7d075ecaf0015620de2db6bf4bd19de1c3cc62ceb3c8a69ef41280ad798fc9c4

Analysis

max time kernel
149s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpj_2olvme.exe
Size 28.5MB
Sample260702-pb8lsshx2y
SHA256 7d075ecaf0015620de2db6bf4bd19de1c3cc62ceb3c8a69ef41280ad798fc9c4
MD5 936895f836b1b058d594214c66d2e3c6
SHA1 3302f540b17f6132a05cc75d6c6a08081caf95fd
SHA512 15685ea00f8811f68971f8e0e02e45ea9474ce60dfc3c983067d33135a70143c95a4b61f3b632bb6cf7cde8df58a325a4a05a90a25be2421a41b20b18c39f0f8
SSDEEP 393216:HoGqxCURHwLBhA6pXqRjWqGP2rlmTg8cJVJXe4Df2OAUs7KA0+i4ElBADQC:+HwLk8q10OrITiJnXe2fDsb0+BEkDQC
TLSH
T1256723FF64D0219CF8C68831E24566FDE487347B4EFA581B6F8616121930C9ACEE593E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery persistence trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

persistence credential_access

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	tmpj_2olvme.exe

Unexpected DNS network traffic destination 12 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	36	9.9.9.9	1060	tmpj_2olvme.exe
Destination IP	41	120.53.53.53	1060	tmpj_2olvme.exe
Destination IP	42	119.29.29.99	1060	tmpj_2olvme.exe
Destination IP	43	119.29.29.29	1060	tmpj_2olvme.exe
Destination IP	44	101.226.4.6	1060	tmpj_2olvme.exe
Destination IP	33	1.0.0.1	1060	tmpj_2olvme.exe
Destination IP	37	149.112.112.112	1060	tmpj_2olvme.exe
Destination IP	38	223.6.6.6	1060	tmpj_2olvme.exe
Destination IP	39	223.5.5.5	1060	tmpj_2olvme.exe
Destination IP	40	119.28.28.99	1060	tmpj_2olvme.exe
Destination IP	45	218.30.118.6	1060	tmpj_2olvme.exe
Destination IP	49	1.0.0.1	1060	tmpj_2olvme.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tmpj_2olvme.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1060	tmpj_2olvme.exe
1060	tmpj_2olvme.exe

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_2087279738\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1552169366\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1552169366\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_2087279738\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1552169366\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-el.hyb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274678596836926"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1060	tmpj_2olvme.exe
1060	tmpj_2olvme.exe
1992	msedgewebview2.exe
1992	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1780	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	tmpj_2olvme.exe
Token: SeSystemEnvironmentPrivilege	1060	tmpj_2olvme.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1060	tmpj_2olvme.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1780	1060	tmpj_2olvme.exe	87
PID 1780 wrote to memory of 1188	1780	msedgewebview2.exe	88
PID 1780 wrote to memory of 3268	1780	msedgewebview2.exe	92
PID 1780 wrote to memory of 3268	1780	msedgewebview2.exe	92
PID 1780 wrote to memory of 3268	1780	msedgewebview2.exe	92
PID 1780 wrote to memory of 2876	1780	msedgewebview2.exe	93
PID 1780 wrote to memory of 2664	1780	msedgewebview2.exe	95
PID 1780 wrote to memory of 2664	1780	msedgewebview2.exe	95
PID 1780 wrote to memory of 3512	1780	msedgewebview2.exe	96
PID 1780 wrote to memory of 3512	1780	msedgewebview2.exe	96
PID 1780 wrote to memory of 3512	1780	msedgewebview2.exe	96
PID 1780 wrote to memory of 728	1780	msedgewebview2.exe	109
PID 1780 wrote to memory of 728	1780	msedgewebview2.exe	109
PID 1780 wrote to memory of 4924	1780	msedgewebview2.exe	112
PID 1780 wrote to memory of 4924	1780	msedgewebview2.exe	112
PID 1780 wrote to memory of 4764	1780	msedgewebview2.exe	113
PID 1780 wrote to memory of 4764	1780	msedgewebview2.exe	113
PID 1780 wrote to memory of 1992	1780	msedgewebview2.exe	114

C:\Users\Admin\AppData\Local\Temp\tmpj_2olvme.exe
"C:\Users\Admin\AppData\Local\Temp\tmpj_2olvme.exe"
1⤵
- Boot or Logon Autostart Execution: LSASS Driver
- Unexpected DNS network traffic destination
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=tmpj_2olvme.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1060.4772.2931574447524338080
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffbf475b078,0x7ffbf475b084,0x7ffbf475b090
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView" --webview-exe-name=tmpj_2olvme.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1876,i,14321305794633519687,8587927653390899134,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView" --webview-exe-name=tmpj_2olvme.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2144,i,14321305794633519687,8587927653390899134,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:3
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView" --webview-exe-name=tmpj_2olvme.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1352,i,14321305794633519687,8587927653390899134,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView" --webview-exe-name=tmpj_2olvme.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3708,i,14321305794633519687,8587927653390899134,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView" --webview-exe-name=tmpj_2olvme.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3936,i,14321305794633519687,8587927653390899134,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView" --webview-exe-name=tmpj_2olvme.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,14321305794633519687,8587927653390899134,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:8
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView" --webview-exe-name=tmpj_2olvme.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4380,i,14321305794633519687,8587927653390899134,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView" --webview-exe-name=tmpj_2olvme.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4728,i,14321305794633519687,8587927653390899134,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Privilege Escalation

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Defense Evasion

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1552169366\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1817280856\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1780_2087279738\manifest.fingerprint
Size 66B
SHA256 946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52
MD5 3fb5233616491df0ec229ba9f42efdb8
SHA1 18a8116e2df9805accd7901d2321c3fa92da1af4
SHA512 e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d
TLSH
T1F8A022A0C302202228A00E0A82E20223200EA80CE880002328AC8E2A080833B00A8200
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1780_2087279738\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f9797bf67c532db49a5e81167a527febd64f4a2f030652cb51dd8d7a1ee15f2e
MD5 10c3ea3cc42af5aaed15b7a3a16977f6
SHA1 ebf519e22522eaad463eba19e1237549bfbde230
SHA512 f9f6050dd7de0b8c94d95a228f70bd6a892b4a92cd7176120336cc57ff0a08a842ed418ed897c423665c7c8878dbffd569912f4710754e6063b18988e63258d5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dfe2e2f2edcbe56c1bf7fb08e3192bbe515075c7951694e5f2f81d92adcaed45
MD5 0fa887a5b2dae45f5d63d0334e4a17bd
SHA1 d25df095a73b92c96f695fd2a7e7e67dfbcb5b05
SHA512 913f9fd4771360d19b790b2061ed59107b414eeb47b853808171db5b4da9b021d832208a396ecbc637788614d26039e368a08f2cdafa10d2c896539855e79a83
TLSH
T1C5D012223611027CC01024730003E1090840C62B80C64104643C851E5A480700D86442
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

5ab67092-c82e-418c-9ce2-6409c5d1fea9.tmp

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\5ab67092-c82e-418c-9ce2-6409c5d1fea9.tmp
Size 6KB
SHA256 1e7e68d3b667fa05813d8fe77dc3165f2133cc348ec6115ce87d275d46311496
MD5 959428c80fcf106f9fb445e9b30df44c
SHA1 c66161313f527b3686064cba32fdba65be429f99
SHA512 c4cd892fb85060fbf8867be9bb349bdc63873c873252fbf68f5cdd573a29a2451c80e618fe68ed12f3b0ad4976fd96e5652e9f50f93cb4c2cc1b0011d96585b1
SSDEEP 192:stg0DTBVfHZ8paRe/S+WiTTmHZwdefjD7MC:st5DTBVOb/VfmZw0jsC
TLSH
T162D1B6036E286A779CC7E6097A75FB12E2F5106262D50E58EBFC870C05E66CDA207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 a2302429037c1df5ea445997bff43579e4c940f9a74436aaad379bfb2aa394ca
MD5 401680aa00bbc81ece7e472d70440c22
SHA1 9ff80e4cce0dd8aff6c3f2bb3e884682d15d3d50
SHA512 631998e59e3c29ad50e18c9bcc429d95cc55fd47efaa4824ed993134f19ad00da66db2af9c174e3f9ae545d1a20a0d8bab947dac3d72cd73186d4355e7b7e71e
TLSH
T1F5E0222A330207C9DB0B10BC08DC3A41F9F09420DA273C83018C2C3EC74D343C016000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589054.TMP

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe589054.TMP
Size 48B
SHA256 fa0c7142b62c08013d90b476fdb0d446f4164e519a17505419edfec4c96e55f7
MD5 487600476ca23f9ae238e777b65ae259
SHA1 86c81bc048c5213532f30a030d5c73e44c6e3196
SHA512 31cbcc58338137dea0102cd8afe683ea2b1e2ee2a42c7741818f3c001af049e87949f671d0dab6e778523c258f76da512cb488f55dda71a9c19ddd2098c80bf1
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 240d81440f6bc1eb9dfcbeb1556381326f1f40f761facd157b26976f5b2b1374
MD5 39713cce132c4b8e27475c08a8af3677
SHA1 5794ba0f5e77b8ddc663c30eb4ab46036bf50f95
SHA512 a640dfafdde4814870da34b8cbd66f9ade48a9a223afd5a0fcb88a8c0a0103e6491e5900d1ae96acf4df54f68850f40144adab6b6e5cdd461ab87d05061f1796
SSDEEP 3:LstlNllkll/ljGQE:LsX3lEtS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\Network\Network Persistent State
Size 358B
SHA256 1149d699ded87354104c8a53a1511cdb7aef66b81ba3ae52ed7b373ea5826b8a
MD5 cf38c3be913e1baa5b214dbf97e4115d
SHA1 eef92e5c733482aef4b103b0eeddb6451f123666
SHA512 e4d8c998fa66a9e6500f4f7ea8245d2b6fc7351a1ff10fb1785382ea83aaca60fd519844fa714ad4225e4f86494a7e9e3e6078461f2e3aa9db0b81c68c97d2b0
TLSH
T112E0C056C2D0D9BD474043E836343823C93B080692281E66DAE8BB9E47D2078D42040B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59553a.TMP

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\Network\Network Persistent State~RFe59553a.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences~RFe58dc61.TMP

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\Preferences~RFe58dc61.TMP
Size 6KB
SHA256 80b119844a2bc95ff61db228e1df1a308e1add7ab609d975703553cdf8e7c446
MD5 b32d54fb5cc43e8f33ae5930c11ad515
SHA1 6f4e3a893cd500d735b912548f5861d0149c4200
SHA512 1af99c40d56bc42e30322ecc305b49a6419daa39d9077f6294951144f743ccf81fc542f6eba142798d1ec15fb99a4c3e725b5b870c2052404a144b703987a954
SSDEEP 192:stg0DVBVfHZ8paRe/S+WiTTmHZwdefw7M8:st5DVBVOb/VfmZw038
TLSH
T1DFD1B8035F2869778CC7E619BA75FB12E2F5106262D40E58EBFC861C09D66CDA207D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Local State
Size 1KB
SHA256 52d46bd219240373b648af2cb4d93f5b07f64957efa3c3a0cd97ba1d7c9ee7ff
MD5 9106ada14c6cc76b351e16fb63adb220
SHA1 a50c957fcc42fc133e8b5c9ef30dda55fe6904b5
SHA512 403a237216bf7128f89c052cb8ad8c48df1a9ceccab1e06169b44c0a4cc196c10b1b238ab048c6947319dfffde08f8f3c658f9c0841fd6f8418e8cc495c651cc
TLSH
T142316532E4883B3259D369457252EB8B2E21403BC3158F9C92ED071C12DB68CD21ED37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Local State
Size 2KB
SHA256 adcc15675517ecc50094f5688535c2d9225341e76f4647b32956c0929a489a83
MD5 ba4827672f9090dfe4b9e011f9f35683
SHA1 64fb934b8a649b5351c02f024e3f49978a510d92
SHA512 3fb3b2856d4233accd4295d574466700a81c6d2787fe010dfec56df6b4f77cebe868d696ce0e982ba2e334b8227117e78957bb036d74c4ec4b6b203958e823d0
TLSH
T19651A833B8486B378AE39D487986BF57AA36406ADB512F9499EC0B1C01DB55CD306C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Local State
Size 3KB
SHA256 ebfb1b499ac582f7203a48e35c3b6fb28acdc868b896f924280f72a3b3fea832
MD5 30e87d7240365ca672e4aad1b120c229
SHA1 157a638934ba2f08cb5b7f443195693b997ba2ed
SHA512 86d056d41b48c8c8df01f211efa394cf84a8d2d22fa93241c03865bc9666e65d8691274e95edfeb880bda2383610c41669d33b85802b849111a57e3d2f2936bf
TLSH
T1AD718836A964AB374EE39D04B9C16B06B766413BD6957FA8C9EC0F0C01DB3985342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Local State
Size 16KB
SHA256 8343d527b063d4c5aa3d6246ae0f12eab1edf8b4e9ea0246c983c2296cc585e4
MD5 f89a88f59a936f5538868d9258957d03
SHA1 529896c13f1840c50670b655d464d6a9515cd059
SHA512 eb1822c7c1b687c3ffc60b850e9a5e25ad08e3c05ec7761b2bdec62534aa378b884d6ed15f45e52bf1932d5873de61ba27e89a16fa725c347032d1edaf048791
SSDEEP 384:zFsrv+89zHqlDNP9oid6NbcyHGkLhCAXwyIN+2:Wrv+4UNbdTyHFLEAXwyIN+2
TLSH
T1F0729D32A568A7379EF39948F4866A0B7B78516B96C11BF8D9DC0B4D42DF0C9230BD07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58360f.TMP

Path C:\Users\Admin\AppData\Local\com.lexis.app\EBWebView\Local State~RFe58360f.TMP
Size 1KB
SHA256 58e7effd044f69de944912e8d4927c0bde634e35ae941e99b99431e6a4f91091
MD5 be826576cd8340d3a426ade6d9f3c4b0
SHA1 81f03b17110798543a7dcea76e958cd56cb1c37f
SHA512 009bb8d6243e3a65f3bb617ee7f9a813185ea6a40ae96b2d69b9d727992ee7cd332148b1491d3b9844ca574be747f1b41fec2b182973dc882ff7327dc6f581a4
TLSH
T1D4213233D4883B36AA975D587252EBCB3E11403B97149F5C92ED071C22DB59DC22AC37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1060-227-0x0000000141D65000-0x0000000142750000-memory.dmp

Download

memory/1060-12-0x0000000140000000-0x00000001443CD000-memory.dmp

Download

memory/1060-228-0x0000000140000000-0x00000001443CD000-memory.dmp

Download

memory/1060-0-0x0000000141D65000-0x0000000142750000-memory.dmp

Download

memory/1060-2-0x00007FFC11D60000-0x00007FFC11D62000-memory.dmp

Download

memory/1060-1-0x00007FFC11D50000-0x00007FFC11D52000-memory.dmp

Download

memory/1060-3-0x0000000140000000-0x00000001443CD000-memory.dmp

Download

memory/1992-577-0x000001CB825D0000-0x000001CB825D1000-memory.dmp

Download

memory/1992-580-0x000001CB825D0000-0x000001CB825D1000-memory.dmp

Download

memory/1992-575-0x000001CB825D0000-0x000001CB825D1000-memory.dmp

Download

memory/1992-576-0x000001CB825D0000-0x000001CB825D1000-memory.dmp

Download

memory/1992-578-0x000001CB825D0000-0x000001CB825D1000-memory.dmp

Download

memory/1992-568-0x000001CB825D0000-0x000001CB825D1000-memory.dmp

Download

memory/1992-570-0x000001CB825D0000-0x000001CB825D1000-memory.dmp

Download

memory/1992-569-0x000001CB825D0000-0x000001CB825D1000-memory.dmp

Download

memory/1992-574-0x000001CB825D0000-0x000001CB825D1000-memory.dmp

Download

memory/1992-579-0x000001CB825D0000-0x000001CB825D1000-memory.dmp

Download

memory/2664-55-0x00007FFC107A0000-0x00007FFC107A1000-memory.dmp

Download

memory/2664-56-0x00007FFC11980000-0x00007FFC11981000-memory.dmp

Download

memory/3268-30-0x00007FFC107A0000-0x00007FFC107A1000-memory.dmp

Download

memory/3512-245-0x00000215DB960000-0x00000215DB9CB000-memory.dmp

Download

memory/3512-139-0x00007FFC107A0000-0x00007FFC107A1000-memory.dmp

Download