redline | hxxps://torontohack[.]fun/

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://torontohack.fun/

Score

10^/10

redline zgrat discovery infostealer rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/5372-514-0x0000000000400000-0x000000000044A000-memory.dmp	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/5372-514-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3852 set thread context of 5372	3852	TORONTO.exe	137
PID 5888 set thread context of 4920	5888	TORONTO.exe	140
PID 1208 set thread context of 6128	1208	TORONTO.exe	143
PID 4940 set thread context of 2964	4940	TORONTO.exe	146

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2380	msedge.exe
2380	msedge.exe
660	msedge.exe
660	msedge.exe
2780	identity_helper.exe
2780	identity_helper.exe
5808	msedge.exe
5808	msedge.exe
5372	RegAsm.exe
5372	RegAsm.exe
5372	RegAsm.exe
4920	RegAsm.exe
6128	RegAsm.exe
2964	RegAsm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5372	RegAsm.exe
Token: SeDebugPrivilege	4920	RegAsm.exe
Token: SeDebugPrivilege	6128	RegAsm.exe
Token: SeDebugPrivilege	2964	RegAsm.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe
660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 3668	660	msedge.exe	81
PID 660 wrote to memory of 3668	660	msedge.exe	81
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2136	660	msedge.exe	83
PID 660 wrote to memory of 2380	660	msedge.exe	84
PID 660 wrote to memory of 2380	660	msedge.exe	84
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85
PID 660 wrote to memory of 4328	660	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://torontohack.fun/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ace946f8,0x7ff8ace94708,0x7ff8ace94718
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7880 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8056 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8164 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8312 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8444 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8796 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9220 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8672 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8300 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9628 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8448 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8428 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9500 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,5238378743031602704,7996373892598511032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5444

C:\Users\Admin\Downloads\TORONTO - BEST\TORONTO.exe
"C:\Users\Admin\Downloads\TORONTO - BEST\TORONTO.exe"
1⤵
- Suspicious use of SetThreadContext
PID:3852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5372

C:\Users\Admin\Downloads\TORONTO - BEST\TORONTO.exe
"C:\Users\Admin\Downloads\TORONTO - BEST\TORONTO.exe"
1⤵
- Suspicious use of SetThreadContext
PID:5888
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4920

C:\Users\Admin\Downloads\TORONTO - BEST\TORONTO.exe
"C:\Users\Admin\Downloads\TORONTO - BEST\TORONTO.exe"
1⤵
- Suspicious use of SetThreadContext
PID:1208
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6128

C:\Users\Admin\Downloads\TORONTO - BEST\TORONTO.exe
"C:\Users\Admin\Downloads\TORONTO - BEST\TORONTO.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Filesize
2KB

MD5
60ad21e008a8447fc1130a9c9c155148

SHA1
5dfa21d14dc33de3cc93a463688fe1d640b01730

SHA256
bb65e24fd8681e7af464e115fba42ff7713e933683cbd654a124c0e564530bb9

SHA512
42a2753f717a4984967907fa69200e8a464068a6d4a226803cf9503ffb7fee540ffc611b4c905cc84f3623639a6aa93003b390f9c38e601b59f171a9e90bd9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38a41fd7-bc64-4cc2-8e21-d242913367f9.tmp

Filesize
10KB

MD5
11e3bcd2f72d9ed11a21337761a192e5

SHA1
0407951d2ad8a1045f28390d0d82acb95ba0ab72

SHA256
5fc81d159794bca9acaee5801a8d60e5e5ca965c2a0c088af443631d6299651a

SHA512
46ac9ec91d403040520769485e1312a2fbe245c0d116650a4de93e4385c29fa09df42458635471c6acbdf83ca98056e8cdd3f93933f206fa567f8f1ffbb4b623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
bbb0ceac38af85a2d921863624dd11ae

SHA1
a467a8a45603621438b659def7c43085c66ac712

SHA256
bfac30199b9e4d356a307e1bef300339fe6d586dffe005166b6c1448485e16f2

SHA512
483d51097e1adc8eced52b3157f15f8e38b94b71a9ca22e9417237c31e5b7b334be049a59c5f3da31ad608baec76aa1e30fa56f3026a95549dfcd365f70375c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
32KB

MD5
b8c5a6827ed571828950dd5346c8e901

SHA1
308a6645340d629d70e24b246012c3c3af997b41

SHA256
ccc8a20b547aadfd6459a1f0029e84243f2665a80a970d4536a681a9ddcc8485

SHA512
4f144ca8acc602c9886ec9773c12dd7e844577f647866a9e35cac73476540d322c3d336787bdd66c1cdf4eca30432c6c2fcd4095e0c93fc8dc4241d0394b7c67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9f02354c76da42b2fa26f9ee990ce3e1

SHA1
a8b278354c66b336d9b36a732019e691c478f52c

SHA256
d074d117f174c675fa636f8be2daa1a7e9af38799cf5c4c67925b329333f233f

SHA512
30967e8baaab7ce221462e58ddef7124b02276af1e6fca829c924ab6bcc2b85887722faffbe5f175f05943f3d7de6e9b702c7d49fb70657981123ae7aa776ed9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
828e34558f275810e7b2b27ba73343ad

SHA1
0d8425e84750e122adf28ce8b799092853b6e6e2

SHA256
6675fe21c40e4ee61258a243e956dd71ba28cee904107af0dd350fd8bfb2d09c

SHA512
bd8ab843469ca0c13c17f5e6ee000b2fbd9d8909371b414ea2e86278c40ba7d5e771360b37ee124ca60fc4cda1b3ea6ca303661e70ec4f39327065bafdbcd311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
600f6798f4cff7934daac57f282b8b4a

SHA1
c7502726f59a0459d342e7103c90906a50b1a902

SHA256
ba398fbfd5d70759f1332feb1dbc2d5676468ab0662768c84082ae501e3fb708

SHA512
c79ca8280bd989a3e32c38a0ecbb7245e407da58cc4ecc63b14bc59b0b59393d5af47f3aec1d0b67723bd8f3d3e45e550152fda34f355b3deee1803fbb945020

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
0f7e4123e70d119e4962f8584cc0b362

SHA1
80643952c0d3cde3e69fefc0237e333b2e0d50ee

SHA256
7e65e975f1be4dcc3b283576e7fd50070771e106cc7856a68cd754d06397d89f

SHA512
561302ca3318e2479840bd49034993eb5b9cd2756867787d9aff56f5d971046e89a7f2a6e624bb6bdf9509518c8bbc8d7d087f67bed726852f79e5ae46d44d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5e2c7166345765865b63d919591d476f

SHA1
0e330e41a056d2253a564c5a0b9e52869d9a83ee

SHA256
329c815f296c9cc18abe9bb1023d4b42115e1dbf403b3ac01b23da7c86e13e31

SHA512
174d151ec0f5c8b6f4a9a3924ab8184f44606884cce2245230d30cfe78d34db31d370164a4c16f7a180f6f604820699f98bdb75dc6af5c21c68fe3921283d4c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
91b95239b3de9c7878ae8cae347ef5f3

SHA1
8e287846c5ab173aeb5a9665e5180e2913ba9bb0

SHA256
cab8c3496a7ea57535d4e5c78a0e0776a99556c721ddbc6e86868c0346dd5df5

SHA512
09401263d6da6827932fa3d8ff3f15f5f978ac3ef2e7545e2d527687763d32bc8f84cb5a950de3fabba186900caa45023c56b5cf37d5d05fe12b542befb562a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a18f.TMP

Filesize
1KB

MD5
7434e4ec29a48b743507f066ec365e3a

SHA1
8f919fa80a978408cf3986bebc946144741f5963

SHA256
d6376d5d23904920e2bed6f7ac668daab1cb79d6644969fdfd1a3a97c061721f

SHA512
eca6a51cac930d9a3b18834a8ee0d9f5cfbf3fa405c192908ec9b9a1e6670f5f07f6008d386c6240aaf87f9ce44d000cbf9095f986f1fc44f720c7a16e17b364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b9e0cd37bdfc4647c883bd79d8715e06

SHA1
144344a8aed2162199e866c0633d18e46c4899d7

SHA256
5d917c500dcf429615ad41a4e15c48c606c2f38a3b1b8489e4579a0d004f4762

SHA512
faff8574803730af116eb50e24d0b06dcaa0244006417520c457c70f0f773b89fd97cf1892b0a9776587bd5af0a458282c495446873c503dea136f3e9e049423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8a19759f5782803c5edaca4f008c9297

SHA1
3ef8ae296308a9345a0c71a56d01add045aa2541

SHA256
79a6192cbc3be7824640076b39468228325109567290c910012e4e91c7b243f1

SHA512
1300fa807d997234c809cbe56e31ea6fd4b75ef8c0e8aaef6765f9f3b8f0b7279d3e7aab9340629a4516b2d4a93d46cd1c13648900b2bcea6a810b4953332d9b

Download Submit
memory/1208-532-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/3852-515-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/3852-513-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/4940-539-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/5372-516-0x00000000056A0000-0x0000000005C44000-memory.dmp

Filesize
5.6MB

Download
memory/5372-526-0x0000000006400000-0x000000000641E000-memory.dmp

Filesize
120KB

Download
memory/5372-521-0x0000000006140000-0x0000000006152000-memory.dmp

Filesize
72KB

Download
memory/5372-522-0x00000000061A0000-0x00000000061DC000-memory.dmp

Filesize
240KB

Download
memory/5372-523-0x0000000006320000-0x000000000636C000-memory.dmp

Filesize
304KB

Download
memory/5372-524-0x00000000064A0000-0x0000000006506000-memory.dmp

Filesize
408KB

Download
memory/5372-525-0x0000000006E60000-0x0000000006ED6000-memory.dmp

Filesize
472KB

Download
memory/5372-520-0x0000000006210000-0x000000000631A000-memory.dmp

Filesize
1.0MB

Download
memory/5372-514-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5372-519-0x00000000066C0000-0x0000000006CD8000-memory.dmp

Filesize
6.1MB

Download
memory/5372-534-0x0000000008070000-0x000000000859C000-memory.dmp

Filesize
5.2MB

Download
memory/5372-533-0x0000000007970000-0x0000000007B32000-memory.dmp

Filesize
1.8MB

Download
memory/5372-518-0x0000000005090000-0x000000000509A000-memory.dmp

Filesize
40KB

Download
memory/5372-517-0x00000000050F0000-0x0000000005182000-memory.dmp

Filesize
584KB

Download
memory/5888-529-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download