dcrat | hxxps://github[.]com/RZM-CRACK-TEAM/RedLine-CRACK?tab=readme-ov-file

Resubmissions

29/07/2024, 20:26

240729-y71eqstbme10

17/07/2024, 12:19

17/07/2024, 11:31

05/07/2024, 16:51

05/07/2024, 14:28

05/07/2024, 14:22

05/07/2024, 11:39

05/07/2024, 11:30

Analysis

max time kernel
113s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
29/07/2024, 20:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/RZM-CRACK-TEAM/RedLine-CRACK?tab=readme-ov-file
Sample240729-y71eqstbme

Score

10^/10

dcrat redline sectoprat cheat discovery infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

127.0.0.1:1337

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4292	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3972	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3564	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5640	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6048	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5144	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5820	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5148	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5644	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5168	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5880	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6080	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5924	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5868	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6040	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5600	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5500	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5888	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5356	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5160	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5364	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5800	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5936	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5320	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5568	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5608	2836	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7160	2836	schtasks.exe	124

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0004000000025a08-377.dat	family_redline
behavioral1/memory/4644-379-0x0000000000DB0000-0x0000000000DCE000-memory.dmp	family_redline
behavioral1/memory/6108-4623-0x000000001F9C0000-0x000000001F9DA000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0004000000025a08-377.dat	family_sectoprat
behavioral1/memory/4644-379-0x0000000000DB0000-0x0000000000DCE000-memory.dmp	family_sectoprat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/3404-482-0x0000000000DF0000-0x000000000122C000-memory.dmp	dcrat
behavioral1/memory/3404-485-0x0000000000DF0000-0x000000000122C000-memory.dmp	dcrat
behavioral1/memory/3404-4624-0x0000000000DF0000-0x000000000122C000-memory.dmp	dcrat

Executes dropped EXE 5 IoCs

pid	Process
4644	build.exe
4380	build.exe
2884	build.exe
3068	build.exe
1476	build.exe

Loads dropped DLL 32 IoCs

pid	Process
4944	Kurome.Host.exe
4944	Kurome.Host.exe
4944	Kurome.Host.exe
4944	Kurome.Host.exe
1320	Kurome.Builder.exe
1320	Kurome.Builder.exe
1320	Kurome.Builder.exe
1320	Kurome.Builder.exe
4644	build.exe
4644	build.exe
4644	build.exe
4644	build.exe
4380	build.exe
4380	build.exe
4380	build.exe
4380	build.exe
2884	build.exe
2884	build.exe
2884	build.exe
2884	build.exe
3068	build.exe
3068	build.exe
3068	build.exe
3068	build.exe
1476	build.exe
1476	build.exe
1476	build.exe
1476	build.exe
5040	Kurome.Loader.exe
5040	Kurome.Loader.exe
5040	Kurome.Loader.exe
5040	Kurome.Loader.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll	Kurome.Loader.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll	Kurome.Loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kurome.Builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kurome.Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	panel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kurome.Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kurome.Host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6768	GoogleUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	panel.exe
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Redline-crack-by-rzt.zip:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1680	schtasks.exe
3228	schtasks.exe
5356	schtasks.exe
3368	schtasks.exe
1392	schtasks.exe
1488	schtasks.exe
5640	schtasks.exe
5144	schtasks.exe
6040	schtasks.exe
7160	schtasks.exe
1888	schtasks.exe
3564	schtasks.exe
5148	schtasks.exe
5168	schtasks.exe
5600	schtasks.exe
5800	schtasks.exe
3276	schtasks.exe
640	schtasks.exe
6048	schtasks.exe
5936	schtasks.exe
5608	schtasks.exe
952	schtasks.exe
1008	schtasks.exe
2392	schtasks.exe
3228	schtasks.exe
5320	schtasks.exe
5568	schtasks.exe
952	schtasks.exe
5644	schtasks.exe
5880	schtasks.exe
5500	schtasks.exe
2540	schtasks.exe
3676	schtasks.exe
4360	schtasks.exe
3972	schtasks.exe
3328	schtasks.exe
6080	schtasks.exe
5868	schtasks.exe
5888	schtasks.exe
2424	schtasks.exe
4292	schtasks.exe
4360	schtasks.exe
572	schtasks.exe
5820	schtasks.exe
5924	schtasks.exe
5160	schtasks.exe
5364	schtasks.exe
4288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
3408	msedge.exe
3408	msedge.exe
876	identity_helper.exe
876	identity_helper.exe
248	msedge.exe
248	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	244	Kurome.Loader.exe
Token: SeDebugPrivilege	4944	Kurome.Host.exe
Token: SeDebugPrivilege	1320	Kurome.Builder.exe
Token: SeDebugPrivilege	4644	build.exe
Token: SeDebugPrivilege	4380	build.exe
Token: SeDebugPrivilege	2884	build.exe
Token: SeDebugPrivilege	3068	build.exe
Token: SeDebugPrivilege	1476	build.exe
Token: SeDebugPrivilege	5040	Kurome.Loader.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 1948	3408	msedge.exe	81
PID 3408 wrote to memory of 1948	3408	msedge.exe	81
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 3192	3408	msedge.exe	83
PID 3408 wrote to memory of 2580	3408	msedge.exe	84
PID 3408 wrote to memory of 2580	3408	msedge.exe	84
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85
PID 3408 wrote to memory of 2212	3408	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/RZM-CRACK-TEAM/RedLine-CRACK?tab=readme-ov-file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa26373cb8,0x7ffa26373cc8,0x7ffa26373cd8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2552 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,12584534849818838133,4656561188849996436,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6020 /prefetch:2
  2⤵
  PID:3276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2228

C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe
"C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:244

C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe
"C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Host\Kurome.Host.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe
"C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Builder\Kurome.Builder.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Builder\build.exe
"C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Builder\build.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Builder\build.exe
"C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Builder\build.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Builder\build.exe
"C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Builder\build.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Builder\build.exe
"C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Builder\build.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3068

C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Builder\build.exe
"C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Builder\build.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe
"C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Loader\Kurome.Loader.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Users\Admin\Desktop\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe
"C:\Users\Admin\Desktop\Redline-crack-by-rzt\Panel\RedLine_20_2\Panel\panel.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4332
- C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe
  "C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe"
  2⤵
  PID:3404
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tCWDdPhdjn.bat"
    3⤵
    PID:572
  - - C:\Windows\SysWOW64\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:6016
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:5360
- C:\Users\Admin\AppData\Local\Temp\Panel.exe
  "C:\Users\Admin\AppData\Local\Temp\Panel.exe"
  2⤵
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\Panel.exe
    "C:\Users\Admin\AppData\Local\Temp\Panel.exe" "--monitor"
    3⤵
    PID:6108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Start Menu\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Start Menu\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Public\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\uninstall\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\uninstall\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Templates\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default\Templates\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Templates\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.106\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.106\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.106\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\Tasks\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Tasks\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5320

C:\Users\Admin\Desktop\Redline-crack-by-rzt\Panel\RedLine_20_2\Tools\Chrome.exe
"C:\Users\Admin\Desktop\Redline-crack-by-rzt\Panel\RedLine_20_2\Tools\Chrome.exe"
1⤵
PID:5628
- C:\Program Files (x86)\GUMB934.tmp\GoogleUpdate.exe
  "C:\Program Files (x86)\GUMB934.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={147E1A31-5E49-ACD4-7646-E2EE6FA22B56}&lang=ru&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
  2⤵
  PID:5232
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
    3⤵
    PID:6216
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
    3⤵
    PID:6152
  - - C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateComRegisterShell64.exe"
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateComRegisterShell64.exe"
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateComRegisterShell64.exe
      "C:\Program Files (x86)\Google\Update\1.3.34.11\GoogleUpdateComRegisterShell64.exe"
      4⤵
      PID:2376
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNC4xMSIgc2hlbGxfdmVyc2lvbj0iMS4zLjM0LjExIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezYwRDM5MzAyLTVFRkItNEQxNi05MDVBLUQ5QTQ0NDNCMEEyMX0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntBMjZCQkQ1OC0zNEMyLTRENUYtQkJGOC1CNUYzRERCQjFBODJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjM3MSIgbmV4dHZlcnNpb249IjEuMy4zNC4xMSIgbGFuZz0icnUiIGJyYW5kPSIiIGNsaWVudD0iIiBpaWQ9InsxNDdFMUEzMS01RTQ5LUFDRDQtNzY0Ni1FMkVFNkZBMjJCNTZ9Ij48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM0NTMiLz48L2FwcD48L3JlcXVlc3Q-
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6768
- - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={147E1A31-5E49-ACD4-7646-E2EE6FA22B56}&lang=ru&browser=3&usagestats=0&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{60D39302-5EFB-4D16-905A-D9A4443B0A21}"
    3⤵
    PID:6900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Music\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\Music\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Music\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7160

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
PID:6164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

npGoogleUpdate3.dll

Path C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll
Size 450KB
SHA256 051c42124192595ec6d22577e4870fad2a8ac52f04a43cb77372a99d48a9b718
MD5 cdbe4728d075ca5050b3b9fa7138f8b8
SHA1 f4e9c3646e948ae324f85d32c1adb4fbc880242f
SHA512 7c7c11e5c7a8e91f3b361ce1dd4db230b1fc2c82c1dfc99d8771632fbb77c353a142dab34ca0322357b73c44cb0432e610e4a510df35e63cc34feaf4e91c847c
SSDEEP 12288:g7NuSkTrXuuRcPXRl6YImKgJ5jGoo3G/SATsHqwvrrIRyH:g7NuSkTjuuRcyYImd3mJATuPvrrIRyH
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Size 151KB
SHA256 794cf7644115198db451431bca7c89ff9a97550482b1e3f7f13eb7aca6120a11
MD5 82f657b0aee67a6a560321cf0927f9f7
SHA1 703175455354cdbd4244668c94704fee585a9228
SHA512 5407eac0dc840aee05265bdc0810865890fed09d7b83ff0dc3f3e4ed4a322a3716710c35208fe8a95ffb0ab2a051e5305825c3251ceb2dd7e0cde6e9cc4f97c2
SSDEEP 3072:TAt2Spbm5QeKZYZQvNSEhDt95LkIACB+Tzl0x3sbGls4NVasuNsyase5sS7s0asc:Gy87N5jB+TixcbisIVXueyXeSSo0XLXw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kurome.Loader.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Kurome.Loader.exe.log
Size 425B
SHA256 85ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4
MD5 bb27934be8860266d478c13f2d65f45e
SHA1 a69a0e171864dcac9ade1b04fc0313e6b4024ccb
SHA512 87dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 41799b5bbdb95da6a57ae553b90de65b80264ca65406f11eea46bcb87a5882a7
MD5 b0499f1feacbab5a863b23b1440161a5
SHA1 37a982ece8255b9e0baadb9c596112395caf9c12
SHA512 4cf9a8547a1527b1df13905c2a206a6e24e706e0bc174550caeefabfc8c1c8a40030e8958680cd7d34e815873a7a173abe40c03780b1c4c2564382f1ceed9260
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5cb8554e763313f3d46766ab868f9d481e3644bfc037f7b8fe43d75d87405a27
MD5 f53eb880cad5acef8c91684b1a94eed6
SHA1 afab2b1015fecbc986c1f4a8a6d27adff6f6fde9
SHA512 d53f3965428f73c0dfed1d941a9ff06eb70b254732410b815bc759b8c7904e11292ad7e9624c12cccaed6763e7bea68208bc0b67fc70b7616d25bda143833794
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 27cc2fdcbdb955d763a5d4e1a94efb7d8709e3bc0a0e1ee278661d8c29b693e9
MD5 c820569f2de7dd918cc5313f96d0bb29
SHA1 ae699613d5a63a4ad350f260d12978e5db8be94a
SHA512 8882a70b49058f78e4ab5c7b4a7eb141aa7022ccf15cac370690755c09235ef0ebea53b5546b311695891a91ff53cc9b543f7432731482c0f5699f6211b7ec03
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 587B
SHA256 141bd3617e43da171060e059467e8dd13574a4f50ba110432152d85942b02150
MD5 411699e443951b38367fd522cfe4b9eb
SHA1 ecdbb21543f95699417ff8af645788e2fe54ef81
SHA512 664e0b173252dfbe9d4b7717567c0f449efd8d9d26954d083906ab5cd48d9a18a5f5090e9a583f2106b06a8c3aea465c9db8ec9069d1089283480ff46dd68999
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b5d0a463f36160176829dcb9bfa9ab793b036ebccdc89784da93118e2e57daf7
MD5 e4046ced8a4ee9dc52467341060f21a2
SHA1 737c7e91c458bd382ea8a9b9dddbbfeb9f481b2e
SHA512 3fcda412ead2ad3efa9a7783917c5aac34139173e4be94be5b40f9bb5c4eefdb9e1ab73799175687722a3e72db1d11784a9ac94e35f6db91d8bc88a5219696b4
SSDEEP 96:nIk3ndKIk5LwSv0MoiVmdHImJCDJ0WQyV+VuziX3wI3:nIk38IkRv0MAIUCDJLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c1f13c10e6a1785426d81fd3547a8a9d884e472e9bce366b9c292444a687dbfe
MD5 3b650dedf6b6667e6dff1754baa1d13a
SHA1 a26cad18bf33e73affe1b3d809bf20a12b3edf72
SHA512 1f2a30136aa1a6bb339209dabc4cee40d2a1806d599d5d8792d79052301d734ebdb64c7d8129302d1c44e469a9016e4504f53c4800adf04260e4dbcec011b891
SSDEEP 96:nIk3rKIkpLwSv0MoiVmdTu51jI2JODJ0WQyV+VpAiX3wI3:nIk3uIkhv0M+u5hIEODJLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 05ee4004f6a82ea3ad40a0cb05f1971d504b79aeb812cb3a20a3ad40747e9b2e
MD5 4fa17f6c56e66fd1a9a1868afd406ca2
SHA1 d514e9c0662e1352d4fe61eac76c3d8a5c3a1e7f
SHA512 68498ba650b8703a9f8df25aed7cd79cfaefd1a27689f03723e4372d347b38146ff44a315ccd7d1473d4ae588c02542151568288ccb58cb00f713278ad13abf6
SSDEEP 96:nIk3rKIkpLwSv0MoiVmdTu51jI2JCDJ0WQyV+VpAiX3wI3:nIk3uIkhv0M+u5hIECDJLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 886f68581dbd5704728591daa5c0b1c180b9293b62a719a195de882113889fc9
MD5 3cf0954b7f4e7fb0c63d538df4e47714
SHA1 6e3bf0bd1cca4dc78ce1bfded253c1dc4bde3cca
SHA512 43737d597bf75ddb891559612591808be5bdb502a128063451861882335ff5560b22b4845ccf6bf2276b05cbffe9b362200713bf09b98d956cdc7af4642370f4
SSDEEP 96:nIk34KIkpLwSv0MoiVmdTu51jI2JODJ0WQyV+VpAiX3wI3:nIk3VIkhv0M+u5hIEODJLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d1f24c0634c00117e7ddec013cfc2bb96ca8bfdc4b9473abd80bafba7dcf0ef3
MD5 a02fe5c883b779ff5a72ed9dea5fbe49
SHA1 350e6ccf7da0d5c8f59730b8d2278108affafd10
SHA512 e8ea96cfa33b9f5be7eca5ffc97e3aeebdc60f403baf9ab400339e0cc5fbea74768579673d73c8a70c15541b354026be986222eca23a501db70c080db60e74b9
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 25107b17d7b7f2c989f9211d424fe566b427f818d7c7fa910a5341f971a37951
MD5 db96be0d8502056754244dbb6db60134
SHA1 01b97f033eacf425c189ea3fd5e77314da4b1b08
SHA512 1d502ca6b5c96450b72e326164abb54529dbc1e597f6088a884bd861bd20f6363f47d79ff1639ae5873812912c30b20bf7a128cde67167177868e14f2292db76
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581cab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581cab.TMP
Size 1KB
SHA256 3056456d7333e42547268b3b8378ef3ef5ba99b93acd2431513b76c32cc6d5cc
MD5 92f0dea5eae30f7d9090699306256759
SHA1 ddcaeaf80b09d30410438a277d0549886ccedfad
SHA512 196bd93cdc38b862476d1890dea8d1f8c151406010788b5e8b473f52a6326263093fb7c35886f1898631bfbc8f624ec697e036892424a8026ac6d2181f597842
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 747e5f7b2fa602331418ee128dc6d1c0b26033237dfa96abe30ec8681c2c42e2
MD5 ba723557bbb21e3ff8c2ecdaa2741981
SHA1 6d746762267e83813900823b3a648f45659b866a
SHA512 4398e767ad44ad56557a634c661c2decd471dd7b2b52a3c757c0f499955019c355f967994213a93a678685e833245ffbea5b29ab74d52ed0eb4e0d05d0d71ffd
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG3EYe2RUmhRW84ZuhMWbriodr:M9iIxuERzA83h09RZxASGjDeZuhM4mAr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c52dfb9871b71713876322e0f9d4ed21c8c78f216ea77a0f2be82f9de4c37154
MD5 797294550d11907965a988e2ae7bf635
SHA1 3f5a2fbd904cef75f1b0cc4f5381cbd7e89efe8b
SHA512 40b7c29a59cf157169617cc9a47c4dd64aa6f074a1012494cdc013c72db2511b9bc10235081347c0ca55c428dedaac9d3b139076804c4631c3671eafa88f965e
SSDEEP 192:noCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG3EYe2RUmhRW84ZEhMWbriodr:/9iIxuERzA83h09RZxASGjDeZEhM4mAr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 df0206bc834ddb32cce7152f1fb2ffdd64fc51d8519ef439ba314864f5641a7c
MD5 db2ab013489a854397e739fb3b2532b2
SHA1 dbcfea7eec5ff11b52ade6e3c4841d0e3d1f230e
SHA512 b5c1f86177c02ed86080428f4612675cd596301dfec471908ec6b2f08f5e973edb091f21560a693ce17d882eb2ebfa1952be558dffe625cfbcd86313b05eae9c
SSDEEP 192:goCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG3EYe2RUmhRW84ZEhMWbriodr:Y9iIxuERzA83h09RZxASGjDeZEhM4mAr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Panel.exe

Path C:\Users\Admin\AppData\Local\Temp\Panel.exe
Size 9.3MB
SHA256 c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
MD5 f4e19b67ef27af1434151a512860574e
SHA1 56304fc2729974124341e697f3b21c84a8dd242a
SHA512 a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
SSDEEP 196608:mJQaPHrQqXs140qMhu8369sV+HLz9SKUeNdDhHidVI1SM52n3iWuUZ/c1sxXoP3p:mJQaPHrQqXs140qMhu8369sV+HLz9SKI
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssurrogateProvider_protected.exe

Path C:\Users\Admin\AppData\Local\Temp\mssurrogateProvider_protected.exe
Size 1.5MB
SHA256 2ec28f57e64fee2b2f1a40c78c079672f0dddb84da2a84fe3291bd68a4771a73
MD5 fcbf03d90d4e9ce80f575452266e71d1
SHA1 1b067d0e057db189c71b2f7ac4ee2483ebaf0fa7
SHA512 9ce9962f645ab542f135d8560a7095259fe6628afcf598a58dfcf8e96b0d1dfa73e59ce13af3ff97e6c03046634dbd46a278c6535f99f99b3a6051b7bbfcf380
SSDEEP 24576:wIf8az3J6WIDr2UQUDwAgrrE/2ZwRMuM5TIdDYbEiu8m4:R8OZ6WXUmtrM6jDVId8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

build.exe

Path C:\Users\Admin\Desktop\Redline-crack-by-rzt\Kurome.Builder\build.exe
Size 95KB
SHA256 d53b5ccdc46e2575b7c917ae6414b93028b9fe4df2deda7107a7a470080a9f3a
MD5 ca8b99c9d67aee4b846581461ec6bb2b
SHA1 7c0fd208b99bc69aaf003693aeafbe73cde4658f
SHA512 027f3e669560a0668706665101bfb7ca258943f80cc660085428516015fb7a106266b34334afabfd95bf43c348d53d2fe6f9cbf7a6a737314d19524e4bc36a83
SSDEEP 1536:1qsGfq+TmlbG6jejoigI/43Ywzi0Zb78ivombfexv0ujXyyed2T3tmulgS6pg:z0taY/+zi0ZbYe1g0ujyzdLg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Redline-crack-by-rzt.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Redline-crack-by-rzt.zip:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

Unconfirmed 777110.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 777110.crdownload
Size 21.7MB
SHA256 54b542bd706838bc61c23ef8189935fc74e0099b14e509d33649b43ff108d85f
MD5 1118549e87cbad92e6959506172d8c5d
SHA1 a5598c8355d03dc1ed03b0f7842d478d6a9e17fe
SHA512 029527677e3a316a0929a111701c87c5fe6c11ecc361a3c009de75ee06d110245d0f250fca836a1aa0a90f86237e3102bcdf60ed645a9b42ad04bd50793aa09c
SSDEEP 393216:l+4Ui5ywU1ePiV9BS9EUCEN3BULF937+zur/A5ELmLDepjHRKxH4ofr5sN5ltwFK:o4UiouCG3BULez1imLDoHk4SSTTwF6LB
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
Size 3.4MB
SHA256 2eaf3d548927ebd243362f7bcb906bb1bbff3961223fb9521cb2846b6b8d523d
MD5 059d51f43f1a774bc5aa76d19c614670
SHA1 171329bf0f48190cf4d59ce106b139e63507457d
SHA512 a299cb18c8a47fc27c46db0011266b7fa273852b302374eb98a54034e1281150af8e54e58f76a384d3b92fbcb1a67fc0452cabe592a379e15cce2c5f9a4b6cb7
SSDEEP 49152:YL8v4Lnc5UC1kbaPV/VY5jdwDSgB7PLGAvXZA3W:dv4GUGPVqqA3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/244-299-0x00000000074A0000-0x0000000007AB0000-memory.dmp

Download

memory/244-298-0x0000000000200000-0x0000000000436000-memory.dmp

Download

memory/1320-375-0x0000000005B50000-0x0000000005BAE000-memory.dmp

Download

memory/1320-374-0x00000000050E0000-0x00000000050EA000-memory.dmp

Download

memory/1320-373-0x0000000004EF0000-0x0000000004F82000-memory.dmp

Download

memory/1320-372-0x0000000005BE0000-0x0000000006186000-memory.dmp

Download

memory/1320-367-0x00000000003D0000-0x00000000003F8000-memory.dmp

Download

memory/2896-519-0x000000001DAE0000-0x000000001DC22000-memory.dmp

Download

memory/2896-546-0x000000001AE20000-0x000000001AE2A000-memory.dmp

Download

memory/2896-556-0x000000001DBE0000-0x000000001DBEA000-memory.dmp

Download

memory/2896-606-0x000000001F420000-0x000000001F59C000-memory.dmp

Download

memory/2896-488-0x000000001AE40000-0x000000001AFE0000-memory.dmp

Download

memory/2896-589-0x000000001DC10000-0x000000001DC2C000-memory.dmp

Download

memory/2896-489-0x000000001AE40000-0x000000001AFE0000-memory.dmp

Download

memory/2896-514-0x000000001DAE0000-0x000000001DC22000-memory.dmp

Download

memory/2896-566-0x000000001F180000-0x000000001F212000-memory.dmp

Download

memory/2896-565-0x000000001E9D0000-0x000000001EF76000-memory.dmp

Download

memory/2896-515-0x000000001DAE0000-0x000000001DC22000-memory.dmp

Download

memory/2896-544-0x000000001AE20000-0x000000001AE2A000-memory.dmp

Download

memory/2896-564-0x000000001E660000-0x000000001E9C2000-memory.dmp

Download

memory/2896-526-0x000000001DEB0000-0x000000001DFF2000-memory.dmp

Download

memory/2896-543-0x000000001AE20000-0x000000001AE2A000-memory.dmp

Download

memory/2896-548-0x000000001AE20000-0x000000001AE2A000-memory.dmp

Download

memory/2896-503-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/2896-504-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/2896-506-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/2896-486-0x00007FFA11030000-0x00007FFA11AF2000-memory.dmp

Download

memory/2896-487-0x000000001AE40000-0x000000001AFE0000-memory.dmp

Download

memory/2896-510-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/2896-508-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/3404-485-0x0000000000DF0000-0x000000000122C000-memory.dmp

Download

memory/3404-482-0x0000000000DF0000-0x000000000122C000-memory.dmp

Download

memory/3404-479-0x0000000000DF0000-0x000000000122C000-memory.dmp

Download

memory/3404-529-0x0000000007320000-0x0000000007386000-memory.dmp

Download

memory/3404-4624-0x0000000000DF0000-0x000000000122C000-memory.dmp

Download

memory/4332-411-0x0000000000400000-0x0000000001470000-memory.dmp

Download

memory/4644-379-0x0000000000DB0000-0x0000000000DCE000-memory.dmp

Download

memory/4944-341-0x00000000068B0000-0x0000000006EC8000-memory.dmp

Download

memory/4944-323-0x0000000000FD0000-0x0000000000FF4000-memory.dmp

Download

memory/4944-350-0x00000000060C0000-0x0000000006110000-memory.dmp

Download

memory/4944-340-0x0000000005960000-0x0000000005986000-memory.dmp

Download

memory/4944-342-0x0000000005A40000-0x0000000005A52000-memory.dmp

Download

memory/4944-343-0x0000000005B00000-0x0000000005B3C000-memory.dmp

Download

memory/4944-344-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Download

memory/4944-345-0x0000000006520000-0x00000000067A6000-memory.dmp

Download

memory/4944-346-0x0000000005F90000-0x0000000005FDC000-memory.dmp

Download

memory/4944-347-0x0000000006290000-0x000000000635E000-memory.dmp

Download

memory/4944-348-0x0000000006360000-0x000000000646A000-memory.dmp

Download

memory/4944-349-0x0000000006040000-0x0000000006068000-memory.dmp

Download

memory/4944-352-0x00000000064C0000-0x00000000064F0000-memory.dmp

Download

memory/4944-339-0x0000000006110000-0x000000000628C000-memory.dmp

Download

memory/4944-329-0x0000000005C20000-0x0000000005F82000-memory.dmp

Download

memory/4944-351-0x0000000006ED0000-0x0000000006FD0000-memory.dmp

Download

memory/6108-4606-0x000000001FE50000-0x00000000200D6000-memory.dmp

Download

memory/6108-4623-0x000000001F9C0000-0x000000001F9DA000-memory.dmp

Download

memory/6108-4625-0x00000000202E0000-0x00000000208F8000-memory.dmp

Download

memory/6108-4627-0x0000000020A10000-0x0000000020A4C000-memory.dmp

Download

memory/6108-4626-0x0000000020900000-0x0000000020A00000-memory.dmp

Download

memory/6108-4642-0x0000000020A90000-0x0000000020AA2000-memory.dmp

Download

memory/6108-4671-0x0000000020BE0000-0x0000000020C90000-memory.dmp

Download

memory/6108-4656-0x0000000020AF0000-0x0000000020B2A000-memory.dmp

Download

memory/6108-4628-0x0000000020A50000-0x0000000020A62000-memory.dmp

Download

memory/6108-4707-0x0000000021200000-0x0000000021274000-memory.dmp

Download

memory/6108-4604-0x000000001FDE0000-0x000000001FE46000-memory.dmp

Download