Malware Analysis Report

2024-09-11 09:46

Sample ID 240705-nsb4gszfja
Target https://github.com/RZM-CRACK-TEAM/RedLine-CRACK?tab=readme-ov-file
Tags
dcrat redline sectoprat cheat infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://github.com/RZM-CRACK-TEAM/RedLine-CRACK?tab=readme-ov-file was found to be: Known bad.

Malicious Activity Summary

dcrat redline sectoprat cheat infostealer rat trojan

RedLine

Process spawned unexpected child process

RedLine payload

SectopRAT payload

SectopRAT

DcRat

DCRat payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Uses Task Scheduler COM API

Enumerates system info in registry

Scheduled Task/Job: Scheduled Task

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Gathers network information

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Persistence
TA0003
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Scheduled Task
T1053.005
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-05 11:39

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-05 11:39

Reported

2024-07-05 11:53

Platform

win10v2004-20240704-en

Max time kernel

843s

Max time network

844s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/RZM-CRACK-TEAM/RedLine-CRACK?tab=readme-ov-file

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\System.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe N/A
N/A N/A C:\Users\Admin\Templates\csrss.exe N/A
N/A N/A C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe N/A
N/A N/A C:\Program Files\Windows Multimedia Platform\dllhost.exe N/A
N/A N/A C:\Users\All Users\ssh\Kurome.Loader.exe N/A
N/A N/A C:\Users\Default User\dwm.exe N/A
N/A N/A C:\Windows\twain_32\SearchApp.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\System.exe N/A
N/A N/A C:\Users\Admin\Templates\csrss.exe N/A
N/A N/A C:\Users\Default User\TextInputHost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\System.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\System.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\System.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\System.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe N/A
N/A N/A C:\Users\Admin\Templates\csrss.exe N/A
N/A N/A C:\Users\Admin\Templates\csrss.exe N/A
N/A N/A C:\Users\Admin\Templates\csrss.exe N/A
N/A N/A C:\Users\Admin\Templates\csrss.exe N/A
N/A N/A C:\Program Files\Windows Multimedia Platform\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Multimedia Platform\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Multimedia Platform\dllhost.exe N/A
N/A N/A C:\Program Files\Windows Multimedia Platform\dllhost.exe N/A
N/A N/A C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe N/A
N/A N/A C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe N/A
N/A N/A C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe N/A
N/A N/A C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe N/A
N/A N/A C:\Users\All Users\ssh\Kurome.Loader.exe N/A
N/A N/A C:\Users\All Users\ssh\Kurome.Loader.exe N/A
N/A N/A C:\Users\All Users\ssh\Kurome.Loader.exe N/A
N/A N/A C:\Users\All Users\ssh\Kurome.Loader.exe N/A
N/A N/A C:\Users\Default User\dwm.exe N/A
N/A N/A C:\Users\Default User\dwm.exe N/A
N/A N/A C:\Users\Default User\dwm.exe N/A
N/A N/A C:\Users\Default User\dwm.exe N/A
N/A N/A C:\Windows\twain_32\SearchApp.exe N/A
N/A N/A C:\Windows\twain_32\SearchApp.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\System.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\System.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\CrashReports\27d1bcfc3c54e0 C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Program Files\Windows Portable Devices\886983d96e3d3e C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Program Files\Windows Multimedia Platform\dllhost.exe C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\65be3b505478f7 C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Program Files (x86)\Google\CrashReports\System.exe C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Program Files\Windows Portable Devices\csrss.exe C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Program Files\Windows Multimedia Platform\5940a34987c991 C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\SearchApp.exe C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\38384e6a620884 C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\twain_32\38384e6a620884 C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Windows\es-ES\sihost.exe C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Windows\es-ES\66fc9ff0ee96c2 C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Windows\LanguageOverlayCache\conhost.exe C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_64\61a52ddc9dd915 C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe N/A
File created C:\Windows\twain_32\SearchApp.exe C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000020000000300000000000000ffffffff C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000048be5f772fceda0131581f7b2fceda013868167d2fceda0114000000 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000000000000300000002000000ffffffff C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202020202020202 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 = 5000310000000000e558375d10004c6f63616c003c0009000400efbee458cc83e558485d2e00000091e10100000001000000000000000000000000000000544e64004c006f00630061006c00000014000000 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\SniffedFolderType = "Generic" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2480455240-981575606-1030659066-1000\{D65546D6-967F-4070-893D-04455D6FBAF8} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 7800310000000000e458cc831100557365727300640009000400efbe874f7748e558e85c2e000000c70500000000010000000000000000003a0000000000d5f30e0155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "17" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 = 5600310000000000e458cc8312004170704461746100400009000400efbee458cc83e558e85c2e0000007ee1010000000100000000000000000000000000000013e1fb004100700070004400610074006100000016000000 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0\NodeSlot = "12" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\SniffedFolderType = "Generic" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\System.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\System.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Google\CrashReports\System.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\7-Zip\7zG.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\System.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe N/A
N/A N/A C:\Users\Admin\Templates\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe N/A
N/A N/A C:\Users\All Users\ssh\Kurome.Loader.exe N/A
N/A N/A C:\Program Files\Windows Multimedia Platform\dllhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Panel.exe N/A
N/A N/A C:\Users\Default User\dwm.exe N/A
N/A N/A C:\Windows\twain_32\SearchApp.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe N/A
N/A N/A C:\Program Files (x86)\Google\CrashReports\System.exe N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Users\Admin\Templates\csrss.exe N/A
N/A N/A C:\Users\Default User\TextInputHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2904 wrote to memory of 3216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5092 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1452 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1452 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/RZM-CRACK-TEAM/RedLine-CRACK?tab=readme-ov-file

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88e1446f8,0x7ff88e144708,0x7ff88e144718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5028 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Redline-crack-by-rzt\" -ad -an -ai#7zMap5684:102:7zEvent10784

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe

"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe"

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe

"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\FAQ.txt

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\FAQ (English).docx" /o ""

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe

"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe"

C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe

"C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe"

C:\Users\Admin\AppData\Local\Temp\Panel.exe

"C:\Users\Admin\AppData\Local\Temp\Panel.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Kurome.HostK" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Kurome.Host" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Kurome.HostK" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\SearchApp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Windows\twain_32\SearchApp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\twain_32\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\twain_32\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Templates\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Templates\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Templates\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\sihost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\es-ES\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Windows\es-ES\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Kurome.LoaderK" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\ssh\Kurome.Loader.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Kurome.Loader" /sc ONLOGON /tr "'C:\Users\All Users\ssh\Kurome.Loader.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Kurome.LoaderK" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\ssh\Kurome.Loader.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\CrashReports\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\CrashReports\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\TextInputHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 9 /tr "'C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Templates\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Templates\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Templates\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\Panel.exe

"C:\Users\Admin\AppData\Local\Temp\Panel.exe" "--monitor"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ctqENoUWTa.bat"

C:\Windows\SysWOW64\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files (x86)\Google\CrashReports\System.exe

"C:\Program Files (x86)\Google\CrashReports\System.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Panel.exe

"C:\Users\Admin\AppData\Local\Temp\Panel.exe" "auth" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAYmMvkocoGUaSpLYbxX0+jwAAAAACAAAAAAAQZgAAAAEAACAAAABrirtW7G8nD8IWGy3JXTkcRzqTqaP/8O1xthyg0J43qgAAAAAOgAAAAAIAACAAAADIAotTjulWH/Kq7sn3DEom7FD/urUCnQtCe9f6UxhugRAAAAA9o0qVm8/v7Yo2FrFlLKFqQAAAAMsGEDWNmo9RXgc6smv6/ZqBCkzU8WewplKqMHomhXKwB7Zc68pV0v72+f03WtBnAgPCgDKWkCBCTeSIBLiCUaE=" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAYmMvkocoGUaSpLYbxX0+jwAAAAACAAAAAAAQZgAAAAEAACAAAADI4DXUHNAp1J85kHQW88qOk84xY80GEfEuAx4j0ST2iQAAAAAOgAAAAAIAACAAAAAexzEdXj9xoJtNuRUU5Lvj+9uULqrno1RCdaWlKNIMUhAAAABLG7Zg97vhGgfgs/H2j1UZQAAAAHPxyOVBIzo56p0n91z7zZSeKMIyoj7trTS9W2usSpA7v/pxvgefO8d5faDCH27sFb1WajudulYOafJpfLpG/Ck="

C:\Users\Admin\AppData\Local\Temp\Panel.exe

"C:\Users\Admin\AppData\Local\Temp\Panel.exe" "auth" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAYmMvkocoGUaSpLYbxX0+jwAAAAACAAAAAAAQZgAAAAEAACAAAABrirtW7G8nD8IWGy3JXTkcRzqTqaP/8O1xthyg0J43qgAAAAAOgAAAAAIAACAAAADIAotTjulWH/Kq7sn3DEom7FD/urUCnQtCe9f6UxhugRAAAAA9o0qVm8/v7Yo2FrFlLKFqQAAAAMsGEDWNmo9RXgc6smv6/ZqBCkzU8WewplKqMHomhXKwB7Zc68pV0v72+f03WtBnAgPCgDKWkCBCTeSIBLiCUaE=" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAYmMvkocoGUaSpLYbxX0+jwAAAAACAAAAAAAQZgAAAAEAACAAAADI4DXUHNAp1J85kHQW88qOk84xY80GEfEuAx4j0ST2iQAAAAAOgAAAAAIAACAAAAAexzEdXj9xoJtNuRUU5Lvj+9uULqrno1RCdaWlKNIMUhAAAABLG7Zg97vhGgfgs/H2j1UZQAAAAHPxyOVBIzo56p0n91z7zZSeKMIyoj7trTS9W2usSpA7v/pxvgefO8d5faDCH27sFb1WajudulYOafJpfLpG/Ck=" "--monitor"

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe

"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe"

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe

"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\ipconfig.exe

ipconfig

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe

"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe"

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe

"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe"

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe

"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3008 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1

C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe"

C:\Users\Admin\Templates\csrss.exe

C:\Users\Admin\Templates\csrss.exe

C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe

C:\Windows\assembly\NativeImages_v4.0.30319_64\msedge.exe

C:\Program Files\Windows Multimedia Platform\dllhost.exe

"C:\Program Files\Windows Multimedia Platform\dllhost.exe"

C:\Users\All Users\ssh\Kurome.Loader.exe

"C:\Users\All Users\ssh\Kurome.Loader.exe"

C:\Users\Default User\dwm.exe

"C:\Users\Default User\dwm.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\ReadMe.txt

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1840 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1344 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5760 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\twain_32\SearchApp.exe

C:\Windows\twain_32\SearchApp.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=printing.mojom.PrintCompositor --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --service-sandbox-type=print_compositor --mojo-platform-channel-handle=6164 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5500 /prefetch:6

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15691271120837051616,1596567533646456509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1

C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\Kurome.Host.exe"

C:\Program Files (x86)\Google\CrashReports\System.exe

"C:\Program Files (x86)\Google\CrashReports\System.exe"

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\FAQ (English).docx" /o ""

C:\Users\Admin\Templates\csrss.exe

C:\Users\Admin\Templates\csrss.exe

C:\Users\Default User\TextInputHost.exe

"C:\Users\Default User\TextInputHost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.111.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.110.133:443 user-images.githubusercontent.com tcp
US 185.199.110.133:443 user-images.githubusercontent.com tcp
US 185.199.110.133:443 user-images.githubusercontent.com tcp
US 8.8.8.8:53 154.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 collector.github.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 140.82.112.22:443 collector.github.com tcp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 22.112.82.140.in-addr.arpa udp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
GB 2.18.27.153:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 153.27.18.2.in-addr.arpa udp
US 8.8.8.8:53 143.252.19.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 a0682132.xsph.ru udp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
US 8.8.8.8:53 42.197.8.141.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
GB 184.28.176.104:443 www.bing.com tcp
N/A 127.0.0.1:1337 tcp
US 8.8.8.8:53 104.176.28.184.in-addr.arpa udp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:80 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
GB 184.28.176.56:443 www.bing.com tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 56.176.28.184.in-addr.arpa udp
GB 184.28.176.19:443 th.bing.com tcp
GB 184.28.176.59:443 r.bing.com tcp
GB 184.28.176.59:443 r.bing.com tcp
GB 184.28.176.19:443 th.bing.com tcp
US 8.8.8.8:53 aefd.nelreports.net udp
GB 2.19.252.146:443 aefd.nelreports.net tcp
GB 2.19.252.146:443 aefd.nelreports.net udp
US 8.8.8.8:53 login.microsoftonline.com udp
NL 40.126.32.134:443 login.microsoftonline.com tcp
US 8.8.8.8:53 19.176.28.184.in-addr.arpa udp
US 8.8.8.8:53 59.176.28.184.in-addr.arpa udp
US 8.8.8.8:53 146.252.19.2.in-addr.arpa udp
US 8.8.8.8:53 translate.google.com udp
GB 172.217.169.78:443 translate.google.com tcp
GB 172.217.169.78:443 translate.google.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 consent.google.com udp
GB 172.217.16.238:443 consent.google.com tcp
US 8.8.8.8:53 services.bingapis.com udp
US 13.107.5.80:443 services.bingapis.com tcp
US 8.8.8.8:53 78.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 80.5.107.13.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
N/A 127.0.0.1:1337 tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 4.180.250.142.in-addr.arpa udp
US 104.18.33.89:443 www2.bing.com tcp
GB 172.217.16.238:443 consent.google.com udp
US 104.18.33.89:443 www2.bing.com tcp
GB 172.217.169.78:443 translate.google.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 89.33.18.104.in-addr.arpa udp
GB 216.58.204.67:443 ssl.gstatic.com tcp
US 8.8.8.8:53 ogs.google.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.187.238:443 apis.google.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.46:443 play.google.com tcp
GB 216.58.204.67:443 ssl.gstatic.com udp
GB 142.250.180.4:443 www.google.com udp
GB 142.250.200.46:443 play.google.com udp
N/A 127.0.0.1:1337 tcp
GB 142.250.200.46:443 play.google.com udp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
N/A 127.0.0.1:1337 tcp
GB 172.217.169.78:443 ogs.google.com udp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
GB 2.19.252.146:443 aefd.nelreports.net udp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
N/A 127.0.0.1:1337 tcp
GB 142.250.200.46:443 play.google.com udp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
US 8.8.8.8:53 40.173.79.40.in-addr.arpa udp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
RU 141.8.197.42:80 a0682132.xsph.ru tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp
N/A 127.0.0.1:1337 tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 9abb787f6c5a61faf4408f694e89b50e
SHA1 914247144868a2ff909207305255ab9bbca33d7e
SHA256 ecfd876b653319de412bf6be83bd824dda753b4d9090007231a335819d29ea07
SHA512 0f8139c45a7efab6de03fd9ebfe152e183ff155f20b03d4fac4a52cbbf8a3779302fed56facc9c7678a2dcf4f1ee89a26efd5bada485214edd9bf6b5cd238a55

\??\pipe\LOCAL\crashpad_2904_ORIMWRMIBBZBZDJI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b6c11a2e74ef272858b9bcac8f5ebf97
SHA1 2a06945314ebaa78f3ede1ff2b79f7357c3cb36b
SHA256 f88faeb70e2a7849587be3e49e6884f5159ac76ef72b7077ac36e5fbf332d777
SHA512 d577a5b3a264829494f5520cc975f4c2044648d51438885f319c2c74a080ea5dd719b6a885ed4d3401fd7a32341f88f26da5e3f29214da9afbbbd5ee950e8ec3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9cb96ded727837d01ed165a058938743
SHA1 af618124ab451c84fedbe6c2b95b48fe855ff161
SHA256 13d9dba9ee87f083db3082a48d51d8a2d33901fafb56ec570576a015056cab31
SHA512 ed73be70f6cbc275e27595926824a7b6fcb988300f195307b99af4ad9cb266a0089a9fac35471f11cb7c3f3bd5a849cbcd99da5f74f0088676271cca26900d65

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8a834dd5e1d5d6f2a2035ad3a3836885
SHA1 9e0c13bbbb61d634fee4f1af7f74a36d1eab801b
SHA256 f8eee630c3e2bef9667dc80fac49149e58d946ad9ac19b8dbd4f5e9d3717289a
SHA512 956e74607a47ce95bc725fbcfbd2469e8475e79e95a8630ac4fbe80e250217b7127e96654e51621372d604d0b714c4c522dddd5541d603e8dfa1c37cdb00c232

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f89e7c99bf1ea531df05e0190efa056f
SHA1 6f4098e53c6e80953c99bc4939cdfcfaf92d922f
SHA256 05f4b438dd94195bad5eb4c81b466d4373cec3e482798be8b6bc1252cb08966a
SHA512 d0a017154b9abd4bb55e34f4bfa3fb50dee9b6493cc933c90b0f5dbb4475fe70a15f04144f200b71e77275403a333363432205d75577138fe15253da83c16eb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\547043ee-97f5-47f7-9144-12e87f967ea2\0

MD5 4a47f956d4e5b86c3a6721a3e4189071
SHA1 434fcc846c0b2aed6e71b96b4a22df0739e29356
SHA256 ddd595420854f182eadbaeb91f9e2541a20fb431b67f3bbd062e1220b817c43e
SHA512 7c51c70d299c9578d11fd4177a0bb17bffa30287c6ae2d9f26d82b726cfde46c32cce2be620d6128c6a6790b1e5f06176c552274239186fd17f5280fd6f1659f

C:\Users\Admin\Downloads\Redline-crack-by-rzt.zip

MD5 1118549e87cbad92e6959506172d8c5d
SHA1 a5598c8355d03dc1ed03b0f7842d478d6a9e17fe
SHA256 54b542bd706838bc61c23ef8189935fc74e0099b14e509d33649b43ff108d85f
SHA512 029527677e3a316a0929a111701c87c5fe6c11ecc361a3c009de75ee06d110245d0f250fca836a1aa0a90f86237e3102bcdf60ed645a9b42ad04bd50793aa09c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6f939a52cebc5d9c45451c233e602860
SHA1 76dd66976d30c8c9b21b4d83bad1a07debb4939b
SHA256 c63ef6721255d394f15aeecd4aed52c32cb4146500c0707fd3dff51698c493b6
SHA512 cf4a103fde663cbb1db1b7fa5c14ba4e01459a61df89af3d1ad440667c1c2a76c1165b179782ce590d30b2924c04583d949572de3bb930f959c753e91910cf96

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0a370ec8161e8b9f3591f4f7c5473992
SHA1 46702343314f5cdf0b30fe1ee45773a1104f0bc5
SHA256 c54eefd87154baf4a2e0974c96d02f204cb68b358ee0fc794555ad43448e04a2
SHA512 9afa07f176db5f38dcdfa954c983bdf832c0f3da12ec9705522c6569f0d22ff6e5316f68e3f8e6a2a23a32d2a3c701fb71067faec489ec1f6b1cec5214b0b83e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 dc54f80c237b26f66b83425d73bc8d1c
SHA1 8cbd4e023576b9ba5b195dec797ba03ec46633b3
SHA256 8ada6923e3c7dd760ded2ca2fb488a5044126ec52a4e8bd662f091ee6d2cc5b8
SHA512 710b5cc43200cd8ce447b5941f327e7c007c69d7879b79fea0c456bcf32589c86f45708104ec1de7cd2eb4cd69e717444ddcfe9862d0938a44e22c758a5b1e25

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe

MD5 a3ec05d5872f45528bbd05aeecf0a4ba
SHA1 68486279c63457b0579d86cd44dd65279f22d36f
SHA256 d4797b2e4957c9041ba32454657f5d9a457851c6b5845a57e0e5397707e7773e
SHA512 b96b582bb26cb40dbb2a0709a6c88acd87242d0607d548473e3023ffa0a6c9348922a98a4948f105ea0b8224a3930af1e698c6cee3c36ca6a83df6d20c868e8e

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe.config

MD5 9070d769fd43fb9def7e9954fba4c033
SHA1 de4699cdf9ad03aef060470c856f44d3faa7ea7f
SHA256 cbaf2ae95b1133026c58ab6362af2f7fb2a1871d7ad58b87bd73137598228d9b
SHA512 170028b66c5d2db2b8c90105b77b0b691bf9528dc9f07d4b3983d93e9e37ea1154095aaf264fb8b5e67c167239697337cc9e585e87ef35faa65a969cac1aa518

memory/3136-315-0x0000000000EF0000-0x0000000001126000-memory.dmp

memory/3136-316-0x0000000008150000-0x0000000008760000-memory.dmp

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe

MD5 4fde0f80c408af27a8d3ddeffea12251
SHA1 e834291127af150ce287443c5ea607a7ae337484
SHA256 1b644cdb1c7247c07d810c0ea10bec34dc5600f3645589690a219de08cf2dedb
SHA512 3693aeaa2cc276060b899f21f6f57f435b75fec5bcd7725b2dd79043b341c12ebc29bd43b287eb22a3e31fd2b50c4fa36bf020f9f3db5e2f75fe8cc747eca5f5

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe.config

MD5 5a7f52d69e6fca128023469ae760c6d5
SHA1 9d7f75734a533615042f510934402c035ac492f7
SHA256 498c7f8e872f9cef0cf04f7d290cf3804c82a007202c9b484128c94d03040fd0
SHA512 4dc8ae80ae9e61d2801441b6928a85dcf9d6d73656d064ffbc0ce9ee3ad531bfb140e9f802e39da2a83af6de606b115e5ccd3da35d9078b413b1d1846cbd1b4f

memory/1912-322-0x0000000000D10000-0x0000000000D34000-memory.dmp

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll

MD5 059d51f43f1a774bc5aa76d19c614670
SHA1 171329bf0f48190cf4d59ce106b139e63507457d
SHA256 2eaf3d548927ebd243362f7bcb906bb1bbff3961223fb9521cb2846b6b8d523d
SHA512 a299cb18c8a47fc27c46db0011266b7fa273852b302374eb98a54034e1281150af8e54e58f76a384d3b92fbcb1a67fc0452cabe592a379e15cce2c5f9a4b6cb7

memory/1912-328-0x0000000005920000-0x0000000005C82000-memory.dmp

memory/1912-333-0x00000000055E0000-0x0000000005606000-memory.dmp

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.WCF.dll

MD5 e3d39e30e0cdb76a939905da91fe72c8
SHA1 433fc7dc929380625c8a6077d3a697e22db8ed14
SHA256 4bfa493b75361920e6403c3d85d91a454c16ddda89a97c425257e92b352edd74
SHA512 9bb3477023193496ad20b7d11357e510ba3d02b036d6f35f57d061b1fc4d0f6cb3055ae040d78232c8a732d9241699ddcfac83cc377230109bf193736d9f92b8

memory/1912-329-0x0000000005C90000-0x0000000005E0C000-memory.dmp

memory/1912-334-0x0000000006430000-0x0000000006A48000-memory.dmp

memory/1912-335-0x00000000056D0000-0x00000000056E2000-memory.dmp

memory/1912-336-0x0000000005770000-0x00000000057AC000-memory.dmp

memory/1912-337-0x0000000005820000-0x0000000005886000-memory.dmp

memory/1912-338-0x00000000060A0000-0x0000000006326000-memory.dmp

memory/1912-339-0x0000000005890000-0x00000000058DC000-memory.dmp

memory/1912-340-0x0000000005EE0000-0x0000000005FAE000-memory.dmp

memory/1912-341-0x0000000006B60000-0x0000000006C6A000-memory.dmp

memory/1912-342-0x0000000005E70000-0x0000000005E98000-memory.dmp

memory/1912-343-0x0000000006000000-0x0000000006050000-memory.dmp

memory/1912-344-0x0000000006A50000-0x0000000006B50000-memory.dmp

memory/1912-345-0x0000000006C70000-0x0000000006CA0000-memory.dmp

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\FAQ.txt

MD5 53fc20e1e68a5619f7ff2df8e99d42c4
SHA1 7a8ddc81d16aaab533411810acfad1546c30dc2f
SHA256 fc7ceb47aa8796614f098406452ea67cb58929ded1d4c6bd944d4d34921bba0b
SHA512 c1ad4f2dfd50528d613e9fe3f55da0bbb5c8442b459d9c3c989b75014c827306f72f2eb6ecbcd92ff11546e12087c09685b12a7dc258c5ea85c15ba5cc002d8c

memory/3836-366-0x00007FF85C230000-0x00007FF85C240000-memory.dmp

memory/3836-368-0x00007FF85C230000-0x00007FF85C240000-memory.dmp

memory/3836-367-0x00007FF85C230000-0x00007FF85C240000-memory.dmp

memory/3836-369-0x00007FF85C230000-0x00007FF85C240000-memory.dmp

memory/3836-370-0x00007FF85C230000-0x00007FF85C240000-memory.dmp

memory/3836-371-0x00007FF8599D0000-0x00007FF8599E0000-memory.dmp

memory/3836-372-0x00007FF8599D0000-0x00007FF8599E0000-memory.dmp

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\FAQ (English).docx

MD5 a973ea85439ddfe86379d47e19da4dca
SHA1 78f60711360ddd46849d128e7a5d1b68b1d43f9f
SHA256 c197833a3fd69e98fbf2b02e9da232ff2867e1e684d420fd3975188c0e0e202b
SHA512 4a3fad33cccb15ea2d98bc30141744ba6709afec52d429ac0916aa656f4b611fdeda4b37812f0a72b90de000fc5c0f95bb445e5df67fc4ba6f93de5ce55df510

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 fb4ddcf2ac7250f7b8279a83629ee7b7
SHA1 8b93c3ab95e597c5efb356f74567065c9931d502
SHA256 9412ca31f73f39f39e9df24f0272bdcb9d99700c8a220d195909e5e5095ab930
SHA512 9ccf4f76aa9b97077d5bd6db0a2e1bce393021409289336694fed74cc934cce7d61e098919627ac257173cacf87cfd8a880ae3f7387a38c86d53e062c9f7ffb1

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

MD5 6fcd83aee155f5c52c69c8c4a27eec76
SHA1 32b613f2fbd47b5301e8e4382c249061503bacbc
SHA256 10b8dbad240ffa183ae51a41a289d4d49a4dd7595134f72fdc91afcd85a312f5
SHA512 2045ffd97a6287d0fcb37c805ef40f52766bee50dee1523e6ca4ec0440885a8ca623d69f5482886bd95ac1824fbe3cbba60ced32beb95bbf05761eabb163961d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 c2f4105e08b7168fc2ae97caa0469cc9
SHA1 ac354f7f6f1daf7208d7e6f5c56bf55b1caf16db
SHA256 b2580b9167d9398cc05f931ed47fdb0a67a3ec98594bd235313c10280c3d5759
SHA512 00c6ec47e6e3a67c39fcbbda308bc55ac3459163819de2db031e1e7a494cc863399028f780bf05453773cb0f8be5682aa65ce5982d7aa47a26009ea77059b0d4

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 8655ddb2e4a790cb333fba9284ea3bea
SHA1 60f72cf1bf55b48cdb15ee4c96ee4a29c652809e
SHA256 b919214f5d09caee73b90cd8344d7ae112ca54cd4cbe84a3d5ea11862ef05674
SHA512 fbf786d13a3463c1984fce00096489c482267c35b8995a3ab863846c6a31d8b3fbb2290f0ebde6013fc2d2d124032a66a936105029b1de63032cfe0aa4a32499

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 c28ff196c8636d5f4766cc654cd1c217
SHA1 fed53d21b5a6edd55258d71911495f14b1857033
SHA256 89ed670d91e9b7ac52ca30d630cdb123875047a2af05589049a2d0d75aadb365
SHA512 6b179add2445d2d5f6a5d5aff809cbe17de51f79ed6da78db620f42a1c247bd9c1dbc67744ea53e58a98b892645223935232e0bd1eef0a30a81ce345c78d490d

C:\Users\Admin\AppData\Local\Temp\TCDD2DC.tmp\sist02.xsl

MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

memory/3836-959-0x00007FF85C230000-0x00007FF85C240000-memory.dmp

memory/3836-958-0x00007FF85C230000-0x00007FF85C240000-memory.dmp

memory/3836-957-0x00007FF85C230000-0x00007FF85C240000-memory.dmp

memory/3836-956-0x00007FF85C230000-0x00007FF85C240000-memory.dmp

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe

MD5 1246b7d115005ce9fcc96848c5595d72
SHA1 fa3777c7fe670cea2a4e8267945c3137091c64b5
SHA256 f01393937f06be201400703d1dbfb35397c4a5162f16278ba9d9bb63ddcbcc78
SHA512 5bf90904cf74a8c3775498578d856dd9f4837077928cd7ce24e4a6ccec00827bcfb28c2079498ba682a4f53204d7ad2bb8de2489005c429dc968e75e26d29101

memory/5212-962-0x0000000000400000-0x0000000001470000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe

MD5 fcbf03d90d4e9ce80f575452266e71d1
SHA1 1b067d0e057db189c71b2f7ac4ee2483ebaf0fa7
SHA256 2ec28f57e64fee2b2f1a40c78c079672f0dddb84da2a84fe3291bd68a4771a73
SHA512 9ce9962f645ab542f135d8560a7095259fe6628afcf598a58dfcf8e96b0d1dfa73e59ce13af3ff97e6c03046634dbd46a278c6535f99f99b3a6051b7bbfcf380

memory/5556-1030-0x00000000001B0000-0x00000000005EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Panel.exe

MD5 f4e19b67ef27af1434151a512860574e
SHA1 56304fc2729974124341e697f3b21c84a8dd242a
SHA256 c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
SHA512 a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77

memory/5556-1036-0x00000000001B0000-0x00000000005EC000-memory.dmp

memory/5556-1032-0x00000000001B0000-0x00000000005EC000-memory.dmp

memory/5556-1038-0x00000000064C0000-0x0000000006A64000-memory.dmp

memory/5620-1037-0x00007FF879E00000-0x00007FF87A8C1000-memory.dmp

memory/5620-1045-0x000000001ADB0000-0x000000001AF50000-memory.dmp

memory/5620-1061-0x0000000180000000-0x0000000180005000-memory.dmp

memory/5620-1070-0x000000001DA30000-0x000000001DB72000-memory.dmp

memory/5620-1059-0x0000000180000000-0x0000000180005000-memory.dmp

memory/5620-1057-0x0000000180000000-0x0000000180005000-memory.dmp

memory/5620-1055-0x0000000180000000-0x0000000180005000-memory.dmp

memory/5620-1054-0x0000000180000000-0x0000000180005000-memory.dmp

memory/5620-1044-0x000000001ADB0000-0x000000001AF50000-memory.dmp

memory/5620-1043-0x000000001ADB0000-0x000000001AF50000-memory.dmp

memory/5620-1066-0x000000001DA30000-0x000000001DB72000-memory.dmp

memory/5620-1078-0x000000001DE00000-0x000000001DF42000-memory.dmp

memory/5620-1065-0x000000001DA30000-0x000000001DB72000-memory.dmp

memory/5620-1108-0x000000001DB70000-0x000000001DB7A000-memory.dmp

memory/5620-1095-0x000000001DB60000-0x000000001DB6A000-memory.dmp

memory/5556-1094-0x0000000006440000-0x00000000064A6000-memory.dmp

memory/5620-1127-0x000000001E850000-0x000000001EDF4000-memory.dmp

memory/5620-1128-0x000000001F000000-0x000000001F092000-memory.dmp

memory/5620-1114-0x000000001E4E0000-0x000000001E842000-memory.dmp

memory/5620-1151-0x000000001F0A0000-0x000000001F0BC000-memory.dmp

memory/5620-1168-0x000000001F2D0000-0x000000001F44C000-memory.dmp

memory/5556-3021-0x00000000001B0000-0x00000000005EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ctqENoUWTa.bat

MD5 6a6aac8c0808f0b2f7e614d1fbd4fee3
SHA1 7328dfaa5835774d9cf205c15e2489856e3cccca
SHA256 a3d0567f30178b77255e4cb115439491e5ef1c10687d409bd2d3b3901878702a
SHA512 4f23f96efc09c08ba7195dc9b5f39bd76a3414f6865c2223fb8f6bc3af6c8b08e23475f833401e654fb90227f221c7dfcbe82978b0ec58d5e4be87b626afe03c

memory/6044-4935-0x000000001FB30000-0x000000001FB96000-memory.dmp

memory/6044-4936-0x000000001FBA0000-0x000000001FE26000-memory.dmp

memory/6044-4950-0x000000001FE30000-0x000000001FE4A000-memory.dmp

memory/6044-4951-0x0000000020050000-0x0000000020668000-memory.dmp

memory/6044-4953-0x00000000207C0000-0x00000000207FC000-memory.dmp

memory/6044-4954-0x0000000020800000-0x0000000020812000-memory.dmp

memory/6044-4952-0x00000000206B0000-0x00000000207B0000-memory.dmp

memory/6044-4971-0x0000000020840000-0x0000000020852000-memory.dmp

memory/6044-5000-0x0000000020990000-0x0000000020A40000-memory.dmp

memory/6044-4985-0x00000000208A0000-0x00000000208DA000-memory.dmp

memory/6044-5034-0x0000000020A40000-0x0000000020AB4000-memory.dmp

memory/5752-5038-0x0000000000B50000-0x0000000000F8C000-memory.dmp

memory/5752-5039-0x0000000000B50000-0x0000000000F8C000-memory.dmp

memory/6044-5057-0x0000000024580000-0x00000000245CA000-memory.dmp

memory/6044-5058-0x0000000024530000-0x0000000024580000-memory.dmp

memory/5752-5068-0x0000000000B50000-0x0000000000F8C000-memory.dmp

memory/6044-5071-0x0000000021BD0000-0x0000000021C6C000-memory.dmp

memory/6044-5079-0x0000000021E70000-0x0000000021EBF000-memory.dmp

memory/6044-5080-0x0000000024EF0000-0x0000000024FFA000-memory.dmp

memory/6044-5081-0x00000000245E0000-0x0000000024610000-memory.dmp

memory/6044-5082-0x0000000024610000-0x0000000024632000-memory.dmp

memory/6044-5083-0x00000000256C0000-0x0000000025A29000-memory.dmp

memory/6044-5098-0x0000000024660000-0x0000000024678000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Panel.exe.log

MD5 cd48530bd8e623c8c70e28bcce887e80
SHA1 578b96fc5a0917250331db16f6625eb17d2c3409
SHA256 1c051ac06c180e5b6e00291e6d489e5169de770a5662206357b37869cd427974
SHA512 9bbd097ee6f05a648a8033818ffe43fab65a69842e7dce0c221914e0e0d2e7630ced1591ffbe9059e183d56f1ac10a7f61fe9eb15f3cc90d4cd172ead3055a94

memory/5492-9083-0x0000000021BA0000-0x0000000021BEF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\serviceSettings.json

MD5 5b0a7c8b2ed5d0e217b1a60188732bd3
SHA1 69c9533cae0ab8c9c7566edf7dc51e3fbae5ecf8
SHA256 7010eaf0b085414f6c95ec08c010073c7d05c4e58e24547f54f5c5f7539020f8
SHA512 52809263f22949eb4a5eee4e7d39a053421aed4f4c3bce828a31091a9c8a8653ba967cc1618c0c8235a3e01b554a890e9a525d3ae3d4676ea1ac79a21870ad53

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe

MD5 cf38a4bde3fe5456dcaf2b28d3bfb709
SHA1 711518af5fa13f921f3273935510627280730543
SHA256 c47b78e566425fc4165a83b2661313e41ee8d66241f7bea7723304a6a751595e
SHA512 3302b270ee028868ff877fa291c51e6c8b12478e7d873ddb9009bb68b55bd3a08a2756619b4415a76a5b4167abd7c7c3b9cc9f44c32a29225ff0fc2f94a1a4cc

memory/1440-9156-0x0000000000DD0000-0x0000000000DF8000-memory.dmp

memory/1440-9161-0x0000000005830000-0x00000000058C2000-memory.dmp

memory/1440-9165-0x0000000005EE0000-0x0000000005EEA000-memory.dmp

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Mono.Cecil.dll

MD5 de69bb29d6a9dfb615a90df3580d63b1
SHA1 74446b4dcc146ce61e5216bf7efac186adf7849b
SHA256 f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc
SHA512 6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015

memory/1440-9169-0x0000000006400000-0x000000000645E000-memory.dmp

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\stub.dll

MD5 625ed01fd1f2dc43b3c2492956fddc68
SHA1 48461ef33711d0080d7c520f79a0ec540bda6254
SHA256 6824c2c92eb7cee929f9c6b91e75c8c1fc3bfe80495eba4fa27118d40ad82b2b
SHA512 1889c7cee50092fe7a66469eb255b4013624615bac3a9579c4287bf870310bdc9018b0991f0ad7a9227c79c9bd08fd0c6fc7ebe97f21c16b7c06236f3755a665

memory/2740-9202-0x0000000000330000-0x000000000034E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4e3fc1267815bbf49bcbef314f7ba521
SHA1 1bbbc8830f6b02c5707ae9ed15d69456fcaa972a
SHA256 39ff1af08d27e39d14df07a6158f88875812eecef679a4df31dcfc90cc4a67c4
SHA512 7bfe637b05d5957faed0acfb478419bc63bdb18b77d812d38cd1b2f1b31170b3a8516a15b576fcb43830f4734b9cf7f5680e29fc633b26c0de13cb67a9814f6b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 4514c9e43fab12a99a4dddb295c00143
SHA1 9d2d1a918e8e0f1eb8b80c253b03039e6917fd94
SHA256 1e786bd2df790963450bafc95bf8d2e45595694aa197b462fdbe06cd4083cf5f
SHA512 293219721218629fb0be19fec582db65007dc351e87e05e0dc4a9a59555d7e1f73d5342970c8abbe459db81efc648f17ede33b4ce81578347adcb31da826b94e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5c7249.TMP

MD5 6122bbd29e1c052686293ea33f88e303
SHA1 afe1928885b03ba66b4f32aa0e19c94490377f59
SHA256 8122fd4e547fd1a2f730b968481bf0fa4406b77b46257fe51ebe8708e0100de9
SHA512 614de2416d69983fc08fe9450937bb31016165bfd5ec263ce28bbdd1d5b710eb654616de59b8b3e8c85e626a955a43f5a71fd65bab5f73ef710d6df070b2ba5a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 04bea4573850b48d9403b895b8910c5c
SHA1 13fd526ce8dc17540ae5524bedf177204b3e57f6
SHA256 4e311ba04dbfc27ed80bec8d1db18120ddf372384a1776bedd2f3f294fa0ab9c
SHA512 9f5d0d0caefe6e057028d95719f378225b3496b0ba87c479c7463e114fd19d57ab67a75daee954bf46b9067fe15c7631d944947134bb7f072c587cdcb0317c63

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4f77cc81ccf6a7da3e9ad92b21cf7d31
SHA1 cf95390b914e74182bcf94971052038ffea1fd89
SHA256 d8abd8b724ed6cb5587ac7e6744a7378d7ae8c305785d6db0fcc88d6b8d57629
SHA512 0efe6195b9537e2f6d53a21404446951d63733613a43d6f8223beb07dc8e1f357b1b605f2972d406a67d4dc1e5c66abdb45282bdc5e4e5ec56fd7af4a8b26db9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ee7e28ca3024d78a22d840db9567d8f0
SHA1 c49a15da0caf53d9d969d8e91f3861f7b0078bd3
SHA256 2dc7d426196620a84ea1dad6d7c264cccde9d119ac051584160377d982582fe7
SHA512 118d7e64bffa224e6740bedffe64e2937916d84fec0cd2f8658b69e479a9961aaee5f8ac931cc815ac07813099fcd00555d3b298e65c1be3acc4bd5c9cc4568e

memory/4784-9476-0x00000000007B0000-0x0000000000BEC000-memory.dmp

memory/4784-9477-0x00000000007B0000-0x0000000000BEC000-memory.dmp

memory/4784-9478-0x00000000007B0000-0x0000000000BEC000-memory.dmp

memory/4784-9490-0x00000000007B0000-0x0000000000BEC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 4ab13236254f9d18037af9870c1f3db7
SHA1 20ac43d6fe805da6aa728b9fcf656fadce285b0d
SHA256 098485e6c1fd27cd216a1708583ccc911e4b0313eddd123176e0286789999fbc
SHA512 0c922249d492ab594b8640c1f277527b952f854ae26150c4fe197439402671c79b6aeadb421b0f1b46719fc9f4277abd3c231d7020b9a7146276990b42b8cebd

memory/2512-9549-0x00000000004E0000-0x000000000091C000-memory.dmp

memory/2512-9550-0x00000000004E0000-0x000000000091C000-memory.dmp

memory/2512-9551-0x00000000004E0000-0x000000000091C000-memory.dmp

memory/2512-9571-0x00000000004E0000-0x000000000091C000-memory.dmp

memory/5492-9618-0x00000000206C0000-0x00000000206DA000-memory.dmp

memory/4888-9699-0x0000000000140000-0x000000000057C000-memory.dmp

memory/2120-9700-0x0000000000420000-0x000000000085C000-memory.dmp

memory/4872-9701-0x0000000000300000-0x000000000073C000-memory.dmp

memory/4872-9702-0x0000000000300000-0x000000000073C000-memory.dmp

memory/2120-9703-0x0000000000420000-0x000000000085C000-memory.dmp

memory/4888-9704-0x0000000000140000-0x000000000057C000-memory.dmp

memory/4872-9705-0x0000000000300000-0x000000000073C000-memory.dmp

memory/2120-9706-0x0000000000420000-0x000000000085C000-memory.dmp

memory/2120-9709-0x0000000000420000-0x000000000085C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\msedge.exe.log

MD5 49bddeedfc82481ba9d2c17cfce37675
SHA1 5a45bfedf3a990883bfc1a1fa2affbe5db94b6fb
SHA256 ab656bebc4d9c75956304be395323a41c282c748ae8e8ab2e46e0031f1cb8578
SHA512 9fa56622319d5e6fccacb2b7f5c5bda48a871e282b6d488822dd8e8349288626d6cc5960eb891df2a6268e67daac3c88e2d4bee450b4981d56789799551c6a24

memory/4888-9723-0x0000000000140000-0x000000000057C000-memory.dmp

memory/4872-9725-0x0000000000300000-0x000000000073C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 431c6790db5b9eb5495405e1d3117f4d
SHA1 11be1c5c309486f7c7a1ac97533d457f3f2899a1
SHA256 de5ba413b0cb7beb013ca0fef14f58dd8d7a2e7c72cb881c11002b4a1f48197f
SHA512 93fc748126419f89e29a3a5d8e947c8abc3d793bb387768724402fae1a43434c3a6b790045b36c368f79e3d69a25cfa19f83db026c7e730894ab6a9a00fe8eb7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 585ccb01cc81fdae46d56f524d4735f5
SHA1 10c192e9e5989bb956308dcdaa5beef9f238b4a9
SHA256 db6a3b1a166fb4c774374e46a3ff487a0e94a15211285ab2cd9acff741e4f2e0
SHA512 47fc28262d628c307b93c643e5842775aacdf9b3b1b22346f245e396af79a125cbd1d48d529a78c167ccb412e6f93f8e9a0f0023f02d5d1856ec8dfd1c7bccc3

memory/2432-9818-0x0000000000EE0000-0x000000000131C000-memory.dmp

memory/2432-9819-0x0000000000EE0000-0x000000000131C000-memory.dmp

memory/2432-9820-0x0000000000EE0000-0x000000000131C000-memory.dmp

memory/2432-9843-0x0000000000EE0000-0x000000000131C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 db9610f761d3823915b231abbaa5c142
SHA1 f194a0df71f97c124f9f63fd5a36a31c1b8c7525
SHA256 f3879d877d75eef315f23acecb2ee900dd33a0841cb6ea43bb90429e1ea4ee48
SHA512 274910d2ea07e7eb08e8cc7bd85503fc85fb803267a0efe954944682e9dcfee213af292a5d022dc4f536c8681ccf2ebdbb188bd7aacb91e24e8e87b1eb147361

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 5255b45d0770356c056aab5fd52b577f
SHA1 c62ce9309674e00fd5e3ca4289c823ee3c408ad3
SHA256 0aa86e4216d0273be5b723a069a03879ee83756c96de7055af950a85d9bf656a
SHA512 d409630c601d0736bcae4c2df3d79c58c1ee4e068e7d7e2a754e03be6ccfae19c14b33098d91f408402ccf7d2d8f97f861a907aa6e1e42b68cb6f5d881543bfc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 aec66ef6281850b21f1025b16be7be41
SHA1 1a251529f129468e9910491cd203094b8b40f4b1
SHA256 5a28207f39cf834e782cd238c6e54c45f2dd3c0f49052d3dee0c39bf60645315
SHA512 51197d0ba11a09b2e5d56abe5cf3aac015f9778e2be994c39c32d9ffb448ae7492e421c1d2fe32818ed5b0ff4698a0c9365541cb95aa88502e7c620c9dc18d28

memory/2508-10136-0x00000000007A0000-0x0000000000BDC000-memory.dmp

memory/2508-10139-0x00000000007A0000-0x0000000000BDC000-memory.dmp

memory/2508-10140-0x00000000007A0000-0x0000000000BDC000-memory.dmp

memory/2508-10167-0x00000000007A0000-0x0000000000BDC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 438aa18c43d5ca2962ec43a4bd39b34d
SHA1 9bdddf055b8fa2e9d0cff462ffbd9470a4d7924e
SHA256 fd7dcbbff29369c51469495af0bfd0c0ac8a8c78e76212ecfe0f041dc84dfd79
SHA512 8ed91cfaa773611beb55f005c5c76d4187034b17e6794c68b1f417a874aee878b3d5df17b6e1d215abf708f7682617d210f4e901b7b0bdb7b57ac32237a109fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 c999d99e5cd26b130e4da4573fbf97db
SHA1 826d783bce700edaf672c5934d677bb50f3091a5
SHA256 98c5d5acfbe027f855fd3d69dc0c3ef3802a87fb71e954da7a9dc4f3af4c99a3
SHA512 d8489830140d51b18afd39624fe7b7e408a1ae0b619d4399dbe8a39eb62c2d446c920d557f1f2448152cadb74b2e54dec0a34fc0e0f44a8d521bcecb963a676c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 0a6f0f44bbf7891586d68bf3e2996290
SHA1 5368a79062c7d2ef4a27ec7404e8e27d527c7c83
SHA256 607e02934f72e9944b130ba598115b139d8660a3201df4c0a3b648ac9c289895
SHA512 19a4b562a86245451d66d7533c26c7eec9db4d462acceca26b66fda22ca6b7c0f0628470d331b8f63a7e4a131a3f79c474ac631a60c11cb188df6717d5235874

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8ff3d3ee3b95d46c02856b62b63f808e
SHA1 a2854292428d114ce2ad8b57106834c4732e3992
SHA256 bb3e60d58d2e2042d6daac8d945dbd1f11d052fd375088172dbc802cf68c9069
SHA512 12a6c3f0bbffeab00a026b6448d81dece5a1f32ac3cd5e8c54ff0ce47a3d55993be6ee09f34e4cb2271c17263e89cfa1f212fd55b0e357f868531e2b7e417bda

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 be2301b7e2703bcab9502df4e0ba6ac1
SHA1 6ae9873c76c229cbbd0eb52bcd388996248d99fb
SHA256 80c60b23093c199ad6ec7f572c3c22cc8da58f105cf8c4ba550ebdc2965da60f
SHA512 65370daac445f5692cdad26dcb66371a340def2763b1b863be4f5f7b02f667145ac889b8d1ca1058c1e3013934305c55a4595bde3ac477c4e55220f9efda2b2b

memory/5528-10300-0x00000000007B0000-0x0000000000BEC000-memory.dmp

memory/5528-10301-0x00000000007B0000-0x0000000000BEC000-memory.dmp

memory/5528-10302-0x00000000007B0000-0x0000000000BEC000-memory.dmp

memory/432-10303-0x0000000000B50000-0x0000000000F8C000-memory.dmp

memory/432-10304-0x0000000000B50000-0x0000000000F8C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mso45F8.tmp

MD5 ed3c1c40b68ba4f40db15529d5443dec
SHA1 831af99bb64a04617e0a42ea898756f9e0e0bcca
SHA256 039fe79b74e6d3d561e32d4af570e6ca70db6bb3718395be2bf278b9e601279a
SHA512 c7b765b9afbb9810b6674dbc5c5064ed96a2682e78d5dffab384d81edbc77d01e0004f230d4207f2b7d89cee9008d79d5fbadc5cb486da4bc43293b7aa878041

memory/5528-10341-0x00000000007B0000-0x0000000000BEC000-memory.dmp

memory/432-10343-0x0000000000B50000-0x0000000000F8C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 abccbd29d6018eac14ad03d0a2eeb898
SHA1 d5e335aa97ff4db23c559898cff0f8591c674d52
SHA256 9bf4907e8394c3e25ed88202fad8117519c04b90a1b0b03fe8a8f65ff6246810
SHA512 67d8a1fde545870097e89fc540fea0b293651079e3c6f9db2a4591239e30a72ed8c225647055a434520156bce1dd84c0eaefa9f93dc775afdbf2679e52a5ede7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a0003ad-d869-4fb9-9c13-85e64f1ebdf6.tmp

MD5 08b7f6f1536ff8792e15203393b54b4f
SHA1 bcd8fcc49752252fcac61c99ef73be1a214786c1
SHA256 8c6f4d4d23201f98f25541a5a9e485bef7ab98d3751ae57ed28170eafea9b68e
SHA512 65cc1b26250b554a10b3a7f3ad68ad3aef0b56084740d45868c3e5307e21fd4730cea59fe4f3af508e8722cde9dc3e2a4929377a7683b9f2685254298f1e2ee6

memory/6132-10423-0x00000000004E0000-0x000000000091C000-memory.dmp