d9216e1491aa130a3595a688da9a5ffaca67a3bb7609cb069e86e000baba041b

Analysis

user interaction
yes
max time kernel
142s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
processlassosetup64.exe
Size 2.7MB
Sample260910-2qvppsxbkc
SHA256 d9216e1491aa130a3595a688da9a5ffaca67a3bb7609cb069e86e000baba041b
MD5 6344a3cfceb315a0354bcbd11a5f8a63
SHA1 39113fff4d7bdeaa1113517fe4ba6e41cab967f3
SHA512 303a3b4e42ad1d53db39396ce948483d1414e17b598c6fd02da272ace9a7da2e8f443985f05a5fabb92d6a8692836e709eaa2b3dcb4baaab7221731945bf6d9d
SSDEEP 49152:16yc3cg20kYjH/eC17hRCR38Ixuya+huxEyoTvigVqae1UFewWenn6m2Xk:1DcsI1Z1tRIcxEyDtae1cNT
TLSH
T1E5D5F1D509BA8DADD051DEBC8AC1CCC975CFAE0C953E3A3A5638350C6FBC79A6584C24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
13	2752	quickupgrade.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Process Lasso\bitsumsessionagent.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\vistammsc.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\Insights.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_spanish.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_japanese.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\uninstall.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\ProcessLassoLauncher.exe	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_german.dll	pl4sfx.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_english.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_finnish.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\ProcessGovernor.exe	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_spanish.dll	pl4sfx.exe
File created	C:\Program Files\Process Lasso\QuickUpgrade.exe	PostUpdate.exe
File opened for modification	C:\Program Files\Process Lasso\QuickUpgrade.exe	processlasso.exe
File created	C:\Program Files\Process Lasso\ProcessLasso.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_english.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_temp.dll	ProcessLasso.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_english.dll	quickupgrade.exe
File created	C:\Program Files\Process Lasso\CPUEater.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\testlasso.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\LogViewer.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\stop-governor.bat	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_italian.dll	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_japanese.dll	pl4sfx.exe
File created	C:\Program Files\Process Lasso\InstallHelper.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\ProcessLasso.exe	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_polish.dll	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_russian.dll	pl4sfx.exe
File created	C:\Program Files\Process Lasso\ProcessGovernor.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\ThreadRacer.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_german.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl-update.cmd	pl4sfx.exe
File created	C:\Program Files\Process Lasso\ProcessLassoLauncher.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\testlasso.exe	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_bulgarian.dll	pl4sfx.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_turkish.dll	pl4sfx.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_slovenian.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_chinese.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\LICENSES	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\TweakScheduler.exe	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_finnish.dll	pl4sfx.exe
File created	C:\Program Files\Process Lasso\srvstub.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_italian.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\start-governor.bat	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\plActivate.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\plActivate.exe	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\ThreadRacer.exe	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_french.dll	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_ptbr.dll	pl4sfx.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_ptbr.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_korean.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\Insights.exe	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\LogViewer.exe	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\vistammsc.exe	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_chinese_traditional.dll	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_turkish.dll	pl4sfx.exe
File created	C:\Program Files\Process Lasso\QuickUpgrade.exe.Replacement	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\TweakScheduler.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl.cmd	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\__tmp_rar_sfx_access_check_240812546	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\bitsumsessionagent.exe	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\CPUEater.exe	pl4sfx.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_chinese.dll	pl4sfx.exe

Executes dropped EXE 26 IoCs

pid	Process
4796	installhelper.exe
3416	installHelper.exe
6080	installHelper.exe
3908	InstallHelper.exe
4860	InstallHelper.exe
1108	InstallHelper.exe
3940	InstallHelper.exe
352	installHelper.exe
5588	bitsumsessionagent.exe
1688	srvstub.exe
4092	ProcessLasso.exe
5192	installHelper.exe
5096	srvstub.exe
3228	installhelper.exe
2776	processgovernor.exe
5068	processlasso.exe
3368	bitsumsessionagent.exe
5408	ProcessLassoLauncher.exe
2752	quickupgrade.exe
5976	pl4sfx.exe
5600	PostUpdate.exe
6076	processgovernor.exe
3648	bitsumsessionagent.exe
3344	processlasso.exe
4632	bitsumsessionagent.exe
2916	ProcessLassoLauncher.exe

Loads dropped DLL 32 IoCs

pid	Process
2420	processlassosetup64.exe
2420	processlassosetup64.exe
4796	installhelper.exe
3416	installHelper.exe
6080	installHelper.exe
3908	InstallHelper.exe
4860	InstallHelper.exe
1108	InstallHelper.exe
3940	InstallHelper.exe
352	installHelper.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
5192	installHelper.exe
3228	installhelper.exe
2776	processgovernor.exe
2776	processgovernor.exe
5068	processlasso.exe
5068	processlasso.exe
5408	ProcessLassoLauncher.exe
5408	ProcessLassoLauncher.exe
2752	quickupgrade.exe
2752	quickupgrade.exe
2752	quickupgrade.exe
2752	quickupgrade.exe
5600	PostUpdate.exe
5600	PostUpdate.exe
6076	processgovernor.exe
6076	processgovernor.exe
3344	processlasso.exe
3344	processlasso.exe
2916	ProcessLassoLauncher.exe
2916	ProcessLassoLauncher.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	processlassosetup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pl4sfx.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3016	msedge.exe
2552	msedge.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ProcessLasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processlasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processgovernor.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processlasso.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processgovernor.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PostUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processgovernor.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processgovernor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessLasso.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PostUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processlasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processlasso.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\ProcessLasso\InstallerLanguageDWORD = "1033"	processgovernor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\ProcessLasso	processgovernor.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\ProcessLasso\ProcessLasso = 09040000	processgovernor.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335542118666376"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\ProcessLasso	processgovernor.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\ProcessLasso\Language = "1033"	processgovernor.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{524D0AE5-4F4E-4C93-A7DD-38B7EBD2B9F8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
4796	installhelper.exe
3940	InstallHelper.exe
3940	InstallHelper.exe
3940	InstallHelper.exe
3940	InstallHelper.exe
3228	installhelper.exe
3228	installhelper.exe
3228	installhelper.exe
3228	installhelper.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
2776	processgovernor.exe
2776	processgovernor.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
2776	processgovernor.exe
2776	processgovernor.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
2776	processgovernor.exe
2776	processgovernor.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3344	processlasso.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	4796	installhelper.exe
Token: SeDebugPrivilege	4796	installhelper.exe
Token: SeChangeNotifyPrivilege	4796	installhelper.exe
Token: SeIncBasePriorityPrivilege	4796	installhelper.exe
Token: SeIncreaseQuotaPrivilege	4796	installhelper.exe
Token: SeProfSingleProcessPrivilege	4796	installhelper.exe
Token: SeAssignPrimaryTokenPrivilege	3416	installHelper.exe
Token: SeDebugPrivilege	3416	installHelper.exe
Token: SeChangeNotifyPrivilege	3416	installHelper.exe
Token: SeIncBasePriorityPrivilege	3416	installHelper.exe
Token: SeIncreaseQuotaPrivilege	3416	installHelper.exe
Token: SeProfSingleProcessPrivilege	3416	installHelper.exe
Token: SeAssignPrimaryTokenPrivilege	6080	installHelper.exe
Token: SeDebugPrivilege	6080	installHelper.exe
Token: SeChangeNotifyPrivilege	6080	installHelper.exe
Token: SeIncBasePriorityPrivilege	6080	installHelper.exe
Token: SeIncreaseQuotaPrivilege	6080	installHelper.exe
Token: SeProfSingleProcessPrivilege	6080	installHelper.exe
Token: SeAssignPrimaryTokenPrivilege	3908	InstallHelper.exe
Token: SeDebugPrivilege	3908	InstallHelper.exe
Token: SeChangeNotifyPrivilege	3908	InstallHelper.exe
Token: SeIncBasePriorityPrivilege	3908	InstallHelper.exe
Token: SeIncreaseQuotaPrivilege	3908	InstallHelper.exe
Token: SeProfSingleProcessPrivilege	3908	InstallHelper.exe
Token: SeAssignPrimaryTokenPrivilege	4860	InstallHelper.exe
Token: SeDebugPrivilege	4860	InstallHelper.exe
Token: SeChangeNotifyPrivilege	4860	InstallHelper.exe
Token: SeIncBasePriorityPrivilege	4860	InstallHelper.exe
Token: SeIncreaseQuotaPrivilege	4860	InstallHelper.exe
Token: SeProfSingleProcessPrivilege	4860	InstallHelper.exe
Token: SeAssignPrimaryTokenPrivilege	1108	InstallHelper.exe
Token: SeDebugPrivilege	1108	InstallHelper.exe
Token: SeChangeNotifyPrivilege	1108	InstallHelper.exe
Token: SeIncBasePriorityPrivilege	1108	InstallHelper.exe
Token: SeIncreaseQuotaPrivilege	1108	InstallHelper.exe
Token: SeProfSingleProcessPrivilege	1108	InstallHelper.exe
Token: SeAssignPrimaryTokenPrivilege	3940	InstallHelper.exe
Token: SeDebugPrivilege	3940	InstallHelper.exe
Token: SeChangeNotifyPrivilege	3940	InstallHelper.exe
Token: SeIncBasePriorityPrivilege	3940	InstallHelper.exe
Token: SeIncreaseQuotaPrivilege	3940	InstallHelper.exe
Token: SeProfSingleProcessPrivilege	3940	InstallHelper.exe
Token: SeAssignPrimaryTokenPrivilege	352	installHelper.exe
Token: SeDebugPrivilege	352	installHelper.exe
Token: SeChangeNotifyPrivilege	352	installHelper.exe
Token: SeIncBasePriorityPrivilege	352	installHelper.exe
Token: SeIncreaseQuotaPrivilege	352	installHelper.exe
Token: SeProfSingleProcessPrivilege	352	installHelper.exe
Token: SeAssignPrimaryTokenPrivilege	1688	srvstub.exe
Token: SeCreateGlobalPrivilege	1688	srvstub.exe
Token: SeAssignPrimaryTokenPrivilege	4092	ProcessLasso.exe
Token: SeDebugPrivilege	4092	ProcessLasso.exe
Token: SeChangeNotifyPrivilege	4092	ProcessLasso.exe
Token: SeIncBasePriorityPrivilege	4092	ProcessLasso.exe
Token: SeIncreaseQuotaPrivilege	4092	ProcessLasso.exe
Token: SeCreateGlobalPrivilege	4092	ProcessLasso.exe
Token: SeProfSingleProcessPrivilege	4092	ProcessLasso.exe
Token: SeBackupPrivilege	4092	ProcessLasso.exe
Token: SeRestorePrivilege	4092	ProcessLasso.exe
Token: SeShutdownPrivilege	4092	ProcessLasso.exe
Token: SeAssignPrimaryTokenPrivilege	5192	installHelper.exe
Token: SeDebugPrivilege	5192	installHelper.exe
Token: SeChangeNotifyPrivilege	5192	installHelper.exe
Token: SeIncBasePriorityPrivilege	5192	installHelper.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
2976	msedge.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe
3344	processlasso.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
4092	ProcessLasso.exe
3344	processlasso.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4796	2420	processlassosetup64.exe	90
PID 2420 wrote to memory of 3416	2420	processlassosetup64.exe	91
PID 2420 wrote to memory of 6080	2420	processlassosetup64.exe	92
PID 2420 wrote to memory of 3908	2420	processlassosetup64.exe	93
PID 2420 wrote to memory of 4860	2420	processlassosetup64.exe	94
PID 2420 wrote to memory of 1108	2420	processlassosetup64.exe	95
PID 2420 wrote to memory of 3940	2420	processlassosetup64.exe	96
PID 2420 wrote to memory of 352	2420	processlassosetup64.exe	97
PID 2420 wrote to memory of 5192	2420	processlassosetup64.exe	104
PID 2420 wrote to memory of 3228	2420	processlassosetup64.exe	106
PID 5096 wrote to memory of 2776	5096	srvstub.exe	107
PID 2420 wrote to memory of 5068	2420	processlassosetup64.exe	108
PID 4092 wrote to memory of 2752	4092	ProcessLasso.exe	112
PID 2752 wrote to memory of 5976	2752	quickupgrade.exe	113
PID 5976 wrote to memory of 5600	5976	pl4sfx.exe	114
PID 2752 wrote to memory of 6076	2752	quickupgrade.exe	115
PID 3344 wrote to memory of 2976	3344	processlasso.exe	121
PID 2976 wrote to memory of 3392	2976	msedge.exe	122
PID 2976 wrote to memory of 2552	2976	msedge.exe	123
PID 2976 wrote to memory of 1428	2976	msedge.exe	124
PID 2976 wrote to memory of 2904	2976	msedge.exe	125
PID 2976 wrote to memory of 1428	2976	msedge.exe	124
PID 2976 wrote to memory of 1428	2976	msedge.exe	124
PID 2976 wrote to memory of 2904	2976	msedge.exe	125
PID 2976 wrote to memory of 2808	2976	msedge.exe	127
PID 2976 wrote to memory of 2380	2976	msedge.exe	128
PID 2976 wrote to memory of 2808	2976	msedge.exe	127
PID 2976 wrote to memory of 2808	2976	msedge.exe	127
PID 2976 wrote to memory of 2380	2976	msedge.exe	128
PID 2976 wrote to memory of 2380	2976	msedge.exe	128
PID 2976 wrote to memory of 6008	2976	msedge.exe	129
PID 2976 wrote to memory of 3380	2976	msedge.exe	130
PID 2976 wrote to memory of 6008	2976	msedge.exe	129
PID 2976 wrote to memory of 6008	2976	msedge.exe	129
PID 2976 wrote to memory of 3380	2976	msedge.exe	130
PID 2976 wrote to memory of 3380	2976	msedge.exe	130
PID 2976 wrote to memory of 564	2976	msedge.exe	131
PID 2976 wrote to memory of 564	2976	msedge.exe	131
PID 2976 wrote to memory of 2860	2976	msedge.exe	133
PID 2976 wrote to memory of 5600	2976	msedge.exe	134
PID 2976 wrote to memory of 2860	2976	msedge.exe	133
PID 2976 wrote to memory of 5600	2976	msedge.exe	134
PID 2976 wrote to memory of 1196	2976	msedge.exe	136
PID 2976 wrote to memory of 2828	2976	msedge.exe	137
PID 2976 wrote to memory of 2828	2976	msedge.exe	137
PID 2976 wrote to memory of 2828	2976	msedge.exe	137
PID 2976 wrote to memory of 2124	2976	msedge.exe	138
PID 2976 wrote to memory of 2124	2976	msedge.exe	138
PID 2976 wrote to memory of 2880	2976	msedge.exe	141
PID 2976 wrote to memory of 2880	2976	msedge.exe	141
PID 2976 wrote to memory of 5760	2976	msedge.exe	143
PID 2976 wrote to memory of 5760	2976	msedge.exe	143
PID 2976 wrote to memory of 5760	2976	msedge.exe	143
PID 2976 wrote to memory of 1576	2976	msedge.exe	144
PID 1576 wrote to memory of 2660	1576	msedge.exe	145
PID 1576 wrote to memory of 3016	1576	msedge.exe	146
PID 1576 wrote to memory of 2404	1576	msedge.exe	148
PID 1576 wrote to memory of 2404	1576	msedge.exe	148
PID 1576 wrote to memory of 2404	1576	msedge.exe	148
PID 1576 wrote to memory of 4288	1576	msedge.exe	149
PID 1576 wrote to memory of 4288	1576	msedge.exe	149
PID 1576 wrote to memory of 1104	1576	msedge.exe	151

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\processlassosetup64.exe
"C:\Users\Admin\AppData\Local\Temp\processlassosetup64.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files\Process Lasso\installhelper.exe
  "C:\Program Files\Process Lasso\installhelper.exe" /terminate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Program Files\Process Lasso\installHelper.exe
  "C:\Program Files\Process Lasso\installHelper.exe" /firstinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3416
- C:\Program Files\Process Lasso\installHelper.exe
  "C:\Program Files\Process Lasso\installHelper.exe" /migrate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:6080
- C:\Program Files\Process Lasso\InstallHelper.exe
  "C:\Program Files\Process Lasso\InstallHelper.exe" /powerinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Program Files\Process Lasso\InstallHelper.exe
  "C:\Program Files\Process Lasso\InstallHelper.exe" /install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4860
- C:\Program Files\Process Lasso\InstallHelper.exe
  "C:\Program Files\Process Lasso\InstallHelper.exe" /env_path_install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Program Files\Process Lasso\InstallHelper.exe
  "C:\Program Files\Process Lasso\InstallHelper.exe" /enable_update_check
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3940
- C:\Program Files\Process Lasso\installHelper.exe
  "C:\Program Files\Process Lasso\installHelper.exe" /initconfig
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:352
- C:\Program Files\Process Lasso\installHelper.exe
  "C:\Program Files\Process Lasso\installHelper.exe" /startgovernorservice
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:5192
- C:\Program Files\Process Lasso\installhelper.exe
  "C:\Program Files\Process Lasso\installhelper.exe" /langcheck
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files\Process Lasso\processlasso.exe
  "C:\Program Files\Process Lasso\processlasso.exe" /install /nodelay /showwindow
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:5068

C:\Program Files\Process Lasso\bitsumsessionagent.exe
"C:\Program Files\Process Lasso\bitsumsessionagent.exe"
1⤵
- Executes dropped EXE
PID:5588

C:\Program Files\Process Lasso\srvstub.exe
"C:\Program Files\Process Lasso\srvstub.exe" "C:\Program Files\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Program Files\Process Lasso\ProcessLasso.exe
"C:\Program Files\Process Lasso\processlasso.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files\Process Lasso\quickupgrade.exe
  "C:\Program Files\Process Lasso\quickupgrade.exe"
  2⤵
  - Downloads MZ/PE file
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5976
  - - C:\Program Files\Process Lasso\PostUpdate.exe
      "C:\Program Files\Process Lasso\PostUpdate.exe"
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:5600
- - C:\Program Files\Process Lasso\processgovernor.exe
    "C:\Program Files\Process Lasso\processgovernor.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    PID:6076

C:\Program Files\Process Lasso\srvstub.exe
"C:\Program Files\Process Lasso\srvstub.exe" "C:\Program Files\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files\Process Lasso\processgovernor.exe
  "C:\Program Files\Process Lasso\processgovernor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2776

C:\Program Files\Process Lasso\bitsumsessionagent.exe
"C:\Program Files\Process Lasso\bitsumsessionagent.exe" ----------------------------------------------------------------
1⤵
- Executes dropped EXE
PID:3368

C:\Program Files\Process Lasso\ProcessLassoLauncher.exe
"C:\Program Files\Process Lasso\ProcessLassoLauncher.exe" /showwindow /nodelay
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5408

C:\Program Files\Process Lasso\bitsumsessionagent.exe
"C:\Program Files\Process Lasso\bitsumsessionagent.exe" ----------------------------------------------------------------
1⤵
- Executes dropped EXE
PID:3648

C:\Program Files\Process Lasso\processlasso.exe
"C:\Program Files\Process Lasso\processlasso.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bitsum.com/processlasso/purchase/?inproduct
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ff84538c188,0x7ff84538c194,0x7ff84538c1a0
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,4672486916978780301,16877785003023391952,524288 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,2363873631598575538,13738092487454249539,262144 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:2
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,12415175212041621503,1371921413520531382,524288 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,16639218466806261482,4779948512323553943,2097152 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,4258776368016141618,3720839345485988822,2097152 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,1594968062634484050,1477086917351945712,2097152 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:1
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,17929779483450803002,11533977035510524159,2097152 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:9
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,12276111546474861527,16089064383565623766,524288 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,10571655734958422205,14378875851200639060,524288 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,10994003103496541112,1671276215394210732,524288 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,16629293105152986954,429752112062441269,524288 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,16629293105152986954,429752112062441269,524288 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6252,i,15674118582061758296,2577746461824781841,2097152 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,12433049640374300996,17304922968124238324,524288 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,18299782000030356023,17459198647102245804,524288 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6624,i,3311586279465044015,14980267784384770113,2097152 --field-trial-handle=2484,i,8302085756766957611,17974720465331040125,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e4,0x7ff84538c188,0x7ff84538c194,0x7ff84538c1a0
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,11388508094269166684,4488683609155340720,524288 --field-trial-handle=2264,i,3524233447899947330,10011115530995989211,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
      4⤵
      System Time Discovery
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,13700221983186128107,10298413732394708224,262144 --field-trial-handle=2264,i,3524233447899947330,10011115530995989211,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,10969262606641108568,17944849617579020998,524288 --field-trial-handle=2264,i,3524233447899947330,10011115530995989211,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:13
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,9658764096606446954,3741760645657376220,524288 --field-trial-handle=2264,i,3524233447899947330,10011115530995989211,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,9658764096606446954,3741760645657376220,524288 --field-trial-handle=2264,i,3524233447899947330,10011115530995989211,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
      4⤵
      PID:1104

C:\Program Files\Process Lasso\bitsumsessionagent.exe
"C:\Program Files\Process Lasso\bitsumsessionagent.exe" ----------------------------------------------------------------
1⤵
- Executes dropped EXE
PID:4632

C:\Program Files\Process Lasso\ProcessLassoLauncher.exe
"C:\Program Files\Process Lasso\ProcessLassoLauncher.exe" /showwindow /nodelay
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallHelper.exe

Path C:\Program Files\Process Lasso\InstallHelper.exe
Size 853KB
SHA256 956924ad0f7d61779025c3bd039dee339227f28eb5598f1fded039772decf8e0
MD5 0638ee2f4f3a03aa1ef68640da7a429c
SHA1 0cb8d423b88c14a32a7b469310db9fe240f4a40b
SHA512 be9a214c90f67c8dabcbd9cf4145711c8a8ef90402708b2ed51a5e4cea4930f2e5764114683d36587e2fb649f55aef89d23a1a4a6a7ffca2b98b56b161fc5521
SSDEEP 12288:rBHsAyQCFwwP3XITXYyOPAC93hjsT6peLSdH03A0y/FWbKGqX:FMAhw/sXYyOPAC9xjsQUSB0QWhqX
TLSH
T1F005C1D056BA49ACD076CD7C8A81CC9AB9EB7D0C463D3ABB0274745C0F3EB994674E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PostUpdate.exe

Path C:\Program Files\Process Lasso\PostUpdate.exe
Size 735KB
SHA256 580138919dca3eb5e51621392f2cc6287fa6c2b12edf0387834dc67eceeefdaf
MD5 18c8af150e490c87b419f36a29b366f9
SHA1 daf243719d87b56f58adb56a656c685589b5b33e
SHA512 7016d8590e8294f79b0402a5caf1e51e59f6e9f11ae5a8a7cbea7d41a2d1fee69ef7e268f4d34beb4a824d7dc63b7f5c61f69e7ba7376c28197b889e7b99489f
SSDEEP 6144:IJ91iXXLM7ykmsyRmGfExtU046q/JfCo6644y+iK18IrJ7WGiC:IJiXLM7ykmxfErc/tCoLSK/KGiC
TLSH
T104F4A0D415BA4AACE0A5CD3C8A91CC89B4EF7D4C473D79BB02B8345C0E3DB9A5974E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProcessGovernor.exe

Path C:\Program Files\Process Lasso\ProcessGovernor.exe
Size 1.3MB
SHA256 5cf88d196b5f600e0aa2bf32871446e60f48a80e6dae6629642fec4cb610b11a
MD5 f1d91efc5a6b48a78fd4e3281e6ec55d
SHA1 abd109657e3ddb1697021189b1e71357973591a9
SHA512 7eae094f9346888ef4af7829b9edc2a00586f1aed9794cfa5222193cfd7740a0ea4c36a2d795d4f9532c0c4b8ff5a61c1d3677f0a16e74b1bf5e9f2ab54605dd
SSDEEP 24576:+08jwatdhVf5Up78pJJldBnt7XxT9x4pWx08:+LkYf5Up7c9Bn9hT74pWt
TLSH
T19C5527D415B905ACE066D87C8A81CC8AE5EB7C0C073D7AFB02B436591F3EBE54A79E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProcessLasso.exe

Path C:\Program Files\Process Lasso\ProcessLasso.exe
Size 2.3MB
SHA256 7a135a83c079c92c85a6ddb63425b2c0411958bc01a7b57593efe54ff14b92be
MD5 6f430ce9c9e72522d3dc3abac14b5fb5
SHA1 7f7044f3319d60d9d43c7abf0157d7d16e0bf9d2
SHA512 d8888c32c71dfe0d884decb36e202ea16d35f6f5ab8019109144dd3745e72a8a3cfe2779d3895c69113cd411b74ce3d740ce903e503f47204b40f95b10b8280b
SSDEEP 49152:OIFNK7mIX6oTWXepAKvB+YmUC7uk5hl6BWrtV+hO:1N6TIl7us+
TLSH
T13EB5489522A805A9E076C57C8986CC5BE9FB7C0C173979FB0160B9580F3FBE60A79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProcessLassoLauncher.exe

Path C:\Program Files\Process Lasso\ProcessLassoLauncher.exe
Size 400KB
SHA256 bbe930f95c4e71f0b581eeb5ef7396851f558a00f45eb4a5d01b352fdab80c10
MD5 80abc9e1bfc7283ab434b092968201a6
SHA1 e83d74209efa04cfbe397282b0076f6ed50e8341
SHA512 fcc621b0f5983831e2b88a22a2a10659ced383f5622f1243f168ade5510e60bcf60bf22bf45eb122a905577013baefd2e4ba439b935afe3a9f196297a4f339b3
SSDEEP 3072:P/wE1YFBW3AYm2+huY6S8Oq1umgSZLb7Vk7HoZ7WK7T1mqP2:n403/m+YpIV7WGMqu
TLSH
T1B5942AD51ABA8DACD061DE7C8AC1CCC9A1DF6E1C463D3A7A0278341C5F7CBDA58A4D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bitsumsessionagent.exe

Path C:\Program Files\Process Lasso\bitsumsessionagent.exe
Size 180KB
SHA256 8f6507c3bb877e85d15adb5ed62d10cac19d32a8e7960e2116a21a6f9f242c11
MD5 c3781289e5ae15bc0e3bb0dbaeeb8cd6
SHA1 a7d26d8f39b43e036f19bafe62c1d4a17bd63bfc
SHA512 0be7b041c405c63f3ada0e525f6a1f0d1985ca0e7dff58f3d232962eaf41e1ce7b458ef2aed55e63cccc932df5f14fe1a4b69c2b55482e114c549b9d95abd7e1
SSDEEP 3072:eaNn5AwjVsJu3hE38kojLVJ6DIrVHnT5xx+Xe2:eaBWJuA2hnN+5
TLSH
T1B3046C5673E510F9E1778234C9A14A05F772B82207609BEF17B08376AF276D19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl_rsrc_english.dll

Path C:\Program Files\Process Lasso\pl_rsrc_english.dll
Size 1.9MB
SHA256 d050dcbc16be8ed00242576cfcb13a9aca1212693da369a895c41d4b6ad92783
MD5 5f1bcb904eaaf2c11a9c8df643dde78a
SHA1 dd8d1c141c4da0c45e5e300bcb1a8d42b54f1241
SHA512 0fcd292d2e0d1da564fe5a477504dcad6c11696c46b66293579874db9a20fefcd33f8d02c92df2353a002808a27f493a5eafd49aee816df833779ba60b65d30d
SSDEEP 6144:jfFa9MmhuV2FFdq7qFrwnim0gsZEeV3dyqlbWTjFC8fB4adLxp7WGCNE/Jt1icNa:jfcHoQuFzLXKGh4ZJe6cwTqREewWuQhe
TLSH
T1EB9582CE12BADC58F179EE781DA04E5818D73C8DE838B13D3A31711E997C6669828F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quickupgrade.exe

Path C:\Program Files\Process Lasso\quickupgrade.exe
Size 487KB
SHA256 52e674c0ebc9c303aea7f77e6f61b5389bc92005bb3450f9e262b4a5b655c087
MD5 6f782f7c529b12940cc72d66607ac775
SHA1 29a677f8399ae2f7d7c653cf974bba1bf8adc827
SHA512 ea9a43082c558a141da1a9a0479c25a79e1b1cdab8efa85cc7943546a0d1116bd850873a0ee08ef7e23f2829c534340b8c27e7b964992311e07b89c201af1273
SSDEEP 3072:Uwlw46gYUBoWux28XvviXx/S0L4ab+cH6myRmrf/JnQwqdz4VSIxDdWk7HoZ7WKx:Uwlw4NXug8fvk60L4OqXcU6Y7WGya
TLSH
T1B5B47ED11ABA8CACE461CE7C8A91CCC9A5DF6D0C463D76BB0278341C5F7EBDA5864D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

srvstub.exe

Path C:\Program Files\Process Lasso\srvstub.exe
Size 131KB
SHA256 b92dff43f36a25b29e32c9139def96429b69ef737f2249b20bda1fad78fc36ff
MD5 efe6b538c6eb4fb2c85abba3faa351fd
SHA1 ba189c96560dffe901102bda814cc62c1c219469
SHA512 4d12f7bcb748c36f552babbee46aefdf84a961b8aec86f78e73cd62ee902f63c97242355af39d74faa8ea338d6e122b8fd9348457ca8cc9237f2f100840e9214
SSDEEP 3072:oEYvuYeweXlgl3ku3f+p9J6BFsS6DT+wOCyPnvUOqg2:N21eO3ku3WbJOFnvpa
TLSH
T131D36C57B3E530F8E1778279C4A1170AEB72B8751BA19BDF03A046651F232D09E3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prolasso.ini

Path C:\ProgramData\ProcessLasso\config\prolasso.ini
Size 8KB
SHA256 aa9ba45be1d8d6da405099e6ea32cf02093f85bb24cdaebe5a0fc1e527d65062
MD5 9c97ac7e99018496dae25fda08e26af1
SHA1 81cbca2644f8908b924d56b4b682339f0a44871f
SHA512 35e5143282d951c013d1a4a8e07fc89ce051f999ed647da18f0929a7d99386250d4c3af1b7508ebc05a7c6a539fc6ad8a6b28bc71dd2d097f7215e6ea5445a99
SSDEEP 192:tCU8hjD6xebh7taMm3aIm6XHWYFgCZiONkM66yWYsaEeAuF:t18hjD7t7wHaIm6XHWYFgKiONkM66yWm
TLSH
T157127B9397F92048F6BB2F60EEB868B24BB7BC661E19C45D41D9010D05F1E90D9B27B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

processlasso.log

Path C:\ProgramData\ProcessLasso\logs\processlasso.log
Size 1KB
SHA256 7890f955a217fe5e1430d99205e23e9ccfdf2f9b423ce8a026839ff060378ac8
MD5 ed166694ff5105113a26ec96c16830b5
SHA1 8602283db1898a01ad10b36a74e5ee91ef5f1b91
SHA512 087af2d176ecd31dd664899631c1e71eba8d0656ed59135973f7904dd4837ae1ec27131b49e8fa74697144ee21fac9925d30765e1dde715b82b06f78e2c71d1c
TLSH
T12E11021AE1DDDD063CCD7082334A5DE78CB6FA4842548D3D64AB46AB7A5CDEE103B804
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

79C9CD216EFA26CA98115DC9A148DEF7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\79C9CD216EFA26CA98115DC9A148DEF7
Size 57KB
SHA256 3a58bf309f8fc8ac2afd566cf241e8dd17248c25318e95ad4e6c6fff27394bcd
MD5 3ee98d9b35dafc3c9367cd708180e66f
SHA1 10df010123a50f83e445160f2aa9cfd6dba81cd7
SHA512 c5d1ae0ac9f1de701d813e323762c0d6e9097c579eb1d7f5bab833000879b4c839f582aa9180453ea7daa837b21b495d17e2581acc3fe51519a8d38a050d9359
SSDEEP 768:LntOXNXVA5BuiMmiite96lxvkXn4AxAfdLxiIThsPVeG4hUdt+KqCRa4EOudBZt0:7tOXPA5Busiiuxg9WISICpEO4fUf
TLSH
T15C430AAB5C7BF6E1AF47CE618C9E89974AF551D92551622A8EF07E001C33E9FCE53080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 7ba6543f6061b3e7782d2cba3e01c2ca6f584ba0874b56423ee90ae0c9095d07
MD5 dc8a3e7b346fc5d3dd830f8fb464a842
SHA1 159e2a088253652e2854b93415fa8af681b4980a
SHA512 e36abbd9c4f182d35e97cebb773352f738405006a282a3bda146d23cbca408102f4251afe07ae068184574b52c7bbfa9892599af7916d53eafbb4db3659f32ff
TLSH
T159C08C2C2AA60A0AF6E843BC02C139439B208102E645CF191AF16A08CA96B162838C6A
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 9d5ea14b3c7122e5145c702cc2d210e9baa3dbd1217d9a327d73a0b50fdccf29
MD5 c203c89148973e1887266d6ee1096b8f
SHA1 2b27639e5ce88ed515dd288e39254f89d71bbd24
SHA512 5d0e54f87a8c8af20c1ef3a5de787ddf9739f290fef2714abb1027f01be66a82017888f566bb58be09b334ca7655bc0e50a42501e72516dd1088412e79ab9ec2
TLSH
T1ACC08C1C5A62460AF3E8437D02C16D439B208420F2858F151AB52A09CD11F502C34C28
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 0ea1e7508e96f6e76ecd4095ffb2b0d7eb122dfc51c3e5b7c9762482e838c358
MD5 1449155e877b2f037f436ffeda13fa3b
SHA1 52250510c5a18df47dc5d73310eada81119b465a
SHA512 a368da850bffe25f12d25e9654beadfe69e4ba8961755bc0a53a9d6fea0be730b7cc65765ef11c8a88d91b818db65cf338f53e538ab9e0470320cefcac9a01d5
TLSH
T1F7C08C182BE20606E2E80BBE22D02A839A24D001F2818F1A263A2A488D10B151C30C2C
MD5 SHA1 SHA512 TLSH

Submit Download

79C9CD216EFA26CA98115DC9A148DEF7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\79C9CD216EFA26CA98115DC9A148DEF7
Size 248B
SHA256 dc7cf44fa7be78ca15ff9b7403c5d5373c739187a3d4d373d9abc9684e67607c
MD5 5e33796b8910635a27d14ea2824d8c7f
SHA1 70b82ba550775009ba93189d6f498119de3ef781
SHA512 fbbb125e3eb277498e36e5fbc719a3abde4561c382575b8bf5f6aad2452a3c9baa7df855072df8f0c3c916c0252ae619061069ca9d19ad147630fd8020964bf4
TLSH
T196D0C9583B950339F2645376897509D17B6A7616B1924F6D3B22166C5C2DF070D31C09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f197b871b02ce87800167dbc3bcb99b3750f1b0b9da2aa5f1e1d03727f603ee
MD5 32db04e14c6bc75489be3ebc3a734fa0
SHA1 72321fb00285c9fe460d4a524fa77ad8e98898cf
SHA512 1f6f8f45f1f0bb72ff937aaa34f7d0a069322bd45d9004bb0f2793c790e9b5cb8aaed6b62dc89a0e85f8dec399218bf5d2ba2f910b33b0363e2c0b3f4735ec24
TLSH
T13AD0C018C538AFE0F033A13D02F13200308D1513FA077147659002140CB124300F0CF8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85dafce42912a0279b41afc95c495da39e731833a67285f36a029e30b3f5cb83
MD5 8f3b9f3675e474e57cec943e2a77db3b
SHA1 a19688cd6ac92f63b8937f033401256d7eb52c2e
SHA512 06dc5a3ab89c76c42f70f010907f6cbcf511d66d683baf99c414fdc9fd3317ff116a01e55f926a4c713294c53683e24283efd09bda06707fd21479dc7f7f74b5
TLSH
T1D0D0C048E304CF60F013D47802D6372C316B9602FC0BB92638D11284089160301B0868
MD5 SHA1 SHA512 TLSH

Submit Download

7c18eb2d-ae64-4fe2-85c9-b7981c580938.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c18eb2d-ae64-4fe2-85c9-b7981c580938.tmp
Size 414B
SHA256 a10fa7e6c249c32198399c0a7163e69b87ed20db79b483e9f37af8a48849bfef
MD5 590d1a19b31f974566d0ce9ebb48da05
SHA1 da447ced8bd0a491d01fa0efabbde368a5c54f3f
SHA512 24478c965369e29d1cae959947d0bdce1c1ae3f17914168e6183b8a47e960cfe412da648e972b8a016751fa22c422b4353470a857ab591603bb851daa0e93afe
TLSH
T1B9E02BA9C961AC6B2CFE172969584742F65053462650850F3A3CA10D8FB063B1686C9C
MD5 SHA1 SHA512 TLSH

Submit Download

80e0f6be-3d4d-4ce2-8310-fee8883385de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80e0f6be-3d4d-4ce2-8310-fee8883385de.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8176b156d1c3e314743edb8ccad22fcd9f259859671a33c45988e4deda4de48c
MD5 f7a01c1833463704e69453af33efc2cc
SHA1 5f5e8a2780dc8996cfd3616225f42f66bc29498d
SHA512 98c65cfa0f5b9258bdf2bfefb45c8141793a11db01d20cff6b921ec05a7b99c63c10ebee15d69c8e3fcf548477f3fedbb290e15dd8a2598b7916eba1f37b5373
TLSH
T112513482532023C2E7666EB659D1B94832FDC06E525B2FC97B409E3C6F46F68CAC2453
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b26af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b26af.TMP
Size 2KB
SHA256 98770fdb738b0be4932e9a35570495e1e966a30119bcf4de8bc14c4202227f38
MD5 107872eb0a20785cdf92bd8328843c40
SHA1 0d33a7ca2859ce155fe9e3d4f7f5ea3b9b5e1a06
SHA512 6fd4cdd17507b09133cfd71ada9e8404341cf51556719d74843a36eb94435c3c8ab4ab5784d8efcb50266c1587221249745d41c7c575ca377d4141756149eabe
TLSH
T10741A482532417D1D7A14EB365E1B65832FCD0BD8607AECA7A002D7DAF08F389BD1463
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 541aff3b127900256255762c8fa93af7c79b46de908d8a7aa00824d98a916e43
MD5 35135a0dd9ff65f3be889c39b0d84c19
SHA1 1193e404d33ae334d9e6c2fd90744bb2e8828f31
SHA512 0cc53c8beee3a040611f1e26dc0351de72b3be99c93e04f41e520068225cb570fe61aa77cbb3e5022d6fe4a08dfbc5f885ef3dd588447f4c415bfe7a53c5eee0
SSDEEP 96:DWrTiR0TaVaZjhaIzprkjSIApkV9IGwLPv6stwe+n:DWrTiRuaVaZjhaItrkjSIwkV9IGuPv6P
TLSH
T16BC1ADF7C7E9926D890156F4AA24AE1FCF1D0914432C3D26C8D8BE5BA3F24B1E141A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8dcafedb8b51827d357f351318529c446f79cabae9ce6b780e6a076b020c6e95
MD5 1e7918bd9b7fad643c4c752cbe3ce08d
SHA1 c4ce36da40b174c931223f8d61bc77d80ac025c4
SHA512 10a85e9ca426dfd347133f9fc5104fb93efdb9123a9f8e1bdba90b0097b068b183d15df6e20b5b6b81f90e7489abe9e335c314467c53b66a3ba482efde08c5e6
SSDEEP 192:sxRWRcCm/fSs+WpVXnZU7zoD8p9mY/g6+WNRqfwX6VpVVIsNGGdRxuO/gzIgD20J:sxRWNm/fSs+WvXZUjEY/5RXkVnhOL
TLSH
T1E952D9566924AD7B9CCBD21DFA55BF23D6F8503261D01F44AAFC9A1C00E77DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ae88f938f519851b740505abe255f62ba8955d7041753d4d0bbb7665955e1b6d
MD5 f3328fdd1d179068baf669cd8d5e75e3
SHA1 96f25eed1f7951eac648518bdb414f95ff8b2fe2
SHA512 138ca246e49dcd931b6e64f1f0b04bfc1bdd9c53264d4338ddf663e967cca2b37914669c9ef8ef44b1432efdcc0523d290c0cf12f20235ef011ba5f73708dd0d
SSDEEP 192:sxRVRXCm/fSsbCnZUjzoD8p9+/g6+WNzli/6OScVIsNC+dRquOiGzIgV0J:sxRVkm/fSseZU7I/5A/PVp8x6
TLSH
T1B742C8566924AD7B5CC7D21DFA55BF63D6F95033A1D01E48BAFC9A1C00E76DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 085a85d67a5e5b4e614a5774eda53f6decec52374d7e242373279e50c9796404
MD5 5a3633bcca9388042277019aefc33126
SHA1 a985e462fa5223c74ac04bc08655741739164155
SHA512 d7b0649871f9ca38b5f1f96e9e762fb016612076742eea669c5ec0df7a27e96f229b9dc5389867fd254dcea33031a9709cfb5323fa3d6f6e0848c05fc7598edb
SSDEEP 192:sxRWRXCm/fSsECnZUNzoD8p9mY/g6+WNzfwX6VpVVIsNCsdRquOiGzIgD20J:sxRWkm/fSsjZUpEY/50XkV/8xL
TLSH
T18242D9566D28A97B5CCBD21DFA55BF53D6F95032A1D01E48BAFC9A1C00E76DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 688dc469a2df52f9d7dd31f4a8abfb87737e4f9f11c891a9419a7f6fbe5bb751
MD5 44d4a9ce0ffdd2822a14063b77339a62
SHA1 a103efe171a11a953e88e3e9ce330910358dc5f0
SHA512 861202980c12be736e4c0e7ebe86f75bf8033c8346d3406bb0c86ed0ac99aa14d6fe965bb4391774b85967a1a84cebe1e91ff133bbd916dd55cd980d690a1801
SSDEEP 768:jC+v/N7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMm0Qqc6roZW:jC+v/7E7JQWgQ+f4+u1jaPm0Vcxs
TLSH
T193D2DA7B640DCB7F4F804ADDAC197EDE6DA802CB9698CD4047FA941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e9bbdd5060aad9f154e3dc9472d63f74c6ce61e47ba72329b1d956cccde36594
MD5 282382ab0b3c6e5d1dde81c176af8522
SHA1 d473471dee35542343751793fe4bd64b6ec90e02
SHA512 8c858718fe5293148ed6da7ad9fc955f11be5dd8518b85d859bd2c5d306ac67b8b34f900b5037d416c6e6fc58ea284e15a54c67a13600b94640f5ffb8b2d8152
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHyX+SkE0SWcJhgCSK4Xg4ScCqRwSbHYp89:CbEBVj5JAdSp9/EgTK7j6dJOHyX+SkEU
TLSH
T12D913300313B02C1383EB95CC1B89C6E86C174727416E66B3FA945AA4F67E479EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a4f869382e5c2808b0e9e6f3eaa9368704312c721a67eccdfc71db31b0c58ea6
MD5 a7dfd26fbf8827826213572faeb415e3
SHA1 26c60d48995ce52b2c3f2930b58c3555fb7929f8
SHA512 4795f9ac7c8a0176d825147dc5835464e3b560b669c7243216d4a5b003083478b67a41c15ad1395937a07ffa97dd834175ea1b9529c0489ab55aed60f3cbcb03
SSDEEP 768:Irv+4UNbdD3bcONp8+p3bd66j+4BRv86aLIi12bwCl1:Ibsbp3DL8+p3Z6n4yb0ww
TLSH
T15603BE73F9A899339CF6C644B24A7B437FF851A396C10AC4D4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 35edf3ca47479d6ba06149789f6c63ec950c17f122401122a4805280ebc90e82
MD5 e1b38d1bbc60e348451a958508d53a96
SHA1 53fcbfa1980476ab1450a7d27478f7803f91644e
SHA512 9008d87a09f8df015f97693d97a93a9a68125cfce0b6b487315a9840591f4cd2e3f32d6cc22d15aa04f7fd51b16ca11873394d073ef437a19e86207c5439de27
SSDEEP 768:1rv+4UNbdD3zY4xNp8+p3bd66j+4BRv86aLITn02bwCl1:1bsbp3LL8+p3Z6n4yE00ww
TLSH
T12903BE72E468DD339CE6C644B2867B837FF811A395C10ED4E8D96B4E405A29E270FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7f44ae809a358a14340df7d3c4f6f1da2daa772ba86da0053a2efd8ec7a32fd1
MD5 7bb5f6646c9643b3d63cf5377bff2463
SHA1 866b813fc7c37195bab7b6541b47b88c4442fe2f
SHA512 763a3164c57b4921cc37cd5febee6456b74c4dc2ef72e6988fb5e7673b6c33d3f4a117f56e6b17cad8b2aadf3c570c7898a56e08b11cfa446f57dabf69b8188f
SSDEEP 768:Yc3uq4x9p8+p3bd66j+4BRv86aLIWn0D184pie:Yc3y78+p3Z6n4yt0Wpe
TLSH
T127F2AEB1E8A9AD739CEAC344B69677436FF4506396C40E94D8D9BB0D045326E1B0FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0246f4f98b93fb5db58b837c6d75d70273d05e213e955fdbeb978901bf06190e
MD5 31deb73d011f3311c71a5185460fc957
SHA1 1e1188f165c623e1c237837a4d834cb232870652
SHA512 27d1f9682bb18f28fc4c81eb8dd412e66c0aba08492e23cca34878dcd1f140a369ce5425cce006555cd6e9180ae623e9874416148f5696d377621163cbab4a1e
SSDEEP 768:fc32q4x9p8+p3bd66j+4BRv86aLIWtoKRZ1RD184pie:fc3K78+p3Z6n4y/oKP1RWpe
TLSH
T163037CBDEC65AD3F88EEB708764E6A175EA84137D1F00994D7C96B0DC03315AF70A829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 af01834a7578ee7fbdd58784118ee9cdd5f86360e4e01acd1254d465d9a9ca72
MD5 b41591f8713d5838f9144dfcc491b022
SHA1 07b7d52da8ffd6599cd3e359fa333b46f3cb785a
SHA512 5b3b97815c2417864ea94daade8a1ae6e25daa210b0ddf0ec3df6a8a3b665e6fa364f29fb53f87317682866315b9ec4dc32288a10a8938886c7f7d9fc1c4d57c
SSDEEP 768:8rv+4UNbdD3Cq4xsp8+p3bd66j+4BRv86aLIWn0D184ps:8bsbp3eK8+p3Z6n4yt0Wh
TLSH
T15903AEB1F86CED739CF68644B28A7B437FB8216395C00E94D8D96B4D44571AE270FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8774edf3-2302-40bd-a042-2b6137513287.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8774edf3-2302-40bd-a042-2b6137513287.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

pl4sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe
Size 3.2MB
SHA256 c8ffa348bdf103061c1958d84e0afc4699ab14644584e5741a0ca86fe42f8936
MD5 848110c30533364755f288f0871467f8
SHA1 08d5d3238de0c1cd55dfb85358ec8d2e3f935d64
SHA512 5acb1ae0ef238e8eb4eedc71cc11324504dcfec9a52912a1cf9b91091c31717eb2103b6187c0dde4a00d1b5fb71cc9574e9b0b4cafb67f94d68eadfb7c58f8f8
SSDEEP 98304:DzTFhWFRKn9EYj9r6PkeXape55E54KsLVC+PrZ:jFoo9EYj9r6MeKpejTZDZ
TLSH
T17EF533927AC04EB3D03316328E3CAF649A7CBC215B7085EF6395945DDF21291A7317AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoFF1E.tmp\LangDLL.dll
Size 5KB
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
TLSH
T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoFF1E.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2976_1808559073\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download