redline | hxxps://download1590[.]mediafire[.]com/sheeyik5qnxgFATiMW6hy6lgYDpo9THM2yuPjv6HEG7sgS0ZvbRvQ28GmYxs84-GzINyW31R9YrQPTR-IgJwKOL55j_VhHK2U0MCHYsVBQdHsMbZY4rzyuGGwfpmsEbETTQZENHRVa6Kr4ZvFeRESj4HaofyeHbbjC7eE9Wp8Two/dlj95wyrxyg831o/Adobe+Activator[.]zip

Analysis

max time kernel
619s
max time network
623s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://download1590.mediafire.com/sheeyik5qnxgFATiMW6hy6lgYDpo9THM2yuPjv6HEG7sgS0ZvbRvQ28GmYxs84-GzINyW31R9YrQPTR-IgJwKOL55j_VhHK2U0MCHYsVBQdHsMbZY4rzyuGGwfpmsEbETTQZENHRVa6Kr4ZvFeRESj4HaofyeHbbjC7eE9Wp8Two/dlj95wyrxyg831o/Adobe+Activator.zip

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1516-108-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 6 IoCs

Processes:

Adobe Activator.exeAdobe Activator.exeAdobe Activator.exeAdobe Activator.exeAdobe Activator.exeAdobe Activator.exe

description	pid	process	target process
PID 2196 set thread context of 1516	2196	Adobe Activator.exe	RegAsm.exe
PID 2824 set thread context of 2904	2824	Adobe Activator.exe	RegAsm.exe
PID 5084 set thread context of 2576	5084	Adobe Activator.exe	RegAsm.exe
PID 884 set thread context of 3628	884	Adobe Activator.exe	RegAsm.exe
PID 1324 set thread context of 4136	1324	Adobe Activator.exe	RegAsm.exe
PID 4340 set thread context of 2772	4340	Adobe Activator.exe	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133611508993198470"	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{DF4D75A9-9DFE-4ED5-BC09-8E1A55784D67}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

RegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exe

pid	process
1516	RegAsm.exe
1516	RegAsm.exe
1516	RegAsm.exe
1516	RegAsm.exe
1516	RegAsm.exe
1516	RegAsm.exe
1516	RegAsm.exe
1516	RegAsm.exe
1516	RegAsm.exe
1516	RegAsm.exe
1516	RegAsm.exe
2904	RegAsm.exe
2576	RegAsm.exe
3628	RegAsm.exe
4136	RegAsm.exe
2772	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

RegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1516	RegAsm.exe
Token: SeDebugPrivilege	2904	RegAsm.exe
Token: SeDebugPrivilege	2576	RegAsm.exe
Token: SeDebugPrivilege	3628	RegAsm.exe
Token: SeDebugPrivilege	4136	RegAsm.exe
Token: SeDebugPrivilege	2772	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1676 wrote to memory of 1600	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 1600	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4100	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4916	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 4916	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 3988	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 3988	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 3988	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 3988	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 3988	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 3988	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 3988	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 3988	1676	msedge.exe	msedge.exe
PID 1676 wrote to memory of 3988	1676	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download1590.mediafire.com/sheeyik5qnxgFATiMW6hy6lgYDpo9THM2yuPjv6HEG7sgS0ZvbRvQ28GmYxs84-GzINyW31R9YrQPTR-IgJwKOL55j_VhHK2U0MCHYsVBQdHsMbZY4rzyuGGwfpmsEbETTQZENHRVa6Kr4ZvFeRESj4HaofyeHbbjC7eE9Wp8Two/dlj95wyrxyg831o/Adobe+Activator.zip
1⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4052,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
1⤵
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3876,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
1⤵
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5260,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
1⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5412,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
1⤵
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5440,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
1⤵
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --field-trial-handle=5028,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
1⤵
PID:2880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6100,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
1⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=6508,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
1⤵
PID:3816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6052,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
1⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=6788,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
1⤵
PID:372

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x324 0x33c
1⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=6484,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
1⤵
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=4480,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
1⤵
PID:616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=6080,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
1⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5924,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:8
1⤵
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6024,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8
1⤵
PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5768,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
1⤵
PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --field-trial-handle=6992,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
1⤵
PID:2080

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff3a18ceb8,0x7fff3a18cec4,0x7fff3a18ced0
2⤵
PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2872,i,9660299743930297397,13082453829417311240,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:2
2⤵
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1928,i,9660299743930297397,13082453829417311240,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:3
2⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,9660299743930297397,13082453829417311240,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:8
2⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4408,i,9660299743930297397,13082453829417311240,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
2⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4408,i,9660299743930297397,13082453829417311240,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
2⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=980,i,9660299743930297397,13082453829417311240,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:8
2⤵
PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4452,i,9660299743930297397,13082453829417311240,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:8
2⤵
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4736,i,9660299743930297397,13082453829417311240,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:8
2⤵
PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
1⤵
PID:3584

C:\Users\Admin\AppData\Local\Temp\Temp1_Adobe Activator.zip\Adobe Activator\Adobe Activator.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Adobe Activator.zip\Adobe Activator\Adobe Activator.exe"
1⤵
- Suspicious use of SetThreadContext
PID:2196

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Users\Admin\Downloads\Adobe Activator\Adobe Activator\Adobe Activator.exe
"C:\Users\Admin\Downloads\Adobe Activator\Adobe Activator\Adobe Activator.exe"
1⤵
- Suspicious use of SetThreadContext
PID:2824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904

C:\Users\Admin\Downloads\Adobe Activator\Adobe Activator\Adobe Activator.exe
"C:\Users\Admin\Downloads\Adobe Activator\Adobe Activator\Adobe Activator.exe"
1⤵
- Suspicious use of SetThreadContext
PID:5084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Users\Admin\Downloads\Adobe Activator\Adobe Activator\Adobe Activator.exe
"C:\Users\Admin\Downloads\Adobe Activator\Adobe Activator\Adobe Activator.exe"
1⤵
- Suspicious use of SetThreadContext
PID:884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3628

C:\Users\Admin\Downloads\Adobe Activator\Adobe Activator\Adobe Activator.exe
"C:\Users\Admin\Downloads\Adobe Activator\Adobe Activator\Adobe Activator.exe"
1⤵
- Suspicious use of SetThreadContext
PID:1324

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Users\Admin\Downloads\Adobe Activator\Adobe Activator\Adobe Activator.exe
"C:\Users\Admin\Downloads\Adobe Activator\Adobe Activator\Adobe Activator.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Filesize
2KB

MD5
60ad21e008a8447fc1130a9c9c155148

SHA1
5dfa21d14dc33de3cc93a463688fe1d640b01730

SHA256
bb65e24fd8681e7af464e115fba42ff7713e933683cbd654a124c0e564530bb9

SHA512
42a2753f717a4984967907fa69200e8a464068a6d4a226803cf9503ffb7fee540ffc611b4c905cc84f3623639a6aa93003b390f9c38e601b59f171a9e90bd9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
11KB

MD5
d2cb2840c212e23b8ed9c3f452995ac8

SHA1
bb0f61eacae5219f7583d9ded695ef1c378dd499

SHA256
2a73080561b261af175a6ce4e7552abb1b86d2015ae52d1dd922b3f65b1ce308

SHA512
920f043bcd773c11b9a22f0a4a352ee46af752a7c4ef11283b702f903dbfe509a823ea15b9d3bca3d51d129b3239ebff7fe853997792077fd29cda2e1a753dad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
30KB

MD5
0e8e51dbdaa5900d49f19947abed3871

SHA1
0e4fe5a99bc02717f4d9c576fc1a6735e999cd3f

SHA256
e5ef3bee8ef62c6bc1fd8297763d2c2814a0de1e846767da656c658df11f5f3f

SHA512
5b8e749e96a5ee13aab958843b861280d0b36cb2c9951030069c6d70d3629e0a5039331d4004bf134f68732d9fa1999ff4b7e879f813b94881c3a476feb5bbee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
74KB

MD5
b23f5788dbf3644b3d65c848b5c25372

SHA1
13e03b268e73c532a72ad0ba50cbbc4cf7eb4e5b

SHA256
d12c0ec848fad03b1757fa5027d4934e0530c4ae22ac19a5eed402d591287644

SHA512
1dd874bc4495c503c4c430b53e6757b320fdcc15feac064d03b3ee93822a5a255214a09d355b1b629f7764d0822ed543478be5d1ab0ad0f85f046474d51f6dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
74KB

MD5
78891f8959b840d85c42197a8b9cfe2e

SHA1
5f1498307d7a420928462a79fa295550e326ce49

SHA256
82c1a9632d3b90e6ef105d5976b0c702b3ac1019a01db94deb3f48de46dcf32b

SHA512
48aec78983cb1ab7c58a349fed732cc4188abc4eb3ca9ba00e34fbc0a09297a54f7b1c3a5b8fb3d3d48eece67b11ad3cd73f1fea742d76fa0e46af5dfbe35d2e

Download Submit
\??\pipe\crashpad_1676_CNVQBWCMAQOVPRWN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/884-134-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1324-137-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/1516-113-0x0000000006D00000-0x0000000007318000-memory.dmp

Filesize
6.1MB

Download
memory/1516-119-0x0000000007420000-0x0000000007496000-memory.dmp

Filesize
472KB

Download
memory/1516-112-0x0000000005830000-0x000000000583A000-memory.dmp

Filesize
40KB

Download
memory/1516-110-0x0000000005CE0000-0x0000000006284000-memory.dmp

Filesize
5.6MB

Download
memory/1516-114-0x0000000006830000-0x000000000693A000-memory.dmp

Filesize
1.0MB

Download
memory/1516-115-0x0000000006750000-0x0000000006762000-memory.dmp

Filesize
72KB

Download
memory/1516-116-0x00000000067B0000-0x00000000067EC000-memory.dmp

Filesize
240KB

Download
memory/1516-117-0x0000000006940000-0x000000000698C000-memory.dmp

Filesize
304KB

Download
memory/1516-118-0x0000000006AB0000-0x0000000006B16000-memory.dmp

Filesize
408KB

Download
memory/1516-111-0x0000000005680000-0x0000000005712000-memory.dmp

Filesize
584KB

Download
memory/1516-120-0x0000000006C80000-0x0000000006C9E000-memory.dmp

Filesize
120KB

Download
memory/1516-121-0x00000000086B0000-0x0000000008872000-memory.dmp

Filesize
1.8MB

Download
memory/1516-122-0x0000000009380000-0x00000000098AC000-memory.dmp

Filesize
5.2MB

Download
memory/1516-108-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2196-109-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/2196-107-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/2824-127-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/4340-140-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/5084-131-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download