dcrat | hxxps://github[.]com/RZM-CRACK-TEAM/RedLine-CRACK?tab=readme-ov-file

System Information Discovery

Processes:

mssurrogateProvider_protected.exePanel.exePanel.exePanel.exepanel.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation	mssurrogateProvider_protected.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation	Panel.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation	Panel.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation	Panel.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation	panel.exe

Executes dropped EXE 17 IoCs

Processes:

Kurome.Loader.exeKurome.Host.exepanel.exemssurrogateProvider_protected.exePanel.exePanel.exemsedge.exePanel.exePanel.exespoolsv.exeRuntimeBroker.exeKurome.Builder.exebuild.exeTextInputHost.exeKurome.Builder.exeKurome.Host.exesppsvc.exe

pid	process
1856	Kurome.Loader.exe
3604	Kurome.Host.exe
3584	panel.exe
2868	mssurrogateProvider_protected.exe
2308	Panel.exe
4032	Panel.exe
4024	msedge.exe
5844	Panel.exe
5800	Panel.exe
5428	spoolsv.exe
1920	RuntimeBroker.exe
2276	Kurome.Builder.exe
6072	build.exe
1092	TextInputHost.exe
908	Kurome.Builder.exe
5748	Kurome.Host.exe
2420	sppsvc.exe

Loads dropped DLL 50 IoCs

Processes:

Kurome.Host.exemssurrogateProvider_protected.exemsedge.exespoolsv.exeRuntimeBroker.exeKurome.Builder.exebuild.exeTextInputHost.exeKurome.Builder.exeKurome.Host.exesppsvc.exe

pid	process
3604	Kurome.Host.exe
3604	Kurome.Host.exe
3604	Kurome.Host.exe
3604	Kurome.Host.exe
3604	Kurome.Host.exe
3604	Kurome.Host.exe
2868	mssurrogateProvider_protected.exe
2868	mssurrogateProvider_protected.exe
2868	mssurrogateProvider_protected.exe
2868	mssurrogateProvider_protected.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
5428	spoolsv.exe
5428	spoolsv.exe
5428	spoolsv.exe
5428	spoolsv.exe
1920	RuntimeBroker.exe
1920	RuntimeBroker.exe
1920	RuntimeBroker.exe
1920	RuntimeBroker.exe
2276	Kurome.Builder.exe
2276	Kurome.Builder.exe
2276	Kurome.Builder.exe
2276	Kurome.Builder.exe
2276	Kurome.Builder.exe
2276	Kurome.Builder.exe
6072	build.exe
6072	build.exe
6072	build.exe
6072	build.exe
1092	TextInputHost.exe
1092	TextInputHost.exe
1092	TextInputHost.exe
1092	TextInputHost.exe
908	Kurome.Builder.exe
908	Kurome.Builder.exe
908	Kurome.Builder.exe
908	Kurome.Builder.exe
908	Kurome.Builder.exe
908	Kurome.Builder.exe
5748	Kurome.Host.exe
5748	Kurome.Host.exe
5748	Kurome.Host.exe
5748	Kurome.Host.exe
2420	sppsvc.exe
2420	sppsvc.exe
2420	sppsvc.exe
2420	sppsvc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

47 raw.githubusercontent.com
46 raw.githubusercontent.com

flow	ioc
47	raw.githubusercontent.com
46	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

mssurrogateProvider_protected.exePanel.exePanel.exemsedge.exe

pid	process
2868	mssurrogateProvider_protected.exe
2868	mssurrogateProvider_protected.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
4024	msedge.exe

Drops file in Program Files directory 12 IoCs

Processes:

mssurrogateProvider_protected.exe

description	ioc	process
File created	C:\Program Files\VideoLAN\VLC\plugins\TextInputHost.exe	mssurrogateProvider_protected.exe
File created	C:\Program Files\Mozilla Firefox\Kurome.Host.exe	mssurrogateProvider_protected.exe
File created	C:\Program Files\Microsoft Office\Updates\RuntimeBroker.exe	mssurrogateProvider_protected.exe
File created	C:\Program Files\WindowsPowerShell\f3b6ecef712a24	mssurrogateProvider_protected.exe
File created	C:\Program Files\Windows Media Player\Visualizations\9e8d7a4ca61bd9	mssurrogateProvider_protected.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe	mssurrogateProvider_protected.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\ee2ad38f3d4382	mssurrogateProvider_protected.exe
File created	C:\Program Files\Microsoft Office\Updates\9e8d7a4ca61bd9	mssurrogateProvider_protected.exe
File created	C:\Program Files\WindowsPowerShell\spoolsv.exe	mssurrogateProvider_protected.exe
File created	C:\Program Files\Windows Media Player\Visualizations\RuntimeBroker.exe	mssurrogateProvider_protected.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\22eafd247d37c3	mssurrogateProvider_protected.exe
File created	C:\Program Files\Mozilla Firefox\65be3b505478f7	mssurrogateProvider_protected.exe

Drops file in Windows directory 11 IoCs

Processes:

mssurrogateProvider_protected.exeKurome.Loader.exe

description	ioc	process
File created	C:\Windows\L2Schemas\61a52ddc9dd915	mssurrogateProvider_protected.exe
File created	C:\Windows\InputMethod\SHARED\RuntimeBroker.exe	mssurrogateProvider_protected.exe
File created	C:\Windows\InputMethod\SHARED\9e8d7a4ca61bd9	mssurrogateProvider_protected.exe
File created	C:\Windows\L2Schemas\msedge.exe	mssurrogateProvider_protected.exe
File opened for modification	C:\Windows\L2Schemas\msedge.exe	mssurrogateProvider_protected.exe
File created	C:\Windows\rescache\spoolsv.exe	mssurrogateProvider_protected.exe
File created	C:\Windows\Media\Garden\sppsvc.exe	mssurrogateProvider_protected.exe
File created	C:\Windows\Media\Garden\0a1fd5f707cd16	mssurrogateProvider_protected.exe
File created	C:\Windows\Registration\CRMLog\csrss.exe	mssurrogateProvider_protected.exe
File created	C:\Windows\Registration\CRMLog\886983d96e3d3e	mssurrogateProvider_protected.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll	Kurome.Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exeWINWORD.EXEchrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

5380 ipconfig.exe

pid	process
5380	ipconfig.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133646721837468674"	chrome.exe

Modifies registry class 64 IoCs

Processes:

Panel.exeOpenWith.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\json_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = 00000000ffffffff	Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0 = 9e00310000000000e4582d8411005341564544507e310000860009000400efbee4582d84e4582d842e000000ffe701000000010000000000000000004c000000000059bad3005300610076006500640020005000690063007400750072006500730000004000770069006e0064006f00770073002e00730074006f0072006100670065002e0064006c006c002c002d0033003400350038003300000018000000	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\.json\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 5000310000000000e4588190100041646d696e003c0009000400efbee458f883e5587c862e0000007fe101000000010000000000000000000000000000000d787f00410064006d0069006e00000014000000	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000745c60a92fceda014915c8d63bceda01cb77cad63bceda0114000000	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202020202	Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\json_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0 = 4e00310000000000e5580988100054656d7000003a0009000400efbee458f883e55809882e0000009ee1010000000100000000000000000000000000000000a04b00540065006d007000000014000000	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg	Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 7800310000000000e458f8831100557365727300640009000400efbe874f7748e5587c862e000000c70500000000010000000000000000003a00000000008c551d0155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Ɏ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\MRUListEx = 00000000ffffffff	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\MRUListEx = ffffffff	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\㪐餞Ɏ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 03000000010000000200000000000000ffffffff	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\json_auto_file	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 = 5000310000000000e5580a8810004c6f63616c003c0009000400efbee458f883e55816882e0000009de101000000010000000000000000000000000000008b6214014c006f00630061006c00000014000000	Panel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\SniffedFolderType = "Pictures"	Panel.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202020202	Panel.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Panel.exe
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Panel.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

pid	process
1840	schtasks.exe
2044	schtasks.exe
2252	schtasks.exe
8	schtasks.exe
3528	schtasks.exe
3324	schtasks.exe
1284	schtasks.exe
2424	schtasks.exe
1852	schtasks.exe
3260	schtasks.exe
3948	schtasks.exe
1456	schtasks.exe
244	schtasks.exe
4644	schtasks.exe
3952	schtasks.exe
1036	schtasks.exe
2928	schtasks.exe
4024	schtasks.exe
1096	schtasks.exe
1524	schtasks.exe
1792	schtasks.exe
3872	schtasks.exe
3948	schtasks.exe
4032	schtasks.exe
4316	schtasks.exe
4644	schtasks.exe
3608	schtasks.exe
2908	schtasks.exe
4304	schtasks.exe
372	schtasks.exe
4504	schtasks.exe
5128	schtasks.exe
2424	schtasks.exe
516	schtasks.exe
2104	schtasks.exe
1852	schtasks.exe
1572	schtasks.exe
5248	schtasks.exe
5684	schtasks.exe
5176	schtasks.exe
2596	schtasks.exe
2196	schtasks.exe
3200	schtasks.exe
2896	schtasks.exe
3052	schtasks.exe
1036	schtasks.exe
2908	schtasks.exe
5124	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1776 WINWORD.EXE
1776 WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exechrome.exemsedge.exemssurrogateProvider_protected.exePanel.exePanel.exemsedge.exe

pid	process
4896	msedge.exe
4896	msedge.exe
1788	msedge.exe
1788	msedge.exe
4920	identity_helper.exe
4920	identity_helper.exe
700	msedge.exe
700	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
744	chrome.exe
744	chrome.exe
4412	msedge.exe
4412	msedge.exe
2868	mssurrogateProvider_protected.exe
2868	mssurrogateProvider_protected.exe
2868	mssurrogateProvider_protected.exe
2868	mssurrogateProvider_protected.exe
2868	mssurrogateProvider_protected.exe
2868	mssurrogateProvider_protected.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
2308	Panel.exe
4032	Panel.exe
4032	Panel.exe
2308	Panel.exe
4032	Panel.exe
2308	Panel.exe
2308	Panel.exe
4032	Panel.exe
2308	Panel.exe
4032	Panel.exe
4032	Panel.exe
4032	Panel.exe
2308	Panel.exe
4024	msedge.exe
4024	msedge.exe
4032	Panel.exe
2308	Panel.exe
4032	Panel.exe
2308	Panel.exe
4032	Panel.exe
2308	Panel.exe
4032	Panel.exe
2308	Panel.exe
4032	Panel.exe
2308	Panel.exe
4032	Panel.exe
2308	Panel.exe
4032	Panel.exe
2308	Panel.exe
4032	Panel.exe
2308	Panel.exe
4032	Panel.exe
2308	Panel.exe
4032	Panel.exe
2308	Panel.exe
4032	Panel.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exePanel.exe

pid process

1460 OpenWith.exe
5800 Panel.exe

pid	process
1460	OpenWith.exe
5800	Panel.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

Processes:

msedge.exechrome.exe

pid	process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zG.exeKurome.Loader.exeKurome.Host.exechrome.exe

description	pid	process
Token: SeRestorePrivilege	3608	7zG.exe
Token: 35	3608	7zG.exe
Token: SeSecurityPrivilege	3608	7zG.exe
Token: SeSecurityPrivilege	3608	7zG.exe
Token: SeDebugPrivilege	1856	Kurome.Loader.exe
Token: SeDebugPrivilege	3604	Kurome.Host.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe
Token: SeShutdownPrivilege	744	chrome.exe
Token: SeCreatePagefilePrivilege	744	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe7zG.exechrome.exe

pid	process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
3608	7zG.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of SendNotifyMessage 52 IoCs

Processes:

msedge.exechrome.exe

pid	process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

WINWORD.EXEOpenWith.exemssurrogateProvider_protected.exemsedge.exeOpenWith.exePanel.exespoolsv.exeRuntimeBroker.exeTextInputHost.exeKurome.Host.exe

pid	process
1776	WINWORD.EXE
1776	WINWORD.EXE
1776	WINWORD.EXE
1776	WINWORD.EXE
1776	WINWORD.EXE
1776	WINWORD.EXE
1776	WINWORD.EXE
1776	WINWORD.EXE
1776	WINWORD.EXE
1776	WINWORD.EXE
1776	WINWORD.EXE
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
2868	mssurrogateProvider_protected.exe
4024	msedge.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5328	OpenWith.exe
5800	Panel.exe
5800	Panel.exe
5800	Panel.exe
5800	Panel.exe
5800	Panel.exe
5428	spoolsv.exe
5800	Panel.exe
5800	Panel.exe
1920	RuntimeBroker.exe
1092	TextInputHost.exe
5748	Kurome.Host.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1788 wrote to memory of 1448	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1448	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4368	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4896	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 4896	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe
PID 1788 wrote to memory of 1020	1788	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/RZM-CRACK-TEAM/RedLine-CRACK?tab=readme-ov-file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffc15f146f8,0x7ffc15f14708,0x7ffc15f14718
2⤵
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
2⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
2⤵
PID:1020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
2⤵
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
2⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
2⤵
PID:628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
2⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
2⤵
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6008 /prefetch:8
2⤵
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
2⤵
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5576 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
2⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
2⤵
PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4532 /prefetch:8
2⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3168 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
2⤵
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
2⤵
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
2⤵
PID:100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=184 /prefetch:1
2⤵
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
2⤵
PID:3840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
2⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1752 /prefetch:8
2⤵
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
2⤵
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
2⤵
PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
2⤵
PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1
2⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,17360710556720578987,3342713092513097390,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1080 /prefetch:8
2⤵
PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1796

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Redline-crack-by-rzt\" -ad -an -ai#7zMap28033:102:7zEvent8718
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3608

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\FAQ (English).docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1776

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1460

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\serviceSettings.json
2⤵
PID:3576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc0565ab58,0x7ffc0565ab68,0x7ffc0565ab78
2⤵
PID:364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 --field-trial-handle=1956,i,11356033947740276792,6499535370150135188,131072 /prefetch:2
2⤵
PID:4236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1956,i,11356033947740276792,6499535370150135188,131072 /prefetch:8
2⤵
PID:4944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1956,i,11356033947740276792,6499535370150135188,131072 /prefetch:8
2⤵
PID:1428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1956,i,11356033947740276792,6499535370150135188,131072 /prefetch:1
2⤵
PID:560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=1956,i,11356033947740276792,6499535370150135188,131072 /prefetch:1
2⤵
PID:2696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4424 --field-trial-handle=1956,i,11356033947740276792,6499535370150135188,131072 /prefetch:1
2⤵
PID:2436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1956,i,11356033947740276792,6499535370150135188,131072 /prefetch:8
2⤵
PID:628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4132 --field-trial-handle=1956,i,11356033947740276792,6499535370150135188,131072 /prefetch:8
2⤵
PID:4848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1956,i,11356033947740276792,6499535370150135188,131072 /prefetch:8
2⤵
PID:4496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4932 --field-trial-handle=1956,i,11356033947740276792,6499535370150135188,131072 /prefetch:1
2⤵
PID:3748

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3220

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3584

C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe
"C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2868

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zb1AOIoPI9.bat"
3⤵
PID:5748

C:\Windows\SysWOW64\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
4⤵
PID:3760

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
5⤵
PID:4412

C:\Recovery\WindowsRE\msedge.exe
"C:\Recovery\WindowsRE\msedge.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4024

C:\Users\Admin\AppData\Local\Temp\Panel.exe
"C:\Users\Admin\AppData\Local\Temp\Panel.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2308

C:\Users\Admin\AppData\Local\Temp\Panel.exe
"C:\Users\Admin\AppData\Local\Temp\Panel.exe" "--monitor"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4032

C:\Users\Admin\AppData\Local\Temp\Panel.exe
"C:\Users\Admin\AppData\Local\Temp\Panel.exe" "auth" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAj87fXg1SIkuqlji9BeulJQAAAAACAAAAAAAQZgAAAAEAACAAAABOuDILb8dtAXFcicDNx1+7gRyzvwgjf7b/Ve5XWiKCIwAAAAAOgAAAAAIAACAAAABqpTspEMK+FeuNV2Gh9LJOjmHoP56eqrS8moY0CexxFxAAAADsyc3kjMmo6gG3vdgdFcv2QAAAAJDNLgELDqfDQ/ZyzrvhrgGwCne9FsWvMdH123C8sIh6CBS/RQZChETtznIayRjWTQZ4TpDTC883oMkqhBC7dlk=" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAj87fXg1SIkuqlji9BeulJQAAAAACAAAAAAAQZgAAAAEAACAAAAA2EUe2v8WJubEoD92J6fVL7b6NE1TsueYKB2ecNjJf5gAAAAAOgAAAAAIAACAAAAAHaXfn/z1BPFMsmYUj6T3Eb2m0O7Mm8T2YeWmyXDoOVhAAAAA6NPYRMM/4kCrwhTj4T9ncQAAAAGCkOQcLZmXDzZkJ+iiZA/v/zzVmgRYEj4xtFG4OktLkaruQ7srVGAP7K8oLjYUWHQHwg8pIXN4X8pTNkh8uo6c="
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:5844

C:\Users\Admin\AppData\Local\Temp\Panel.exe
"C:\Users\Admin\AppData\Local\Temp\Panel.exe" "auth" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAj87fXg1SIkuqlji9BeulJQAAAAACAAAAAAAQZgAAAAEAACAAAABOuDILb8dtAXFcicDNx1+7gRyzvwgjf7b/Ve5XWiKCIwAAAAAOgAAAAAIAACAAAABqpTspEMK+FeuNV2Gh9LJOjmHoP56eqrS8moY0CexxFxAAAADsyc3kjMmo6gG3vdgdFcv2QAAAAJDNLgELDqfDQ/ZyzrvhrgGwCne9FsWvMdH123C8sIh6CBS/RQZChETtznIayRjWTQZ4TpDTC883oMkqhBC7dlk=" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAj87fXg1SIkuqlji9BeulJQAAAAACAAAAAAAQZgAAAAEAACAAAAA2EUe2v8WJubEoD92J6fVL7b6NE1TsueYKB2ecNjJf5gAAAAAOgAAAAAIAACAAAAAHaXfn/z1BPFMsmYUj6T3Eb2m0O7Mm8T2YeWmyXDoOVhAAAAA6NPYRMM/4kCrwhTj4T9ncQAAAAGCkOQcLZmXDzZkJ+iiZA/v/zzVmgRYEj4xtFG4OktLkaruQ7srVGAP7K8oLjYUWHQHwg8pIXN4X8pTNkh8uo6c=" "--monitor"
5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Windows\L2Schemas\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\Visualizations\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Visualizations\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\Visualizations\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Public\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Users\Public\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Videos\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Users\Public\Videos\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Videos\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\InputMethod\SHARED\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\InputMethod\SHARED\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\InputMethod\SHARED\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\plugins\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\plugins\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\VLC\plugins\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Kurome.HostK" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\Kurome.Host.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Kurome.Host" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\Kurome.Host.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Kurome.HostK" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\Kurome.Host.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Updates\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Updates\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\Media\Garden\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Media\Garden\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\Media\Garden\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\Registration\CRMLog\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\Registration\CRMLog\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Contacts\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\Contacts\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Contacts\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5176

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5328

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\serviceSettings.json
2⤵
PID:4796

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:6036

C:\Windows\system32\ipconfig.exe
ipconfig
2⤵
- Gathers network information
PID:5380

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\serviceSettings.json
1⤵
PID:3768

C:\Program Files\WindowsPowerShell\spoolsv.exe
"C:\Program Files\WindowsPowerShell\spoolsv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5428

C:\Program Files\Microsoft Office\Updates\RuntimeBroker.exe
"C:\Program Files\Microsoft Office\Updates\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1920

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\build.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6072

C:\Program Files\VideoLAN\VLC\plugins\TextInputHost.exe
"C:\Program Files\VideoLAN\VLC\plugins\TextInputHost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1092

C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe
"C:\Users\Admin\Downloads\Redline-crack-by-rzt\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908

C:\Program Files\Mozilla Firefox\Kurome.Host.exe
"C:\Program Files\Mozilla Firefox\Kurome.Host.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5748

C:\Windows\Media\Garden\sppsvc.exe
C:\Windows\Media\Garden\sppsvc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery