfebb025014dc219412d13de655d1dff753d1d87329a1c9a6bc48838ff2b8c8509bee6a51b4ff5245140a1b4544835218482ad2b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
540B

MD5
7f1594dcb96b346b487ebd3ba0e63ee2

SHA1
bbda33dd9720a729c526653bf21bc6de57d46fac

SHA256
40cfb9e19eb73221c36ee6db9cbcdee808b873a852899bb3a0e58b2e40e7139e

SHA512
d088f108a970e162df7363ebd75ad08056ba5fbe0ba67e837eeeb6529c34bd6198e942ef9fd0e8de81c418abb23124c8787db0a92b3ebf967f6a52b1087c5922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
540B

MD5
9ab71df4de1f5443f5cf2220cc6a25a5

SHA1
f7e5646eff178f168952f02c9e79086fff94ff7c

SHA256
efae92f310c20b42d3b432fc2cdefe31521e130d90bd83efa89360e20635e8f9

SHA512
87a0bf368905bccc36f409a255c31259ad4b76005d2e95bd7b46d92cabe1ba8411c8e8425b00e411674a551c281d07e13c79b95058c2abedc9bb23ffa87138d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
540B

MD5
f4d2c93e91470c9362f76ccc5c872c7f

SHA1
a20d7fcc7b769cd3bc5e732cac0b3711bdcfcae3

SHA256
e94abb5890f41c077beeb60b9f01f13f0e3b4fb89ac06470b72ccdae46e9339e

SHA512
163ad18de625a95648588ae3e57d868a15f6fcf2e5742afa138beb3b01e3c0e569c6f07047567da67edcd0e8cfad5ab6de3de52e6f7d765000a9178b8e194135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
372B

MD5
43ad097a5c4d541a0a264a5d87a42d19

SHA1
18cedd045e36191b63e9005415520d743e075dca

SHA256
0f8f7021c6a34147779b2521651714aa81440da7aadb11b5a022ac4c25cbb396

SHA512
f18d500ea08736fe951016a7d2428413cf46ecaf9cc34047eb8d3f734034b2bb2d169c773b5a53d0d2ca13f3f46ac464013aeb3e293edb1733538b2af51458c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
540B

MD5
a0b620401426d29b776daae4ede6d48b

SHA1
18b86d8ad208c852abc8271c6865dbe4a2cbda99

SHA256
118873f7ad25f93c1e4da3da616d7b1bff31b762009dfde7a701566251eacf60

SHA512
4972b10e48bf7d112e6da24dffb49bed522462926048d4000d527702ddcfdd34588d8e5437d45a47654881db2dafc29dc357f6aeb34bb5767d63cc9712054af8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
540B

MD5
3cdf41e7cba76ab1bf4d20a3897da44b

SHA1
818ffb40ed0266e11644a3c402afea1c6ada5017

SHA256
d844e4f4b78757d705c7072372f91ab201343f7568d4f7011467d56972ca2e38

SHA512
90652d823ba904a9e2cd6c8cabfd8918bdf8da3ea32ce13dfc1269d2514e9d4e200aabb90d016756c3e67704c224f2a289a160cc62e91a051de32558986b6176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c18b.TMP
Filesize
372B

MD5
ebc510b9e25634c8a2ef1ff4e0c38178

SHA1
31c9aca3bf3400eb04273468092b8fe103f96d3e

SHA256
cb4d778fccd305555ab0ec16a9438ffa8ee0d44f21c597938e64e815c59f5970

SHA512
6d15793008caa69832933f04058fb428a9127e129856c22b23eeb907175b080827ba73782053c0b9c51516aba3869f28f1d349180c563d1b8a8af239f4ee1b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
28971660a1469c1e1c9166c8d2756a97

SHA1
b210c5d95f5c01415bc183885b7f693cddab82f2

SHA256
128c7e3f51a350abf659624ea32a920086584b5859882ba174fbdf50e7691d38

SHA512
68a59c0e75f552a701ba303a9724d276fe6d358acfcf4d019f96be8eafe56238d8fc49691a3b98673239303db61138ab91f958f630b4ab1234dc757d6dcfc0a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
05cdd0591fb72083ddcdd07395290bb7

SHA1
024d2dc4527957ff26d6a31f8fb89c8dde17ed74

SHA256
e80f339fb709a7bd19f7c234517b36a77b8dc35711733fcc07ccfa8da0ad6e63

SHA512
7845a41d0d870946a8abb979c103eee950464a334df799637534b65c03f9f2de26888e31eb075eb2560779e1023e39bbe7acd3f17c1246d8d06806e1d7df1465

Download Submit
\??\pipe\LOCAL\crashpad_3924_TWRETMEXAGTLMXPQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2380-4-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/2380-8-0x0000000005100000-0x0000000005112000-memory.dmp

Filesize
72KB

Download
memory/2380-46-0x0000000074F60000-0x0000000075710000-memory.dmp

Filesize
7.7MB

Download
memory/2380-11-0x0000000005B10000-0x0000000005B76000-memory.dmp

Filesize
408KB

Download
memory/2380-1-0x0000000074F60000-0x0000000075710000-memory.dmp

Filesize
7.7MB

Download
memory/2380-3-0x0000000004E60000-0x0000000004EF2000-memory.dmp

Filesize
584KB

Download
memory/2380-10-0x00000000052E0000-0x000000000532C000-memory.dmp

Filesize
304KB

Download
memory/2380-2-0x00000000054C0000-0x0000000005A64000-memory.dmp

Filesize
5.6MB

Download
memory/2380-6-0x0000000006090000-0x00000000066A8000-memory.dmp

Filesize
6.1MB

Download
memory/2380-0-0x0000000000410000-0x0000000000464000-memory.dmp

Filesize
336KB

Download
memory/2380-7-0x00000000051D0000-0x00000000052DA000-memory.dmp

Filesize
1.0MB

Download
memory/2380-12-0x0000000006900000-0x0000000006950000-memory.dmp

Filesize
320KB

Download
memory/2380-5-0x0000000005020000-0x000000000502A000-memory.dmp

Filesize
40KB

Download
memory/2380-9-0x0000000005160000-0x000000000519C000-memory.dmp

Filesize
240KB

Download