4d8daf45a5fcf7480739974e1d9ecac7370462f66196dd14b9a38020120dc202

Resubmissions

02/06/2024, 23:20

240602-3bvxlaag6v7

02/06/2024, 23:16

240602-29dwasbg874

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Redact-Setup-0.17.4.exe
Size 71.1MB
Sample240602-3bvxlaag6v
SHA256 4d8daf45a5fcf7480739974e1d9ecac7370462f66196dd14b9a38020120dc202
MD5 34dc26c43d1c95019b5a390eb5e5fcc2
SHA1 c74edda8d14c6683eeb482344f009b1ac0f97491
SHA512 3fdb707661075555112672ed0157ba45bb65581d58b5f6c045a32cdd830acb24bdbcdb62dd48ab743d221f13e4d0d0824f0bb2edff5da1ce5f923ab43e3babcc
SSDEEP 1572864:WXeyzeKgzQOKuPjz++x1vWx4gYaVsxYTCs68KGz6kz:WXF8zQOKundve4gayjpz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
38	checkip.amazonaws.com
43	checkip.amazonaws.com

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Redact.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Redact.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Redact.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
7304	powershell.exe
6028	powershell.exe
7276	powershell.exe
6900	powershell.exe
8028	powershell.exe
6244	powershell.exe
5668	powershell.exe
5788	powershell.exe
7036	powershell.exe
6572	powershell.exe
6272	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 6 IoCs

pid	Process
840	Redact.exe
5520	Redact.exe
5020	Redact.exe
5564	Redact.exe
5232	Redact.exe
5624	Redact.exe

Loads dropped DLL 21 IoCs

pid	Process
3948	Redact-Setup-0.17.4.exe
3948	Redact-Setup-0.17.4.exe
3948	Redact-Setup-0.17.4.exe
3948	Redact-Setup-0.17.4.exe
3948	Redact-Setup-0.17.4.exe
3948	Redact-Setup-0.17.4.exe
3948	Redact-Setup-0.17.4.exe
840	Redact.exe
5020	Redact.exe
5520	Redact.exe
5520	Redact.exe
5520	Redact.exe
5520	Redact.exe
5520	Redact.exe
5564	Redact.exe
840	Redact.exe
5232	Redact.exe
840	Redact.exe
5624	Redact.exe
5624	Redact.exe
5624	Redact.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Redact.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Redact.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Redact.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Redact.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Redact.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Redact.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Redact.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2396	tasklist.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
2400	msedge.exe
2400	msedge.exe
3948	Redact-Setup-0.17.4.exe
3948	Redact-Setup-0.17.4.exe
2396	tasklist.exe
2396	tasklist.exe
5004	identity_helper.exe
5004	identity_helper.exe
840	Redact.exe
840	Redact.exe
840	Redact.exe
840	Redact.exe
840	Redact.exe
840	Redact.exe
7304	powershell.exe
7304	powershell.exe
7304	powershell.exe
8028	powershell.exe
8028	powershell.exe
8028	powershell.exe
6244	powershell.exe
6244	powershell.exe
6244	powershell.exe
5668	powershell.exe
5668	powershell.exe
5668	powershell.exe
6028	powershell.exe
6028	powershell.exe
6028	powershell.exe
5788	powershell.exe
5788	powershell.exe
5788	powershell.exe
7036	powershell.exe
7036	powershell.exe
7036	powershell.exe
7276	powershell.exe
7276	powershell.exe
7276	powershell.exe
6900	powershell.exe
6900	powershell.exe
6900	powershell.exe
6572	powershell.exe
6572	powershell.exe
6572	powershell.exe
6272	powershell.exe
6272	powershell.exe
6272	powershell.exe
6680	chrome.exe
6680	chrome.exe
384	msedge.exe
384	msedge.exe
4908	msedge.exe
4908	msedge.exe
4576	identity_helper.exe
4576	identity_helper.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3840	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	tasklist.exe
Token: SeSecurityPrivilege	3948	Redact-Setup-0.17.4.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe
Token: SeShutdownPrivilege	840	Redact.exe
Token: SeCreatePagefilePrivilege	840	Redact.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
840	Redact.exe
840	Redact.exe
840	Redact.exe
2400	msedge.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
840	Redact.exe
840	Redact.exe
840	Redact.exe
840	Redact.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
6680	chrome.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4612	2400	msedge.exe	89
PID 2400 wrote to memory of 4612	2400	msedge.exe	89
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 1420	2400	msedge.exe	90
PID 2400 wrote to memory of 4556	2400	msedge.exe	91
PID 2400 wrote to memory of 4556	2400	msedge.exe	91
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92
PID 2400 wrote to memory of 1772	2400	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\Redact-Setup-0.17.4.exe
"C:\Users\Admin\AppData\Local\Temp\Redact-Setup-0.17.4.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Redact.exe" | %SYSTEMROOT%\System32\find.exe "Redact.exe"
  2⤵
  PID:3596
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Redact.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
- - C:\Windows\SysWOW64\find.exe
    C:\Windows\System32\find.exe "Redact.exe"
    3⤵
    PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa74e146f8,0x7ffa74e14708,0x7ffa74e14718
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4011594620322951704,5303997492256352989,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4011594620322951704,5303997492256352989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4011594620322951704,5303997492256352989,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4011594620322951704,5303997492256352989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4011594620322951704,5303997492256352989,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4011594620322951704,5303997492256352989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4011594620322951704,5303997492256352989,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4011594620322951704,5303997492256352989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4011594620322951704,5303997492256352989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4011594620322951704,5303997492256352989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4011594620322951704,5303997492256352989,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4011594620322951704,5303997492256352989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:5212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2112

C:\Users\Admin\AppData\Local\Programs\redact\Redact.exe
"C:\Users\Admin\AppData\Local\Programs\redact\Redact.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:840
- C:\Users\Admin\AppData\Local\Programs\redact\Redact.exe
  "C:\Users\Admin\AppData\Local\Programs\redact\Redact.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\redact" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,12963224349388588250,14111948537170616585,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5520
- C:\Users\Admin\AppData\Local\Programs\redact\Redact.exe
  "C:\Users\Admin\AppData\Local\Programs\redact\Redact.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --host-rules="MAP localhost 127.0.0.1" --user-data-dir="C:\Users\Admin\AppData\Roaming\redact" --mojo-platform-channel-handle=2324 --field-trial-handle=1976,i,12963224349388588250,14111948537170616585,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5020
- C:\Users\Admin\AppData\Local\Programs\redact\Redact.exe
  "C:\Users\Admin\AppData\Local\Programs\redact\Redact.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\redact" --app-path="C:\Users\Admin\AppData\Local\Programs\redact\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3012 --field-trial-handle=1976,i,12963224349388588250,14111948537170616585,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  PID:8004
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:6492
- C:\Users\Admin\AppData\Local\Programs\redact\Redact.exe
  "C:\Users\Admin\AppData\Local\Programs\redact\Redact.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\redact" --app-user-model-id=Redact --app-path="C:\Users\Admin\AppData\Local\Programs\redact\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=1976,i,12963224349388588250,14111948537170616585,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:8028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:7276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe /c "Get-CimInstance -className win32_process | select Name,ProcessId,ParentProcessId,CommandLine,ExecutablePath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:6680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffa757aab58,0x7ffa757aab68,0x7ffa757aab78
    3⤵
    PID:6416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=2000,i,15921601151457487250,10684188942537365303,131072 /prefetch:2
    3⤵
    PID:4372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=2000,i,15921601151457487250,10684188942537365303,131072 /prefetch:8
    3⤵
    PID:7860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2028 --field-trial-handle=2000,i,15921601151457487250,10684188942537365303,131072 /prefetch:8
    3⤵
    PID:6012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3176 --field-trial-handle=2000,i,15921601151457487250,10684188942537365303,131072 /prefetch:1
    3⤵
    PID:4048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=2000,i,15921601151457487250,10684188942537365303,131072 /prefetch:1
    3⤵
    PID:5328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4292 --field-trial-handle=2000,i,15921601151457487250,10684188942537365303,131072 /prefetch:1
    3⤵
    PID:7400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa74ff46f8,0x7ffa74ff4708,0x7ffa74ff4718
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16907218191209981270,1868736098601690435,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,16907218191209981270,1868736098601690435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,16907218191209981270,1868736098601690435,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2096,16907218191209981270,1868736098601690435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2096,16907218191209981270,1868736098601690435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:6268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2096,16907218191209981270,1868736098601690435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
    3⤵
    PID:6404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2096,16907218191209981270,1868736098601690435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
    3⤵
    PID:6156
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16907218191209981270,1868736098601690435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,16907218191209981270,1868736098601690435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2096,16907218191209981270,1868736098601690435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2096,16907218191209981270,1868736098601690435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:7268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9222 --field-trial-handle=2096,16907218191209981270,1868736098601690435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:7744
- C:\Users\Admin\AppData\Local\Programs\redact\Redact.exe
  "C:\Users\Admin\AppData\Local\Programs\redact\Redact.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\redact" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3004 --field-trial-handle=1976,i,12963224349388588250,14111948537170616585,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5624

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:7100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5640

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3840

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5688

C:\Windows\System32\cwwwvr.exe
"C:\Windows\System32\cwwwvr.exe"
1⤵
PID:6940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 258B
SHA256 aafd908b3b4366cc5a8a7180560e047e71a1be50240b5bb4d9166dc62b87fb23
MD5 ac55806915ee1312b3e25501e0617023
SHA1 38fbadec2f3565d24507fb72eb3e83da939abb85
SHA512 fedfbd335ad3a2887497d1506abe544e1a3198057c70b92a34b39b8d5dd472cfd69ff384bf25ccda2aac10a5839b5ce193f31c07774a415c8c2dd5566198707d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 b53648ef88f1a5e74bdf916be1817ba6de846af261ea84a1d264ab70881c0ab4
MD5 5fb7286caf45dfc89f026a5e48b6f016
SHA1 c6472c847b32ecd4ac36abcca173bba787599674
SHA512 3fe11825482a4f5d7f88a1fdb1cb5562560347cf4e295167dfe82d4830ac822bde2f61b0212bd0e2676884c5fa08c206e0d23559afa8e314e0b2d27391e26de8
SSDEEP 192:c+fAr7sDoaJIo8syh+FPHQXkb5tjEsXtScR:c+fAfkJICyqftIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 127fcb15d018998ab621fd2ee4edabfc15cc872cac2a5b756a47a0bc70389ec4
MD5 21294a695dae062dad0dcc5227733c9b
SHA1 596353d6d4fa09b639532a39d0f1fff24ffd9bfd
SHA512 fd32cd304c3b2d9121f345ad9496672dbba7cb576b1e475258a4e9c8bc6bc99415e449404114c4369a443bd34d15ed74629659af4dc7a0314eadeb8aa2c60c98
SSDEEP 6144:YZ5IZXqXHjTdCP3y/3QYRPILxZnhLMJjX0EeGzY2rLO:AsqlGS3Q5fnReEFsLLO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 2cea3403810eb87069899bab9540391e7986ab9f1cf61dc3dc19663031d63ade
MD5 6eeb8895c140e6a336bc398aa68fc2f8
SHA1 55ea3a9c0ff31d61b85df1514014bd90c5db290e
SHA512 6e6210de09d7fa55779c3e776891eaec797d98ef8fb7ece97fd1c18facf15c5faf1eb16b63f600b523328347560361b470e91c60b52932886a271cb1ffc71d5d
SSDEEP 6144:8Z5IZXqXHjTdCP3y/aQYRPILxZnhLMJjX0EeGzY2rLO:MsqlGSaQ5fnReEFsLLO
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 da2a6cb3d25fcd1811779c683b29e28eb112d5662eae1711e5f3db49afab3ef7
MD5 7ad009e5f99bc614faa3d51239a43f78
SHA1 6fb6ba23b4fe5fc5b201c5568abd05aba70a017c
SHA512 68877a9cb2d3e38f9df885cc732f3f34ccba5e30b29d1a65f4ec4eb24bb4b324d3a944f17658b65245d16fb9ba1af6e479ece8a3616214f66fb286f1ad629e0a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 08b6101b3a83d7d557967fc06d464dba1e81ca167cd7011b8342bf7364b65bca
MD5 d04f89048108a89bc12f983020cf061b
SHA1 8fa780952bdf4f8b840175fe5ca6a57da8b55669
SHA512 4f396c5c1f46c0e9dcf068292e39c49e9d238829805b5d2ed27e827f258140b7ddd13cca6520d0fc29c6d6402362196896831d217764acec0f02129c388de444
MD5 SHA1 SHA512

Submit Download

089caf34-598f-40c2-aab4-18d5418087fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\089caf34-598f-40c2-aab4-18d5418087fe.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 68edde5779acd7538cf3caa6f2e6a0214a24b14b89493f661aaf4aa4dc55fd4c
MD5 ec2a5ebe15a127c3d37bd964e54405ca
SHA1 55f841d7fef2f8686d935daa2e2869370adcd9d7
SHA512 77dd5d569d246e5c725972bcdf3615e10676740a33c7336e92bfb188bd314eefb0a80858098e0109eb59d2df05ca216a5c2be9fc45457d8f965f2bc5ca61b338
SSDEEP 96:nSk/X1s8juwpvWMoiVmdeHvSSxbJUWQyV+VDCziEwb:nSkvq8juGWMXTbJro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0d65d73575ab9f4f9b39c2c7a3169298e209f7249ef0fe5de84c6d365ea23f75
MD5 e6146a40eac7d08877bad78796b2df20
SHA1 f0d57cb39defc01dbf5c45cf42137ceecfd2c77c
SHA512 0d591218393486c39922675f0b0ebbacaf7b3c514f5521db1554430ed3f998015f0f023e94cf8a608413a289a457c431e2b28f7aae0a15ced2910e6a1a9beb89
SSDEEP 96:nSk2X1s8juwpvWMoiVmdeHvSS9bJUWQyV+VD7AiEwb:nSkEq8juGWMXfbJrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ca1217ab7149d6e61e8f504fb0daf7a2559ac30014d953df21da1af6c3b6c47f
MD5 de77089a8efa303cb0279690e29f11c2
SHA1 ef4a95d357013c229e7f863e57d6c354a18697a7
SHA512 d03e336ad8792febf2c37f353afb4e67d66900819759447c8908edfa0da82a1633ea8c6b00bd7a27805d4c76ef6598bb6f05630981460e86d9d8126bb7f13ff4
SSDEEP 96:nSkgX1sYjuwpvWMoiVmdeHvSr9bNryWQyV+VD7AiEwb:nSk2qYjuGWMX0bNrlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c10f8a47721dd2701cfb3388830e2d684bdea71f244ee95a1585dd06e0d67773
MD5 c0e9cf092fcf37e9ea747cea3deef996
SHA1 a17a6ad6be02a04b72a2507e11a18b71b2a8d63b
SHA512 7611b4a3f5cb1b627b48a07dbbb9ccfc2b75e7228b72db8a86d1693f1f4785488b262107caa18616bd68b77eaa4078cad70be1706053d98330b3a87b00b04777
SSDEEP 96:nSk9X1pYjuwpvWMoiVmdeHvSS9bNRUWQyV+VD7AiEwb:nSkFjYjuGWMXfbNRrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bdbcbe8b39d29ab7b67b809eb3e195b9b6a2be28154b862d0318af2d4d1b8b87
MD5 5fe21d4d4ae22f15a3e540f75965c407
SHA1 21174732a17858f8d2108bc3a13ffe07e2e8878b
SHA512 9057d9ed00fd114d86c807fd24fe6d981fc1f8e9e4c59f02231048831a65039127dd39916026a67926716358d92548fe8cba0ee555fa7508b1e0b8e1e5759508
SSDEEP 96:nSkiX1pYjuwpvWMoiVmdeHvSS9bNRUWQyV+VD7ziEwb:nSkAjYjuGWMXfbNRrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 285ef3d62cbe9fa354ddad62facdc3d6192970a49fa89c7b63770edd39df1121
MD5 980308fba0fab5cbb725af0b94a0c6df
SHA1 5fb66fc9747f401313a13062731f079806042321
SHA512 d8915db8d5d2a85ac0e85c57491b6e15eeeadef305480832b4dbe0a5da6407fbc7a1a9ea2088257f9ea58ebcaa94d962ea6056fec984de6cbde65fd49ecda749
SSDEEP 192:GoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkte2RUXk4u+3z2OMDCRHqH:C9iIxuERzA83h09RZxYkpb+aOMWRHqlp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c946625d067b04ed15277366dff35e52b2b598e7f132e03bc62c540501a16e7e
MD5 ede842f90aa4ec4439aa80cfa61a35f5
SHA1 d0bb1bf7f0d575f896bbd71ee44571fc2f1e7c34
SHA512 c35848de94c19a35c4f18da4f7b92137343a9eb877276abee1f336700116cabab7fbd38dc930efe5265891817247c784213b7d64e5695ae26d775fcb406d9df1
SSDEEP 192:eoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkEe2RU0t4uUq3z2OMDCRHE:q9iIxuERzA83h09RZxYkqTUqaOMWRHqH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 65434450fd3e82b298274f913ae21b5d779ecf0b491eefd22395c8f9ad03513b
MD5 996caa05c2da09141301a101943a03e6
SHA1 650f84dd5c10efd120d5f8edd0764c4abfcdaf70
SHA512 7af1090a9809feb8d0d2e37402f764fb7aeb8657b2ff74372102f92c14bcc7853c7b5766b262559f12c776d80fd61ddd59c36a6c3d62f5453771a6ff4bc564cb
SSDEEP 192:GoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupate2RU0t4P13z2OMDCRHqQ:C9iIxuERzA83h09RZxYapi1aOMWRHqla
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1c6a45f113684def06d11d2b672b92b39ee4bab0111fd642fb081ba24130ae62
MD5 3e40ac184cb2525a2a76407f33579dd5
SHA1 2767c9b8bc80f1eb7c04dc1b024c33a77319e2ad
SHA512 01ba3c0438a68c57d6234d11053a66c7a7f83fbe3328b98b98b601ea07241fee5115e65ccc6c8b5c3e72bdc52ba4f66ddc0d536c479e7385b35d65baf7dc3d04
SSDEEP 192:MoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupate2RU0t4P13z2OMDCRHqQ:89iIxuERzA83h09RZxYapi1aOMWRHqla
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6716fa75b1b29cece9e1cc7976d34913af7e5720abfa8f1bd7fe40edae00efef
MD5 61c1160ba7a513d4da37d12ad7ceae5b
SHA1 28c90e58a932bc30341e826f8f5c168b60170199
SHA512 25814fb83bc8b7921cce38c225ebd76e963014a4a085940a4e7d603d5ac0a826ac376cf485e95d249784396dae2871a4fe9bce637cca8d5193789bdd879aa9cb
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupate2RU0t4P13z2OMDCRHqQ:A9iIxuERzA83h09RZxYapi1aOMWRHqla
MD5 SHA1 SHA512 SSDEEP

Submit Download