dcrat | hxxps://github[.]com/RZM-CRACK-TEAM/RedLine-CRACK?tab=readme-ov-file

System Information Discovery

Processes:

panel.exePanel.exemssurrogateProvider_protected.exePanel.exePanel.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation	panel.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation	Panel.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation	mssurrogateProvider_protected.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation	Panel.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation	Panel.exe

Executes dropped EXE 25 IoCs

Processes:

Kurome.Loader.exeKurome.Host.exepanel.exemssurrogateProvider_protected.exePanel.exePanel.exeSystem.exePanel.exePanel.exeKurome.Builder.exebuild.exebuild.exebuild.exeKurome.Builder.exeKurome.Host.execsrss.exemsedge.exedllhost.exeKurome.Loader.exedwm.exeSearchApp.exeKurome.Host.exeSystem.execsrss.exeTextInputHost.exe

pid	process
3136	Kurome.Loader.exe
1912	Kurome.Host.exe
5212	panel.exe
5556	mssurrogateProvider_protected.exe
5620	Panel.exe
6044	Panel.exe
5752	System.exe
5912	Panel.exe
5492	Panel.exe
1440	Kurome.Builder.exe
2740	build.exe
5700	build.exe
4224	build.exe
116	Kurome.Builder.exe
4784	Kurome.Host.exe
2512	csrss.exe
4888	msedge.exe
2120	dllhost.exe
4872	Kurome.Loader.exe
2432	dwm.exe
2508	SearchApp.exe
5528	Kurome.Host.exe
432	System.exe
6132	csrss.exe
3696	TextInputHost.exe

Loads dropped DLL 64 IoCs

Processes:

Kurome.Host.exemssurrogateProvider_protected.exeSystem.exeKurome.Builder.exebuild.exebuild.exebuild.exeKurome.Builder.exeKurome.Host.execsrss.exedllhost.exemsedge.exeKurome.Loader.exedwm.exeSearchApp.exe

pid	process
1912	Kurome.Host.exe
1912	Kurome.Host.exe
1912	Kurome.Host.exe
1912	Kurome.Host.exe
1912	Kurome.Host.exe
1912	Kurome.Host.exe
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5752	System.exe
5752	System.exe
5752	System.exe
5752	System.exe
1440	Kurome.Builder.exe
1440	Kurome.Builder.exe
1440	Kurome.Builder.exe
1440	Kurome.Builder.exe
1440	Kurome.Builder.exe
1440	Kurome.Builder.exe
2740	build.exe
2740	build.exe
2740	build.exe
2740	build.exe
5700	build.exe
5700	build.exe
5700	build.exe
5700	build.exe
4224	build.exe
4224	build.exe
4224	build.exe
4224	build.exe
116	Kurome.Builder.exe
116	Kurome.Builder.exe
116	Kurome.Builder.exe
116	Kurome.Builder.exe
116	Kurome.Builder.exe
116	Kurome.Builder.exe
4784	Kurome.Host.exe
4784	Kurome.Host.exe
4784	Kurome.Host.exe
4784	Kurome.Host.exe
2512	csrss.exe
2512	csrss.exe
2512	csrss.exe
2512	csrss.exe
2120	dllhost.exe
2120	dllhost.exe
2120	dllhost.exe
2120	dllhost.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4872	Kurome.Loader.exe
4872	Kurome.Loader.exe
4872	Kurome.Loader.exe
4872	Kurome.Loader.exe
2432	dwm.exe
2432	dwm.exe
2432	dwm.exe
2432	dwm.exe
2508	SearchApp.exe
2508	SearchApp.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

44 raw.githubusercontent.com
45 raw.githubusercontent.com

flow	ioc
44	raw.githubusercontent.com
45	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

mssurrogateProvider_protected.exePanel.exePanel.exeSystem.exePanel.exe

pid	process
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
5752	System.exe
5752	System.exe
5912	Panel.exe

Drops file in Program Files directory 11 IoCs

Processes:

mssurrogateProvider_protected.exe

description	ioc	process
File created	C:\Program Files (x86)\Google\CrashReports\27d1bcfc3c54e0	mssurrogateProvider_protected.exe
File created	C:\Program Files\Windows Portable Devices\886983d96e3d3e	mssurrogateProvider_protected.exe
File created	C:\Program Files\Windows Multimedia Platform\dllhost.exe	mssurrogateProvider_protected.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe	mssurrogateProvider_protected.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\65be3b505478f7	mssurrogateProvider_protected.exe
File created	C:\Program Files (x86)\Google\CrashReports\System.exe	mssurrogateProvider_protected.exe
File created	C:\Program Files\Windows Portable Devices\csrss.exe	mssurrogateProvider_protected.exe
File created	C:\Program Files\Windows Multimedia Platform\5940a34987c991	mssurrogateProvider_protected.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe	mssurrogateProvider_protected.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\SearchApp.exe	mssurrogateProvider_protected.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\38384e6a620884	mssurrogateProvider_protected.exe

Drops file in Windows directory 8 IoCs

Processes:

mssurrogateProvider_protected.exeKurome.Loader.exe

description	ioc	process
File created	C:\Windows\twain_32\38384e6a620884	mssurrogateProvider_protected.exe
File created	C:\Windows\es-ES\sihost.exe	mssurrogateProvider_protected.exe
File created	C:\Windows\es-ES\66fc9ff0ee96c2	mssurrogateProvider_protected.exe
File created	C:\Windows\LanguageOverlayCache\conhost.exe	mssurrogateProvider_protected.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe	mssurrogateProvider_protected.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\61a52ddc9dd915	mssurrogateProvider_protected.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll	Kurome.Loader.exe
File created	C:\Windows\twain_32\SearchApp.exe	mssurrogateProvider_protected.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WINWORD.EXEWINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

Processes:

WINWORD.EXEWINWORD.EXEmsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

3524 ipconfig.exe

pid	process
3524	ipconfig.exe

Modifies registry class 64 IoCs

Processes:

Panel.exepanel.exemsedge.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000020000000300000000000000ffffffff	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000048be5f772fceda0131581f7b2fceda013868167d2fceda0114000000	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000000000000300000002000000ffffffff	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Panel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202020202020202	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 = 5000310000000000e558375d10004c6f63616c003c0009000400efbee458cc83e558485d2e00000091e10100000001000000000000000000000000000000544e64004c006f00630061006c00000014000000	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\SniffedFolderType = "Generic"	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Panel.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2480455240-981575606-1030659066-1000\{D65546D6-967F-4070-893D-04455D6FBAF8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 7800310000000000e458cc831100557365727300640009000400efbe874f7748e558e85c2e000000c70500000000010000000000000000003a0000000000d5f30e0155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\MRUListEx = 00000000ffffffff	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "17"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = 00000000ffffffff	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 = 5600310000000000e458cc8312004170704461746100400009000400efbee458cc83e558e85c2e0000007ee1010000000100000000000000000000000000000013e1fb004100700070004400610074006100000016000000	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\MRUListEx = 00000000ffffffff	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0\NodeSlot = "12"	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\SniffedFolderType = "Generic"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Panel.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

pid	process
5816	schtasks.exe
868	schtasks.exe
1580	schtasks.exe
4500	schtasks.exe
5164	schtasks.exe
3768	schtasks.exe
1420	schtasks.exe
6036	schtasks.exe
1968	schtasks.exe
4592	schtasks.exe
5136	schtasks.exe
6140	schtasks.exe
1964	schtasks.exe
224	schtasks.exe
5860	schtasks.exe
5148	schtasks.exe
5196	schtasks.exe
2324	schtasks.exe
5476	schtasks.exe
6120	schtasks.exe
5276	schtasks.exe
4940	schtasks.exe
3796	schtasks.exe
432	schtasks.exe
5612	schtasks.exe
5224	schtasks.exe
3712	schtasks.exe
1796	schtasks.exe
4964	schtasks.exe
928	schtasks.exe
1104	schtasks.exe
4520	schtasks.exe
464	schtasks.exe
4416	schtasks.exe
4044	schtasks.exe
2400	schtasks.exe
3240	schtasks.exe
3488	schtasks.exe
5372	schtasks.exe
4484	schtasks.exe
1156	schtasks.exe
6084	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

Processes:

WINWORD.EXEWINWORD.EXE

pid process

3836 WINWORD.EXE
3836 WINWORD.EXE
3316 WINWORD.EXE
3316 WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemssurrogateProvider_protected.exePanel.exePanel.exeSystem.exemsedge.exe

pid	process
1452	msedge.exe
1452	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2416	identity_helper.exe
2416	identity_helper.exe
3340	msedge.exe
3340	msedge.exe
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5620	Panel.exe
5620	Panel.exe
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5556	mssurrogateProvider_protected.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
5620	Panel.exe
6044	Panel.exe
6044	Panel.exe
5620	Panel.exe
6044	Panel.exe
6044	Panel.exe
5620	Panel.exe
6044	Panel.exe
6044	Panel.exe
6044	Panel.exe
5620	Panel.exe
6044	Panel.exe
5620	Panel.exe
5752	System.exe
5752	System.exe
6044	Panel.exe
5620	Panel.exe
5620	Panel.exe
6044	Panel.exe
5620	Panel.exe
6044	Panel.exe
6044	Panel.exe
5620	Panel.exe
6044	Panel.exe
5620	Panel.exe
6044	Panel.exe
5620	Panel.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
5140	msedge.exe
6044	Panel.exe
5620	Panel.exe
6044	Panel.exe
5620	Panel.exe
6044	Panel.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Panel.exe

pid process

5492 Panel.exe

pid	process
5492	Panel.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

Processes:

msedge.exe

pid	process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zG.exeKurome.Loader.exeKurome.Host.exemssurrogateProvider_protected.exePanel.exePanel.exeSystem.exePanel.exePanel.exe

description	pid	process
Token: SeRestorePrivilege	1244	7zG.exe
Token: 35	1244	7zG.exe
Token: SeSecurityPrivilege	1244	7zG.exe
Token: SeSecurityPrivilege	1244	7zG.exe
Token: SeDebugPrivilege	3136	Kurome.Loader.exe
Token: SeDebugPrivilege	1912	Kurome.Host.exe
Token: SeDebugPrivilege	5556	mssurrogateProvider_protected.exe
Token: SeDebugPrivilege	5620	Panel.exe
Token: SeDebugPrivilege	6044	Panel.exe
Token: SeDebugPrivilege	5752	System.exe
Token: 33	6044	Panel.exe
Token: SeIncBasePriorityPrivilege	6044	Panel.exe
Token: 33	6044	Panel.exe
Token: SeIncBasePriorityPrivilege	6044	Panel.exe
Token: 33	6044	Panel.exe
Token: SeIncBasePriorityPrivilege	6044	Panel.exe
Token: 33	6044	Panel.exe
Token: SeIncBasePriorityPrivilege	6044	Panel.exe
Token: 33	6044	Panel.exe
Token: SeIncBasePriorityPrivilege	6044	Panel.exe
Token: 33	6044	Panel.exe
Token: SeIncBasePriorityPrivilege	6044	Panel.exe
Token: 33	6044	Panel.exe
Token: SeIncBasePriorityPrivilege	6044	Panel.exe
Token: 33	6044	Panel.exe
Token: SeIncBasePriorityPrivilege	6044	Panel.exe
Token: 33	6044	Panel.exe
Token: SeIncBasePriorityPrivilege	6044	Panel.exe
Token: 33	6044	Panel.exe
Token: SeIncBasePriorityPrivilege	6044	Panel.exe
Token: SeDebugPrivilege	5912	Panel.exe
Token: SeDebugPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe
Token: 33	5492	Panel.exe
Token: SeIncBasePriorityPrivilege	5492	Panel.exe

Suspicious use of FindShellTrayWindow 43 IoCs

Processes:

msedge.exe7zG.exePanel.exe

pid	process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
1244	7zG.exe
5492	Panel.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

msedge.exe

pid	process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of SetWindowsHookEx 37 IoCs

Processes:

WINWORD.EXEmssurrogateProvider_protected.exeSystem.exeKurome.Host.execsrss.exePanel.exemsedge.exeKurome.Loader.exedllhost.exedwm.exeSearchApp.exeKurome.Host.exeSystem.exeWINWORD.EXEcsrss.exeTextInputHost.exe

pid	process
3836	WINWORD.EXE
3836	WINWORD.EXE
3836	WINWORD.EXE
3836	WINWORD.EXE
3836	WINWORD.EXE
3836	WINWORD.EXE
3836	WINWORD.EXE
3836	WINWORD.EXE
5556	mssurrogateProvider_protected.exe
5752	System.exe
4784	Kurome.Host.exe
2512	csrss.exe
5492	Panel.exe
5492	Panel.exe
5492	Panel.exe
4888	msedge.exe
4872	Kurome.Loader.exe
2120	dllhost.exe
5492	Panel.exe
5492	Panel.exe
5492	Panel.exe
2432	dwm.exe
2508	SearchApp.exe
5528	Kurome.Host.exe
432	System.exe
3316	WINWORD.EXE
3316	WINWORD.EXE
3316	WINWORD.EXE
3316	WINWORD.EXE
3316	WINWORD.EXE
3316	WINWORD.EXE
3316	WINWORD.EXE
3316	WINWORD.EXE
3316	WINWORD.EXE
3316	WINWORD.EXE
6132	csrss.exe
3696	TextInputHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2904 wrote to memory of 3216	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3216	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5092	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1452	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1452	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5044	2904	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/RZM-CRACK-TEAM/RedLine-CRACK?tab=readme-ov-file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88e1446f8,0x7ff88e144708,0x7ff88e144718
2⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
2⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
2⤵
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
2⤵
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5028 /prefetch:8
2⤵
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
2⤵
PID:732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
2⤵
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
2⤵
PID:2172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
2⤵
PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
2⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3008 /prefetch:1
2⤵
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
2⤵
PID:6092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
2⤵
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
2⤵
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
2⤵
PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
2⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
2⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
2⤵
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
2⤵
PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
2⤵
PID:5580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
2⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1340 /prefetch:1
2⤵
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
2⤵
PID:2188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1840 /prefetch:8
2⤵
PID:5372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1344 /prefetch:8
2⤵
- Modifies registry class
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
2⤵
PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
2⤵
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
2⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5760 /prefetch:8
2⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
2⤵
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
2⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=printing.mojom.PrintCompositor --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=print_compositor --mojo-platform-channel-handle=6164 /prefetch:8
2⤵
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5500 /prefetch:6
2⤵
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
2⤵
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
2⤵
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
2⤵
PID:516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
2⤵
PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3240

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Redline-crack-by-rzt\" -ad -an -ai#7zMap5684:102:7zEvent10784
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1244

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\FAQ.txt
1⤵
PID:3740

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\FAQ (English).docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3836

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:5212

C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe
"C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5556

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ctqENoUWTa.bat"
3⤵
PID:4008

C:\Windows\SysWOW64\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
4⤵
PID:5224

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
5⤵
PID:856

C:\Program Files (x86)\Google\CrashReports\System.exe
"C:\Program Files (x86)\Google\CrashReports\System.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5752

C:\Users\Admin\AppData\Local\Temp\Panel.exe
"C:\Users\Admin\AppData\Local\Temp\Panel.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5620

C:\Users\Admin\AppData\Local\Temp\Panel.exe
"C:\Users\Admin\AppData\Local\Temp\Panel.exe" "--monitor"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6044

C:\Users\Admin\AppData\Local\Temp\Panel.exe
"C:\Users\Admin\AppData\Local\Temp\Panel.exe" "auth" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAYmMvkocoGUaSpLYbxX0+jwAAAAACAAAAAAAQZgAAAAEAACAAAABrirtW7G8nD8IWGy3JXTkcRzqTqaP/8O1xthyg0J43qgAAAAAOgAAAAAIAACAAAADIAotTjulWH/Kq7sn3DEom7FD/urUCnQtCe9f6UxhugRAAAAA9o0qVm8/v7Yo2FrFlLKFqQAAAAMsGEDWNmo9RXgc6smv6/ZqBCkzU8WewplKqMHomhXKwB7Zc68pV0v72+f03WtBnAgPCgDKWkCBCTeSIBLiCUaE=" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAYmMvkocoGUaSpLYbxX0+jwAAAAACAAAAAAAQZgAAAAEAACAAAADI4DXUHNAp1J85kHQW88qOk84xY80GEfEuAx4j0ST2iQAAAAAOgAAAAAIAACAAAAAexzEdXj9xoJtNuRUU5Lvj+9uULqrno1RCdaWlKNIMUhAAAABLG7Zg97vhGgfgs/H2j1UZQAAAAHPxyOVBIzo56p0n91z7zZSeKMIyoj7trTS9W2usSpA7v/pxvgefO8d5faDCH27sFb1WajudulYOafJpfLpG/Ck="
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:5912

C:\Users\Admin\AppData\Local\Temp\Panel.exe
"C:\Users\Admin\AppData\Local\Temp\Panel.exe" "auth" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAYmMvkocoGUaSpLYbxX0+jwAAAAACAAAAAAAQZgAAAAEAACAAAABrirtW7G8nD8IWGy3JXTkcRzqTqaP/8O1xthyg0J43qgAAAAAOgAAAAAIAACAAAADIAotTjulWH/Kq7sn3DEom7FD/urUCnQtCe9f6UxhugRAAAAA9o0qVm8/v7Yo2FrFlLKFqQAAAAMsGEDWNmo9RXgc6smv6/ZqBCkzU8WewplKqMHomhXKwB7Zc68pV0v72+f03WtBnAgPCgDKWkCBCTeSIBLiCUaE=" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAYmMvkocoGUaSpLYbxX0+jwAAAAACAAAAAAAQZgAAAAEAACAAAADI4DXUHNAp1J85kHQW88qOk84xY80GEfEuAx4j0ST2iQAAAAAOgAAAAAIAACAAAAAexzEdXj9xoJtNuRUU5Lvj+9uULqrno1RCdaWlKNIMUhAAAABLG7Zg97vhGgfgs/H2j1UZQAAAAHPxyOVBIzo56p0n91z7zZSeKMIyoj7trTS9W2usSpA7v/pxvgefO8d5faDCH27sFb1WajudulYOafJpfLpG/Ck=" "--monitor"
5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Kurome.HostK" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Kurome.Host" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Kurome.HostK" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Windows\twain_32\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\twain_32\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\twain_32\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Templates\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Templates\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Templates\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\es-ES\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Windows\es-ES\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Kurome.LoaderK" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\ssh\Kurome.Loader.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Kurome.Loader" /sc ONLOGON /tr "'C:\Users\All Users\ssh\Kurome.Loader.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Kurome.LoaderK" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\ssh\Kurome.Loader.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\CrashReports\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\CrashReports\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 9 /tr "'C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Templates\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5372

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5240

C:\Windows\system32\ipconfig.exe
ipconfig
2⤵
- Gathers network information
PID:3524

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5700

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4224

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:116

C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe
"C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4784

C:\Users\Admin\Templates\csrss.exe
C:\Users\Admin\Templates\csrss.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2512

C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe
C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4888

C:\Program Files\Windows Multimedia Platform\dllhost.exe
"C:\Program Files\Windows Multimedia Platform\dllhost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2120

C:\Users\All Users\ssh\Kurome.Loader.exe
"C:\Users\All Users\ssh\Kurome.Loader.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4872

C:\Users\Default User\dwm.exe
"C:\Users\Default User\dwm.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2432

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\ReadMe.txt
1⤵
PID:4440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5676

C:\Windows\twain_32\SearchApp.exe
C:\Windows\twain_32\SearchApp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2508

C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe
"C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5528

C:\Program Files (x86)\Google\CrashReports\System.exe
"C:\Program Files (x86)\Google\CrashReports\System.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:432

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\FAQ (English).docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3316

C:\Users\Admin\Templates\csrss.exe
C:\Users\Admin\Templates\csrss.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6132

C:\Users\Default User\TextInputHost.exe
"C:\Users\Default User\TextInputHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery