hxxps://www[.]upload[.]ee/download/6888883/8db3c9bb14002347ded7/PLP9A[.]zip

Analysis

user interaction
yes
max time kernel
390s
max time network
385s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.upload.ee/download/6888883/8db3c9bb14002347ded7/PLP9A.zip
Sample261003-wsv6cswtbs

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
295	4356	msedge.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	NOTEPAD.EXE
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Activator.exe

Executes dropped EXE 36 IoCs

pid	Process
3240	processlassosetup64.exe
6016	installhelper.exe
2348	installHelper.exe
3688	installHelper.exe
2500	InstallHelper.exe
2100	InstallHelper.exe
4384	InstallHelper.exe
4536	InstallHelper.exe
732	installHelper.exe
5832	srvstub.exe
2808	bitsumsessionagent.exe
4744	ProcessLasso.exe
3636	installHelper.exe
5056	srvstub.exe
3728	processgovernor.exe
4708	installhelper.exe
4348	processlasso.exe
3384	bitsumsessionagent.exe
4660	bitsumsessionagent.exe
4752	processlassosetup64.exe
4744	installhelper.exe
3804	installhelper.exe
1364	installHelper.exe
616	InstallHelper.exe
728	InstallHelper.exe
4648	InstallHelper.exe
1456	InstallHelper.exe
3692	installHelper.exe
4496	srvstub.exe
1808	processgovernor.exe
4928	installhelper.exe
4952	processlasso.exe
3448	bitsumsessionagent.exe
5184	ProcessLassoLauncher.exe
2308	plActivate.exe
2732	plActivate.exe

Loads dropped DLL 39 IoCs

pid	Process
3240	processlassosetup64.exe
3240	processlassosetup64.exe
6016	installhelper.exe
2348	installHelper.exe
3688	installHelper.exe
2500	InstallHelper.exe
2100	InstallHelper.exe
4384	InstallHelper.exe
4536	InstallHelper.exe
732	installHelper.exe
4744	ProcessLasso.exe
4744	ProcessLasso.exe
3636	installHelper.exe
3728	processgovernor.exe
3728	processgovernor.exe
4708	installhelper.exe
4348	processlasso.exe
4348	processlasso.exe
4752	processlassosetup64.exe
4752	processlassosetup64.exe
4744	installhelper.exe
3804	installhelper.exe
1364	installHelper.exe
616	InstallHelper.exe
728	InstallHelper.exe
4648	InstallHelper.exe
1456	InstallHelper.exe
3692	installHelper.exe
1808	processgovernor.exe
1808	processgovernor.exe
4928	installhelper.exe
4952	processlasso.exe
4952	processlasso.exe
5184	ProcessLassoLauncher.exe
5184	ProcessLassoLauncher.exe
2308	plActivate.exe
2308	plActivate.exe
2732	plActivate.exe
2732	plActivate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Process Lasso\pl_rsrc_english.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\ProcessLasso.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\CPUEater.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_spanish.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_japanese.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\LogViewer.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_spanish.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\plActivate.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\srvstub.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\testlasso.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\stop-governor.bat	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_chinese_traditional.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_german.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\QuickUpgrade.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl.cmd	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\testlasso.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_bulgarian.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_korean.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_spanish.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_english.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_japanese.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_finnish.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\start-governor.bat	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\srvstub.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_polish.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_russian.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\bitsumsessionagent.exe	installhelper.exe
File opened for modification	C:\Program Files\Process Lasso\bitsumsessionagent.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\Insights.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_italian.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_chinese.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_russian.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\plActivate.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\uninstall.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_finnish.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_french.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_italian.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\ProcessGovernor.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\vistammsc.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_german.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_italian.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\vistammsc.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_finnish.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_chinese_traditional.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\stop-governor.bat	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\LICENSES	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_chinese.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\LogViewer.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_bulgarian.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\QuickUpgrade.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\ThreadRacer.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_ptbr.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_french.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_slovenian.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_turkish.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\LICENSES	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\uninstall.exe	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_bulgarian.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\pl_rsrc_english.dll	processlassosetup64.exe
File opened for modification	C:\Program Files\Process Lasso\ThreadRacer.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\InstallHelper.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\pl_rsrc_english.dll	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\ProcessGovernor.exe	processlassosetup64.exe
File created	C:\Program Files\Process Lasso\TweakScheduler.exe	processlassosetup64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	processlassosetup64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	processlassosetup64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4356	msedge.exe

Checks processor information in registry 2 TTPs 50 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processgovernor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processlasso.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processlasso.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processlasso.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processgovernor.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processgovernor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processlasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessLasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ProcessLasso.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processgovernor.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installHelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	installhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	installhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallHelper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\ProcessLasso\Language = "1033"	processgovernor.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\ProcessLasso\InstallerLanguageDWORD = "1033"	processgovernor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\ProcessLasso	processgovernor.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\ProcessLasso\Language = "1033"	processgovernor.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\ProcessLasso\InstallerLanguageDWORD = "1033"	processgovernor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\ProcessLasso	processgovernor.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\ProcessLasso\ProcessLasso = 09040000	processgovernor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\ProcessLasso	processgovernor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\ProcessLasso	processgovernor.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\ProcessLasso\ProcessLasso = 09040000	processgovernor.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{8591943D-91B1-4F05-8730-1414F4DE0C47}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Opens file in notepad (likely ransom note) 4 IoCs

ransomware

pid	Process
4960	NOTEPAD.EXE
4708	NOTEPAD.EXE
4744	NOTEPAD.EXE
3472	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
6016	installhelper.exe
4536	InstallHelper.exe
4536	InstallHelper.exe
4536	InstallHelper.exe
4536	InstallHelper.exe
4708	installhelper.exe
4708	installhelper.exe
4708	installhelper.exe
4708	installhelper.exe
3728	processgovernor.exe
3728	processgovernor.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
3728	processgovernor.exe
3728	processgovernor.exe
4744	ProcessLasso.exe
4744	ProcessLasso.exe
4744	ProcessLasso.exe
3728	processgovernor.exe
3728	processgovernor.exe
3728	processgovernor.exe
3728	processgovernor.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4744	ProcessLasso.exe
4744	ProcessLasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
3728	processgovernor.exe
3728	processgovernor.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3448	bitsumsessionagent.exe
1808	processgovernor.exe
2924	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	6016	installhelper.exe
Token: SeDebugPrivilege	6016	installhelper.exe
Token: SeChangeNotifyPrivilege	6016	installhelper.exe
Token: SeIncBasePriorityPrivilege	6016	installhelper.exe
Token: SeIncreaseQuotaPrivilege	6016	installhelper.exe
Token: SeProfSingleProcessPrivilege	6016	installhelper.exe
Token: SeAssignPrimaryTokenPrivilege	2348	installHelper.exe
Token: SeDebugPrivilege	2348	installHelper.exe
Token: SeChangeNotifyPrivilege	2348	installHelper.exe
Token: SeIncBasePriorityPrivilege	2348	installHelper.exe
Token: SeIncreaseQuotaPrivilege	2348	installHelper.exe
Token: SeProfSingleProcessPrivilege	2348	installHelper.exe
Token: SeAssignPrimaryTokenPrivilege	3688	installHelper.exe
Token: SeDebugPrivilege	3688	installHelper.exe
Token: SeChangeNotifyPrivilege	3688	installHelper.exe
Token: SeIncBasePriorityPrivilege	3688	installHelper.exe
Token: SeIncreaseQuotaPrivilege	3688	installHelper.exe
Token: SeProfSingleProcessPrivilege	3688	installHelper.exe
Token: SeAssignPrimaryTokenPrivilege	2500	InstallHelper.exe
Token: SeDebugPrivilege	2500	InstallHelper.exe
Token: SeChangeNotifyPrivilege	2500	InstallHelper.exe
Token: SeIncBasePriorityPrivilege	2500	InstallHelper.exe
Token: SeIncreaseQuotaPrivilege	2500	InstallHelper.exe
Token: SeProfSingleProcessPrivilege	2500	InstallHelper.exe
Token: SeAssignPrimaryTokenPrivilege	2100	InstallHelper.exe
Token: SeDebugPrivilege	2100	InstallHelper.exe
Token: SeChangeNotifyPrivilege	2100	InstallHelper.exe
Token: SeIncBasePriorityPrivilege	2100	InstallHelper.exe
Token: SeIncreaseQuotaPrivilege	2100	InstallHelper.exe
Token: SeProfSingleProcessPrivilege	2100	InstallHelper.exe
Token: SeAssignPrimaryTokenPrivilege	4384	InstallHelper.exe
Token: SeDebugPrivilege	4384	InstallHelper.exe
Token: SeChangeNotifyPrivilege	4384	InstallHelper.exe
Token: SeIncBasePriorityPrivilege	4384	InstallHelper.exe
Token: SeIncreaseQuotaPrivilege	4384	InstallHelper.exe
Token: SeProfSingleProcessPrivilege	4384	InstallHelper.exe
Token: SeAssignPrimaryTokenPrivilege	4536	InstallHelper.exe
Token: SeDebugPrivilege	4536	InstallHelper.exe
Token: SeChangeNotifyPrivilege	4536	InstallHelper.exe
Token: SeIncBasePriorityPrivilege	4536	InstallHelper.exe
Token: SeIncreaseQuotaPrivilege	4536	InstallHelper.exe
Token: SeProfSingleProcessPrivilege	4536	InstallHelper.exe
Token: SeAssignPrimaryTokenPrivilege	732	installHelper.exe
Token: SeDebugPrivilege	732	installHelper.exe
Token: SeChangeNotifyPrivilege	732	installHelper.exe
Token: SeIncBasePriorityPrivilege	732	installHelper.exe
Token: SeIncreaseQuotaPrivilege	732	installHelper.exe
Token: SeProfSingleProcessPrivilege	732	installHelper.exe
Token: SeAssignPrimaryTokenPrivilege	5832	srvstub.exe
Token: SeCreateGlobalPrivilege	5832	srvstub.exe
Token: SeAssignPrimaryTokenPrivilege	4744	ProcessLasso.exe
Token: SeDebugPrivilege	4744	ProcessLasso.exe
Token: SeChangeNotifyPrivilege	4744	ProcessLasso.exe
Token: SeIncBasePriorityPrivilege	4744	ProcessLasso.exe
Token: SeIncreaseQuotaPrivilege	4744	ProcessLasso.exe
Token: SeCreateGlobalPrivilege	4744	ProcessLasso.exe
Token: SeProfSingleProcessPrivilege	4744	ProcessLasso.exe
Token: SeBackupPrivilege	4744	ProcessLasso.exe
Token: SeRestorePrivilege	4744	ProcessLasso.exe
Token: SeShutdownPrivilege	4744	ProcessLasso.exe
Token: SeAssignPrimaryTokenPrivilege	3636	installHelper.exe
Token: SeDebugPrivilege	3636	installHelper.exe
Token: SeChangeNotifyPrivilege	3636	installHelper.exe
Token: SeIncBasePriorityPrivilege	3636	installHelper.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe
4348	processlasso.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
6080	Activator.exe
6080	Activator.exe
3240	processlassosetup64.exe
6016	installhelper.exe
2348	installHelper.exe
3688	installHelper.exe
2500	InstallHelper.exe
2100	InstallHelper.exe
4384	InstallHelper.exe
4536	InstallHelper.exe
732	installHelper.exe
3636	installHelper.exe
4708	installhelper.exe
4348	processlasso.exe
4280	OpenWith.exe
5460	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
5460	OpenWith.exe
4752	processlassosetup64.exe
4744	installhelper.exe
3804	installhelper.exe
1364	installHelper.exe
616	InstallHelper.exe
728	InstallHelper.exe
4648	InstallHelper.exe
1456	InstallHelper.exe
3692	installHelper.exe
4928	installhelper.exe
4952	processlasso.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 2556	4620	msedge.exe	86
PID 4620 wrote to memory of 4356	4620	msedge.exe	87
PID 4620 wrote to memory of 1900	4620	msedge.exe	89
PID 4620 wrote to memory of 2392	4620	msedge.exe	88
PID 4620 wrote to memory of 1900	4620	msedge.exe	89
PID 4620 wrote to memory of 2392	4620	msedge.exe	88
PID 4620 wrote to memory of 2392	4620	msedge.exe	88
PID 4620 wrote to memory of 1784	4620	msedge.exe	90
PID 4620 wrote to memory of 1784	4620	msedge.exe	90
PID 4620 wrote to memory of 1072	4620	msedge.exe	91
PID 4620 wrote to memory of 1784	4620	msedge.exe	90
PID 4620 wrote to memory of 1072	4620	msedge.exe	91
PID 4620 wrote to memory of 1072	4620	msedge.exe	91
PID 4620 wrote to memory of 3524	4620	msedge.exe	92
PID 4620 wrote to memory of 3524	4620	msedge.exe	92
PID 4620 wrote to memory of 3524	4620	msedge.exe	92
PID 4620 wrote to memory of 1836	4620	msedge.exe	93
PID 4620 wrote to memory of 1836	4620	msedge.exe	93
PID 4620 wrote to memory of 1836	4620	msedge.exe	93
PID 4620 wrote to memory of 3348	4620	msedge.exe	98
PID 4620 wrote to memory of 3348	4620	msedge.exe	98
PID 4620 wrote to memory of 3348	4620	msedge.exe	98
PID 4620 wrote to memory of 1752	4620	msedge.exe	99
PID 4620 wrote to memory of 1752	4620	msedge.exe	99
PID 4620 wrote to memory of 1752	4620	msedge.exe	99
PID 4620 wrote to memory of 2104	4620	msedge.exe	100
PID 4620 wrote to memory of 2104	4620	msedge.exe	100
PID 4620 wrote to memory of 2104	4620	msedge.exe	100
PID 4620 wrote to memory of 3032	4620	msedge.exe	101
PID 4620 wrote to memory of 3032	4620	msedge.exe	101
PID 4620 wrote to memory of 3032	4620	msedge.exe	101
PID 4620 wrote to memory of 4528	4620	msedge.exe	102
PID 4620 wrote to memory of 4168	4620	msedge.exe	103
PID 4620 wrote to memory of 4528	4620	msedge.exe	102
PID 4620 wrote to memory of 4168	4620	msedge.exe	103
PID 4620 wrote to memory of 992	4620	msedge.exe	104
PID 4620 wrote to memory of 992	4620	msedge.exe	104
PID 4620 wrote to memory of 992	4620	msedge.exe	104
PID 4620 wrote to memory of 4080	4620	msedge.exe	105
PID 4620 wrote to memory of 4080	4620	msedge.exe	105
PID 4620 wrote to memory of 4080	4620	msedge.exe	105
PID 4620 wrote to memory of 972	4620	msedge.exe	109
PID 4620 wrote to memory of 5036	4620	msedge.exe	114
PID 4620 wrote to memory of 5036	4620	msedge.exe	114
PID 4620 wrote to memory of 5036	4620	msedge.exe	114
PID 4620 wrote to memory of 696	4620	msedge.exe	115
PID 4620 wrote to memory of 696	4620	msedge.exe	115
PID 4620 wrote to memory of 696	4620	msedge.exe	115
PID 4620 wrote to memory of 2096	4620	msedge.exe	118
PID 4620 wrote to memory of 2096	4620	msedge.exe	118
PID 4620 wrote to memory of 2096	4620	msedge.exe	118
PID 4620 wrote to memory of 4656	4620	msedge.exe	119
PID 4620 wrote to memory of 4656	4620	msedge.exe	119
PID 4620 wrote to memory of 4656	4620	msedge.exe	119
PID 4620 wrote to memory of 5544	4620	msedge.exe	121
PID 4620 wrote to memory of 5552	4620	msedge.exe	122
PID 4620 wrote to memory of 5544	4620	msedge.exe	121
PID 4620 wrote to memory of 5552	4620	msedge.exe	122
PID 4620 wrote to memory of 5552	4620	msedge.exe	122
PID 4620 wrote to memory of 5564	4620	msedge.exe	123
PID 4620 wrote to memory of 5460	4620	msedge.exe	132
PID 4620 wrote to memory of 5412	4620	msedge.exe	133
PID 4620 wrote to memory of 5476	4620	msedge.exe	134
PID 4620 wrote to memory of 5428	4620	msedge.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.upload.ee/download/6888883/8db3c9bb14002347ded7/PLP9A.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa1396c188,0x7ffa1396c194,0x7ffa1396c1a0
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,7006836273410584101,15560552537122147865,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,9665363191472912914,4660734217049302117,262144 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,3824339547835812795,8159620410224717133,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,5348174244114705893,4545238416329414711,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,3811529852805087107,8254373279541230703,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,18445353597278201580,11234975554559592251,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,3225471229416713701,4582849166115640295,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5084,i,8035953140765210507,17103580612619624784,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5276,i,2720363305741785553,833148881711140271,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5416,i,2368879550945885684,10279836397849367326,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5640,i,17261806334736820976,5810977178771324255,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,14531299395078171541,5341409931166767879,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,9303165929148755120,6457856412113296893,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6304,i,4812619542294891429,1360376411794363509,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6484,i,6733965412543293037,2006060819472831395,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,12467564020009034510,2066711919254164987,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,12467564020009034510,2066711919254164987,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4176,i,14764818034976823404,16335144726590887634,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6324,i,381488365201059338,6180634561454995196,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5740,i,2001863219957841978,14349565637064548409,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7344,i,8534517366538879673,11601322475482433957,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,4695436072386871970,15083665027512949820,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=8040,i,14807715242778994843,1379948920114118488,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8144,i,8781863390986866758,12263294845007927818,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=7992 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,9429982319826276282,2193676671172585207,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7816,i,1473077712970518369,6492278398044820436,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7820,i,516991152910445365,10910053277083515046,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,515084874275052192,16819175709884451694,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,4828154531494332595,4683338637011600765,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7840,i,13778541972768454703,5440367793298579777,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7740,i,9225519257562806629,6844124045300638247,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5156,i,8653071734598497182,6236032787493961839,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4352,i,9705975424504045964,1766180471618934284,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7276,i,6358916237882143619,2936287089702906015,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6328,i,13440726037356295811,5071767355105051317,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5312,i,7253604272829750237,10707265004681259126,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7160,i,3637415517014828755,11280252127621830894,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7376,i,8185834867710162419,1022478362113402536,2097152 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,6403108996789337808,7348722769670806657,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:2536
- C:\Users\Admin\Downloads\processlassosetup64.exe
  "C:\Users\Admin\Downloads\processlassosetup64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3240
- - C:\Program Files\Process Lasso\installhelper.exe
    "C:\Program Files\Process Lasso\installhelper.exe" /terminate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:6016
- - C:\Program Files\Process Lasso\installHelper.exe
    "C:\Program Files\Process Lasso\installHelper.exe" /firstinstall
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2348
- - C:\Program Files\Process Lasso\installHelper.exe
    "C:\Program Files\Process Lasso\installHelper.exe" /migrate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3688
- - C:\Program Files\Process Lasso\InstallHelper.exe
    "C:\Program Files\Process Lasso\InstallHelper.exe" /powerinstall
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2500
- - C:\Program Files\Process Lasso\InstallHelper.exe
    "C:\Program Files\Process Lasso\InstallHelper.exe" /install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2100
- - C:\Program Files\Process Lasso\InstallHelper.exe
    "C:\Program Files\Process Lasso\InstallHelper.exe" /env_path_install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4384
- - C:\Program Files\Process Lasso\InstallHelper.exe
    "C:\Program Files\Process Lasso\InstallHelper.exe" /enable_update_check
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4536
- - C:\Program Files\Process Lasso\installHelper.exe
    "C:\Program Files\Process Lasso\installHelper.exe" /initconfig
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:732
- - C:\Program Files\Process Lasso\installHelper.exe
    "C:\Program Files\Process Lasso\installHelper.exe" /startgovernorservice
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3636
- - C:\Program Files\Process Lasso\installhelper.exe
    "C:\Program Files\Process Lasso\installhelper.exe" /langcheck
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4708
- - C:\Program Files\Process Lasso\processlasso.exe
    "C:\Program Files\Process Lasso\processlasso.exe" /install /nodelay /showwindow
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8120,i,4946987730683049058,11936508016499138397,262144 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,7508289234715121444,16916130295832970942,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7908,i,11184388989194514429,4200114886210703712,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,6781888362076120922,11441591188040267846,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  PID:4716
- C:\Users\Admin\Downloads\processlassosetup64.exe
  "C:\Users\Admin\Downloads\processlassosetup64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4752
- - C:\Program Files\Process Lasso\installhelper.exe
    "C:\Program Files\Process Lasso\installhelper.exe" /terminate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:4744
- - C:\Program Files\Process Lasso\installhelper.exe
    "C:\Program Files\Process Lasso\installhelper.exe" /clearoldlogs
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:3804
- - C:\Program Files\Process Lasso\installHelper.exe
    "C:\Program Files\Process Lasso\installHelper.exe" /migrate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:1364
- - C:\Program Files\Process Lasso\InstallHelper.exe
    "C:\Program Files\Process Lasso\InstallHelper.exe" /powerinstall
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:616
- - C:\Program Files\Process Lasso\InstallHelper.exe
    "C:\Program Files\Process Lasso\InstallHelper.exe" /install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:728
- - C:\Program Files\Process Lasso\InstallHelper.exe
    "C:\Program Files\Process Lasso\InstallHelper.exe" /env_path_install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:4648
- - C:\Program Files\Process Lasso\InstallHelper.exe
    "C:\Program Files\Process Lasso\InstallHelper.exe" /enable_update_check
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:1456
- - C:\Program Files\Process Lasso\installHelper.exe
    "C:\Program Files\Process Lasso\installHelper.exe" /startgovernorservice
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:3692
- - C:\Program Files\Process Lasso\installhelper.exe
    "C:\Program Files\Process Lasso\installhelper.exe" /langcheck
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:4928
- - C:\Program Files\Process Lasso\processlasso.exe
    "C:\Program Files\Process Lasso\processlasso.exe" /install /nodelay /showwindow
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,15819414309933054484,405860757102121495,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,1081935093261895542,12069121620034751739,524288 --field-trial-handle=2408,i,9832352759224212562,11588373857759236212,262144 --variations-seed-version --mojo-platform-channel-handle=8012 /prefetch:8
  2⤵
  PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5976

C:\Users\Admin\AppData\Local\Temp\Temp1_PLP9A.zip\Activator.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_PLP9A.zip\Activator.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6080

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_PLP9A.zip\History.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4960

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_PLP9A.zip\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4708

C:\Program Files\Process Lasso\srvstub.exe
"C:\Program Files\Process Lasso\srvstub.exe" "C:\Program Files\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5832

C:\Program Files\Process Lasso\bitsumsessionagent.exe
"C:\Program Files\Process Lasso\bitsumsessionagent.exe"
1⤵
- Executes dropped EXE
PID:2808

C:\Program Files\Process Lasso\ProcessLasso.exe
"C:\Program Files\Process Lasso\processlasso.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Program Files\Process Lasso\srvstub.exe
"C:\Program Files\Process Lasso\srvstub.exe" "C:\Program Files\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent
1⤵
- Executes dropped EXE
PID:5056
- C:\Program Files\Process Lasso\processgovernor.exe
  "C:\Program Files\Process Lasso\processgovernor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3728

C:\Program Files\Process Lasso\bitsumsessionagent.exe
"C:\Program Files\Process Lasso\bitsumsessionagent.exe" ----------------------------------------------------------------
1⤵
- Executes dropped EXE
PID:3384

C:\Program Files\Process Lasso\bitsumsessionagent.exe
"C:\Program Files\Process Lasso\bitsumsessionagent.exe" ----------------------------------------------------------------
1⤵
- Executes dropped EXE
PID:4660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5460
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  PID:4472

C:\Program Files\Process Lasso\srvstub.exe
"C:\Program Files\Process Lasso\srvstub.exe" "C:\Program Files\Process Lasso\processgovernor.exe" "ProcessGovernor" /exitevent:Global\ProcessGovernorExitEvent
1⤵
- Executes dropped EXE
PID:4496
- C:\Program Files\Process Lasso\processgovernor.exe
  "C:\Program Files\Process Lasso\processgovernor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1808

C:\Program Files\Process Lasso\bitsumsessionagent.exe
"C:\Program Files\Process Lasso\bitsumsessionagent.exe" ----------------------------------------------------------------
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:3448

C:\Program Files\Process Lasso\ProcessLassoLauncher.exe
"C:\Program Files\Process Lasso\ProcessLassoLauncher.exe" /showwindow /nodelay
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5184

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\ProgramData\ProcessLasso\config\prolasso.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:4744

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\ProgramData\ProcessLasso\logs\processlasso.log
1⤵
- Opens file in notepad (likely ransom note)
PID:3472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2924
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Process Lasso\LICENSES
  2⤵
  PID:4788

C:\Program Files\Process Lasso\plActivate.exe
"C:\Program Files\Process Lasso\plActivate.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308

C:\Program Files\Process Lasso\plActivate.exe
"C:\Program Files\Process Lasso\plActivate.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallHelper.exe

Path C:\Program Files\Process Lasso\InstallHelper.exe
Size 896KB
SHA256 5d3f3b8ddee4becc58292f995ea30132d250e0fb0a7d2545d150e91b4156fd10
MD5 fa06d8bafaeaa39cd0a11de491ed5790
SHA1 c9359fe4b63e75956731a5b079edd51e9faede8f
SHA512 d83e6c7d67035c7e613b9cd035d415adf4d68066b462b676b3cb5fe3cab933ae600ebcfb70751507ee06b6d6c86c5a4c6c244f2b6a3f3f0de9804f9e8f1962dc
SSDEEP 24576:/Zjgah8YGdAGGi+bQUxZq/HG+LFqwDaGGEIP:Rjlh8bAGGiuQUxZq3L7DaR1
TLSH
T1FB15C1D056BA49ACD0A5CD3D8981CC9AE5EB7D0C473D7ABB027438580F3EB994A74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProcessGovernor.exe

Path C:\Program Files\Process Lasso\ProcessGovernor.exe
Size 1.3MB
SHA256 5b57a47b181c9a8d309bc5210ac46051d4473699675c9905f0110e14c129b377
MD5 24cafce405492fac20c83952acff57ec
SHA1 5188f0453015e1f573987ec9d1c7907cf9db145a
SHA512 4bbc89b3560e0d76e5152d09c1f9193bb13e6be932ffecfa089eee477ab2b979afd3cce7a492a532c25c83e0926306b6db5f85c2638e03ed04e576ee3e204b84
SSDEEP 24576:LgDX8Ivgm43Kjtoou1JG7rTzDlZIHOlxPb9GLLc:Lg78x391JG7bJZ4ExML
TLSH
T1DC5518D416B906ACE066D87C8981CC8AE5EB7C0D073D7AFB02B036591F3EBE54979E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProcessLasso.exe

Path C:\Program Files\Process Lasso\ProcessLasso.exe
Size 2.5MB
SHA256 3643982a58b21712add1b4c806412c48fec54b7ded78ec4e782e5bb8480cae2b
MD5 c1245b32eda5287f58fd45ef025b5444
SHA1 2a2eff6dcbb95365ce6a1c2efdcb98266dee4bf8
SHA512 a4cf0bc44eb8add6b33757e29cd1e4707dff9523fbedded3790aab7d988a1ff61fb9cf06c5b4c4161c0713b99a65c344d65659b79b21dcd11599fda4e296c5f5
SSDEEP 49152:DCjNs9qI6TCJRs0RalxtulGAr9usAUlF6EskadfJMmgU:2jFwlGEk8FyTdxBj
TLSH
T16EC5399622A801ADE476C47C89858D47E6FB7C0C173979FB01A0B5591F3FBEA0A39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProcessLassoLauncher.exe

Path C:\Program Files\Process Lasso\ProcessLassoLauncher.exe
Size 408KB
SHA256 c3cb9527ebfeb123b2974027513a0aecf47b5edb303d490f6422e7b62bf53223
MD5 121a463552660cfe6050b288fb754976
SHA1 d93497ec8dedeb381725899ca3d3fd2777884968
SHA512 c59b450a4ae26907e530bdd88fec0e6170fd12e305ad9c1ee1f2507123a28bae267f12c3db8f88635efcb5bddf2c8da5f5f0a2ff46b52d724ed028e245ba5d80
SSDEEP 3072:f+zuRv1YLaD3Sx3C2alOKnSKvGfMsQr10Yu0zAtFc+k7HoZ7WK7TlQ4O25D:feuHNrSx3CTpnFP0Fc+7WGi45h
TLSH
T13F944CD51ABA8DACD061CD7C8AC1CCC9A6DF6E0C863D3A3A4278345C5F7CBDA5964D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl_rsrc_english.dll

Path C:\Program Files\Process Lasso\pl_rsrc_english.dll
Size 1.9MB
SHA256 61ee139f30045cea0d4d25204f98a637fe615e274e137f46a5a1a6ec7ad72c5d
MD5 b5e67ba341ff2135bf587c1afe41aeed
SHA1 ad2bf780ebb89b018180ff22c2794919e86afc6f
SHA512 be322ef703cff719b367d4689adf51b75715fd0043099a7474371543ee2a074aacd4cb0bf9195712eba5ed2d2ccd774c3ce13fe6d5576211ac231f9e22abed7d
SSDEEP 6144:RVfFa9MmhuV2FFdq7qFrwnim0gsZEeV3dyvl2r8jFC8fB4adLxp7WGCNE/Jt1icw:LfcHoo2FzLXKGh4ZJe6cwTqREewM7t0h
TLSH
T1EF9571CE12FADC58F179EE781DA04E5818D73C8DE838B13D3A31711E99786669828F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

srvstub.exe

Path C:\Program Files\Process Lasso\srvstub.exe
Size 131KB
SHA256 372ab689259d721b7bdc81407017e361bd7bd79d6ae8935c68edb520624f58f0
MD5 905b3aa0cf60e7cf32e384c235182ae3
SHA1 280c476d816a9f1300a132a444c77672035fbfe8
SHA512 acf9bb101fd61b3f6917fc2103af14144229ed9e8ea571b98174475757c12baf031d905669dd4c5004e862d80d66e8cae14cda5702fd915ada28c34ac09ea4b1
SSDEEP 3072:gEYvuYeweXlgl3ku3f+p9J6BFsJADT+wOCwPnvUO6h2ev:121eO3ku3WbJ1/nvptev
TLSH
T1A9D36C57B3E530F8E1778279C4A1170AEB72B8721BA09BDF07A046651F232D09E3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files\Process Lasso\uninstall.exe
Size 287KB
SHA256 4581c2d2158e81ac7dc17ae65d84b7e55f50757359884e28f7e6e9e23b1392ed
MD5 0ee5535222f8a7cfa1b8a00a3c9d7442
SHA1 d067ac65d7ca9c7d570b5b8a5b9f7f094bb98bda
SHA512 47a79d7b9e06f7a97b6f2f6ffbacf4e1bd8c884ec8dd571a6a1b0c44c1f10d4dc20e648e681db2ce1ce495304c56bcfdf2c697b4dce92eaf7994dae341fa76c8
SSDEEP 3072:4fY/TU9fE9PEtuXQ+WK/yTjAn1eDetT83:uYa6JQ+Wzwn1iUT83
TLSH
T16254B4D51ABA8DACD460DEBC8AD1CCC974CF9E0C953E3A3A4678340C5FBCB9A5494C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prolasso.ini

Path C:\ProgramData\ProcessLasso\config\prolasso.ini
Size 10KB
SHA256 c23e3fde2bc1ec192cb08fb19062af1fbc5d9b9a8f83c3f1d766c1f0b4831049
MD5 9075cac5ba918239a54de093f8e0b99c
SHA1 e8c394bd168ea9175d604c35ef0208710169856a
SHA512 e2b0be2b2e104537004d76b65681343f704f5da27b040c07c214131b3a1e6dda8a2f48dda882c81c2ecd9b28be3729f6f270efb4280db292b625d14177c2c0ca
SSDEEP 192:OWCU8hjD6xebh7kFaMm3aIm6XKWYFcCZiONkMN6eWYsaEeAu2:n18hjD7t7zHaIm6XKWYFcKiONkMN6eWd
TLSH
T191228B9397F92008F2BB1F64EEB868B64BB7BC665E19C49D41D4010D05F1E90D9B23B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

119bb4de-af5e-4ea2-b8c0-d06ed4c08fe5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\119bb4de-af5e-4ea2-b8c0-d06ed4c08fe5.tmp
Size 26KB
SHA256 f065ae5332a8eaf5c93ae4b5e2e0effebccb0f77986307561fec79851f321e51
MD5 c381ed37e5008a667da78df5e833a730
SHA1 0a47c5b2a2ade75d818a5d24028ab21f61eb6cbd
SHA512 b2adc8a12cb3ee7e7591e1964582198179753e7754eaf269a2e4275eee0356f2629946382aaae5dbeb87b55ff49e56e5f04e40f3ecb5049afe661ef7df104ce3
SSDEEP 384:CiF9ZcIv9sN98TUNTUlIRROY4iPU1QJKVLzIGmQ2msMFirtgOIwZOyWgo4:JFl1UwgiYotfT2xAirXs4X
TLSH
T1FFC22AF288E798B6E9AE9747A77D2D038D7CC117B6C09690B3C8560CCC961BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

348a9774-ccb9-4809-940b-25034bf913ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\348a9774-ccb9-4809-940b-25034bf913ff.tmp
Size 26KB
SHA256 81915f7e662d46ae875f5d48311ec9191f861b7cd5354cd473e7476d49662d45
MD5 38b60f8b2a6d3b198d5cc993f43826dc
SHA1 cd1e559a492a2c8fdec6cf770b00e0694ecb56f3
SHA512 5b01117bb10595db5509bfd15c428e6284dcb713c9e1a88503ffd5957d1a0c3acdf2fa3b11886e7d1b2cca81a8846c68edf516f606975114bdc293174ce47eed
SSDEEP 384:CiFPZcIv0sNo8TUNTUlIlRFY4iPU1QlKVLzIGmQ2msMUirtgOIwZOyWgo4:JFHs7wglYopfT2xZirXs4X
TLSH
T1B0C22AF388E788B6D9AE9747A77D2E138D7CC157B680A690B3C8550CCC961BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60a59662-70cd-455c-9cf0-81078e1fbddd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\60a59662-70cd-455c-9cf0-81078e1fbddd.tmp
Size 18KB
SHA256 41f6d53ed2834b3925771d1563a061e111299e4feb91af3feb8449408e23c46f
MD5 f32fb33f315c939c687118ad906a0187
SHA1 b419f8d1e88839a15a5bff37530c89e21d15c2e7
SHA512 763f24e5280615fef917ecdbe7fac79adfc3ecf3da218b3cae34509343266190f26a51bd5baa0b6bbbcdd899da2e909b64cd3aa2ac186af6fba487ce1a71317e
SSDEEP 384:pZcI9sNxoFY4iPU1Q6Klg2zIGmQ2msMairtgOIwZOyWgo4:h9PYomgAT2xzirXs4X
TLSH
T15B827D739CB89CB76DE7A144F58636139EB48127A3C56F84C4ED5B1C00EB2A9130BE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8747e352-7380-4e38-8042-6ea2dea83a6f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8747e352-7380-4e38-8042-6ea2dea83a6f.tmp
Size 18KB
SHA256 72740297c70352422a902b420a851761b66242459cd8ce54d871890bc7f3cccb
MD5 91d7c943c98255f8d108559b6233f9fe
SHA1 19ba6c9184af58fa8432ba12cd4ce997c882de0d
SHA512 f4a93c737b0265f37278d82111cedaec10fbd8f2a0c7f4dee5012919d9861049f326bb73b5d3eb2793f38f12cda7a1c10422a66b7b9e6c93fa817e45a8a2522b
SSDEEP 384:sZcIhsNxkFY4iPU1QLKlg2zIGmQ2msMairtgOIwZOyWgo4:6hvYotgAT2xzirXs4X
TLSH
T1A6827D73DCB89CB76DE7A544F58636135EB88127A3C5AB84C4DD671C00EB2A9130BE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd7e8f2c-4ff3-41cc-9a67-10658ac53e53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\fd7e8f2c-4ff3-41cc-9a67-10658ac53e53.tmp
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e73b391410b47c494ee7953905a0c60fd04c6bc35617583539b46b92968689a8
MD5 c67fbef7f62bf0056c3e3f786716b78a
SHA1 45f832458a5b84f29df5280a7973ebf46d014c4b
SHA512 623599849df6e275e849b53aa15de4c0c6df018ceb72805f4afbfea2a8577410fc6f21085b8473298805a9eec11bfc75b61276472cfcad39c54461995984dd1a
TLSH
T180D0C0F0CEF896F0F031343C01344142308C274122021211B432001C0C900C34265DE8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

1c985e1c-c30d-4a9a-b03e-000bee17d3ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c985e1c-c30d-4a9a-b03e-000bee17d3ae.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ab29a1a-cbb1-408f-84e6-6a5c07765687.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3ab29a1a-cbb1-408f-84e6-6a5c07765687.tmp
Size 14KB
SHA256 3c59f59284d30b1b261c55e6fb4663b52a7d97cd9966cc6cba12dc8b2fd22544
MD5 9a1099c7f67a515768f3826b851f7bae
SHA1 263d2355c2930422aeeb4031f0d7b254e7247af5
SHA512 01c33d09dcf4b6a450b9098f5cc243c3e98179b57214d3fb84e452db182c3b790524a87418737cd538dad43b0aad0aaefedd58967bb98d516bca6f1141e1ade5
SSDEEP 192:sxZIRjucBWZ/fesm47dpCcuKwP3byb6HW6+WN1vNpsI9FBW/YapGo3Ig5MIWztNQ:sxZIwmWZ/fesms6HHbLK/RVWzUZ
TLSH
T10862C863693499FB8CCAD519B934BF56D3F5502299D04E4CAAFCC91C04DB6FE120384B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b6bff6c-f918-4af5-afaf-6196a08d34e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6b6bff6c-f918-4af5-afaf-6196a08d34e6.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6ced17a6-7de5-44b6-9261-37224ca1d879.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ced17a6-7de5-44b6-9261-37224ca1d879.tmp
Size 29KB
SHA256 8e40306609c500d879908a2d509261db7eba5fe891a5bd0bc44d7d08483c38dc
MD5 5ae11fea1ce63fe61933d68cf8a1ffdb
SHA1 f8e5d0d07254161cd64a2985c715ae146f97811a
SHA512 0f0527759ebeb3c2e094d1fe72d6e95fea102785eb12ca0f57454c721c6ca6329b9f1f1e8f52d85c958df4204f93c6f5ae036fb8b55ae043adc41ea95b3c3506
SSDEEP 384:sxZIwmWZ/fesC66s8qMpRiYnazAW8pZS15posJWeT+6s6HHbLK/GVWzUZ:swwmWZ/fc4Mnc7WeT+6zHHbshzUZ
TLSH
T1B8D209529924C8BB8EC35D18783C7E32DAEC50525AC5CEDE6AECC91C019E1FDAB07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7843a403-5b0d-4885-95f8-36094a8ab7a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7843a403-5b0d-4885-95f8-36094a8ab7a9.tmp
Size 11KB
SHA256 4e170876414a32e7ffbe1dc83375f31fa7aa3d543dd168318169ffc4576878bb
MD5 ea416356e1df65a1960e6e471f7e5162
SHA1 7d7b45878fa4ed0d4336e5ce53cadd36881c3590
SHA512 77a14a639cd9d4addf7ac03e5d2882224a79e3313aa05b68c6462bd4c761e7a7b25587f221eb2b2d26fdf678ddc1648b6f53d0429427d25af307405cea532be1
SSDEEP 192:sxZIRjWZ/fesXkBIdpQcuwbyb6HW6+WN1vNiBW/Yapro3IgrJ:sxZIYZ/fesXVYSHbZ/S9
TLSH
T14232D9626E3459BB8CD7D21DBA54BB53D2F9503291D05E48FAFC891C08E7BDE220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 795bd2a9580e08dc61d6c7b7db5571c297bdba1ca9d749ef260671af0a0af96a
MD5 6974fcc44268064b82979fa2eb0c1582
SHA1 04f66188517cf3b7be3bf87407e7cf720eb93ffb
SHA512 443b329e7a95f8b990a52844b9be0c8bffda0df8cc08684fed8344a99ae510f1557b0e15d688e2b03466a54ea47a41c341d3b7513dedf8222c605e04ef94fb59
TLSH
T18CE026F47BC8CA2EB388688B017CA38C83C0365B9AC0ED0F3700C5C87807640AB827E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d741cee00e1fd171a5e769371cd9e22bfebb55cedb1548aecfe738953a5903a8
MD5 20afe057da20ade5a9f3f6390c700411
SHA1 a30d800133e9187b0b277c5d33afcc5a2d1615d4
SHA512 b5575906e85123457da76fade84bf0f009ed881a11288debbc23b597b5afe375a53efd255f4202246017c6304deb262150e5cffd2e5078135a52afe45a3f74d0
TLSH
T15CE0DFEC26CAC32FB2A8A447017C530CC2C03A5F92C46D0B1700C68E7407140B7E6AF0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 47c8afa1217a9944a1b0ac76380708c1014f287dd80e4dd986cbbb0a53213944
MD5 c6374868bf39c84edb9aa42ff28d9b61
SHA1 63d4e10ca881d2b0a363175a904940241504f8fc
SHA512 351128910bc45f5ab9ad30a8abddbd08e00d5afc9565d448271ac252c485ac17b81967548b134af1f7b3228285e154d1a2e3bd1caa9d051b235f1ca09d871ee6
TLSH
T18EE026E826C8C32EB648648791FC734D93D0369A96C0AF1F3704CA8974066C0A7C2FE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6cd9842888678b1a9c522d5b5023f817b7537f2be14d75f3e45959e022c886bc
MD5 1bd30ece17fa919eb028f7d18496b2f3
SHA1 4b4b89879e83c1ce875a388b653d3663dda9247e
SHA512 58d43b42315463385249f7865a7c63737b64927b51c8dba5f89fcf4835a5b2f8573c8355aae6932fca341e225ed0da9a0f236cb53be35f1eb121a43812c1fe38
TLSH
T1DEE0DFE426C8C22EA2887487127C630C83EA365F92E06D5E2704C98C7806A50B7836A0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 36KB
SHA256 a931e259101cd858117abd851fa2f6d85b848324e71ed326d9588d22daf84d89
MD5 5938c2e8647f4e3a8f3ce1fc4264ff30
SHA1 6b07c95fe2460eab2a02d33e56e2c72ab7a5c9de
SHA512 7de4a8d7101a4bc6116730ac85a2a165f2e3c389b908547449e15fcdb0285f82a430da6001b2f7aca9fbe82ab9f301788ec1bf530c7e4f686ef6a4a34395ad63
SSDEEP 768:AGUaTfXsozUOHK+o7dmiQ5IVuXZC3J6C/F0LxKdjtoBgBFH8lgZ:AGUaT7Uqe7dAOVuZmVOxGjtoGBFZ
TLSH
T1D1F2F217E4442AC25C189B29D9B4FBABB695A37A198B7B0D505D383D5CCF08E08C93E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 174KB
SHA256 240b53bc00ea9eb066b67c2faa464f2c9b3792031e6dd9c4522ed5df4e6968c2
MD5 a0ca701a64a676598b93dee411d01bc4
SHA1 a77e9731886bc9911128f97cde5df24f55aee595
SHA512 dc5bce0eb88826e73f5280fc50714fdfd365dbfbb6d0227e0c850a70d79ac9f88012b292d0c073aa3d6672951800204a6cedbef6dd93a59fa9c16fc2ec320ff3
SSDEEP 3072:PzoyhUU5L2z60LWMG0xGXOVR0F76X2TpsXcItNuYMrHXXQzFo+l+cx3aEti2LBu6:PkcxS6NDIGXPTpCnN1gHQzFo4vIIT
TLSH
T11404121CD8C7003E696E2497C656F5B142A7F79F8E0A9F78153BFAE2044FC86A14B4C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 37KB
SHA256 06b16db7a969135d48d38c49183be7fb88d4452e2a3011957c7851941f4e4879
MD5 311d352d93230ece04b34eaa8ad10d08
SHA1 a5ec54920b589ebe2af3bc3bb7754a476db68abf
SHA512 c6958d434bd827914bdd132b294209f48d84c4f91aa09ac6476fcaf9ab1cb5e70da6721c9ae2cfe350fa8288fab2ac10208e4a7d2c385a746768048bac0a631a
SSDEEP 768:J1K3v4RM1yf6cH/Ca4EOAFVnQZ1haUKUKAJmosEc6wcTwL/bjf:m3gq1yf6XOQZP1GEcaTwjbT
TLSH
T11B03F1B385431CA543842F3397CF967CC978FA55AB843B885823ECCC14AA6ADCDC0764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 44KB
SHA256 34a6a0b4c6521f99ec398ce7663437ea2cbb0d86b4d1322f65ae2b45a53007b2
MD5 f069cb36af3b6c360161ec41ba4e24ba
SHA1 98c3aba0d33b9daeeda530528c6d8a2debcc1067
SHA512 0ea2853fe3ff003193dd3aac8d7e895b91513dbe13e126a540462207ac18c215eb753ed77eded3a948ab5f0adac084270bccce77abf77ff99d5a375a5f607043
SSDEEP 768:DkwV7Apz1QrSXVvr4Qc/8Dc08rHPTynh06oYE7BsMlu1U/zWbw+FaBfTPr1feVrF:DHVsz1Q+Fvr439HPTgx5E7B41U7V+FKU
TLSH
T1F923021F23F52C97C23D1E603BF184E0BD64287CB49163E0A11B50196EB49C7EAB89BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 0de7de150ba1ce6c8a57ba8fad1a227b6e117988579a85c4a83b5850687b1e19
MD5 8649981cf4238c386270d33fa741b14a
SHA1 7ae4cdab97d196a851c2fefa40e82c6a3e05f776
SHA512 20286fdc7cc51c86b3addc3da43b58753e3424eb252c8b0b24efb41d99d48549b16f58020ab682bbc2a29177575937073b455f5e6fe75503f1f1cc8800b173d3
TLSH
T12C611B85ACB144D4FBC949F081FDD68F36FB4D9145832EA2FD97CAB87A32760524A44C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 336395cadba10df47cf1357fe10eea3adca270f1061d71afcbc6fced256e3172
MD5 960202c33c4448625e4ae31e0af6f823
SHA1 80fb4ce44132ea8841688399b70167188b070de2
SHA512 1ccaf3112e030dc592658cdd81ddccdc82c7d8f6a3138818ccd043524476d23a6f4402f50e83ba37c5f80e46b66a9856aa5ef0d87265ba46c929b68984f68616
SSDEEP 96:gM680zAjjcB2K3ydL2KmVy1LBn5oxU+kLpLF/V0Ha2d1navE7Ez:gzAn0yxvB5KU+kLlhV0HhdEMY
TLSH
T189C17372A8B540B4FBCE4DF041FCB98A35B7285114431E62F952CBB93E737E46E49648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9b28b00fe66c5e3679f129fcaf2f2693ce55590b3f4f733806a9f1e4997a4e94
MD5 082fa090069a3a54de1dd7ff007d8485
SHA1 d1308c2533f81dd2ec47fc3f9ce75fffe81f053e
SHA512 1aeb8b26598b581f524c29db6d6436766a7c572500d4019092ce4cc4f03dca2cd9c0a0db81f3262bacc8a1fe0cabd36342f9190cacacee2c8196912c112b0ac4
TLSH
T184510882EDB040D8FBCA41F081FDD08F36F74C8149832E92FC6BCAB85636764924A05C
MD5 SHA1 SHA512 TLSH

Submit Download

fe7fe085-f0fb-45ea-bd0d-440296306251.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\fe7fe085-f0fb-45ea-bd0d-440296306251.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

165d0d14-4899-4d95-adcf-3fa83fc78b71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\165d0d14-4899-4d95-adcf-3fa83fc78b71.tmp
Size 211B
SHA256 232561268f35b8113a92e030aaeb114444253682fdba38212a275eba083b368c
MD5 172adad8f57ab01ce1ce9b54e8a355b9
SHA1 32a53ae5e745c696a9620c91bda55ba6c3fe86cc
SHA512 457e3b7f3f60fd7a6475cf80c3e982091e640153a15bbdde95f811f93d0e6d4ff13ed60cf2dd0da738ab518ba691dede52883a259cee8ed9b3bf191bfb64acef
TLSH
T16AD0237363053076657C5DC6A179ECCFC72610555401DDE411D0649C0531A7C1B4B145
MD5 SHA1 SHA512 TLSH

Submit Download

33190f7a-45f4-499b-b360-e7a0c2833e33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\33190f7a-45f4-499b-b360-e7a0c2833e33.tmp
Size 7KB
SHA256 040230a9e64e5a56218f8805e019dc8b851fd54f2a24b9f817f682b913eab7a3
MD5 de612b4b9c138c17f15e8168aae437b1
SHA1 ed7b720476bf9774a83206e92f035eafe0a07e14
SHA512 47f3bb4fcd9fe928e98c182026451f529594af415259eeb9943101ff1c562544a802fb4b25d629392e1ea08e88454256b0f3740e4e15fee4189d3c075ed0c1ab
SSDEEP 192:D8RxZJYJXnOrwLJpW1jIbD9PiFAIGKH43Pi62qecPKd2WgPBfPntg1T:D8RxHEXnOrwLJpW1jIbD9PiFAIGKH43o
TLSH
T16FF17DF7C3E4862DE82152F1AB246E1ACE5D1528431C3D29C9E5EF5BB3E2471E24168F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3bd947a5-90a4-4ed5-8b6a-1e4c33c03fa7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3bd947a5-90a4-4ed5-8b6a-1e4c33c03fa7.tmp
Size 13KB
SHA256 6e09225c085dcb08c643aee90a9a75f797045b465795f878ddd6c7801f17b2fb
MD5 397ced7776aaa4541be6490d5cdedc16
SHA1 59da5a32526c08a6f959429e2ef34360c768ab0b
SHA512 dbbfc51861dfd8ba68bf778f1eb435bec0d34f3ae1eedaee22628ac7490dd348da9da99cddb55c7669354d53b8632886a70eb569f518e6183530db00d2f993f5
SSDEEP 384:D8RxHEXnOrwLJpJErh4MW59Y1jIbD9PiFAIGKS3q6xecCd2WgJfPthSP3z9rkcon:X73p9Jlpj
TLSH
T15052AEF7C3E5866DD81156F1AA246E1BCE1D0928431C3D29C8E5EF4BB3E2471E241A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58c0746e-f744-4caf-9074-0f8b9208f953.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\58c0746e-f744-4caf-9074-0f8b9208f953.tmp
Size 11KB
SHA256 5a5c0df25e206b65c4ff89b64bf2ebc5359018fd84c5fab34055144acd2bd284
MD5 96a5cf9470805ef27e10eb3075ba988d
SHA1 405b208e80a753b90f760c7d3b74d0cefee49682
SHA512 dcbe950eaee3074e2ee629d734c90405956e51ee845c650775b4d167c25cc5b0d6ab85795fd447bc44b3f6aa81a5c4646eabd365d0e35376f3a9d8c5911db525
SSDEEP 192:DWK+6JPJoY5cAUJlJErh4MW59j1jIbD9qfFNIGKS3PiS2qncPKd4HgPisnqhkP/n:DWK+SxoY5cAUJlJErh4MW59j1jIbD9qL
TLSH
T193328BF787F5866DD81152F0AA24AE1BCE5D1524431C3D3AC9E4EE47A3E2072E241B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b2c32378-7eb1-4117-99a9-ccf270d8f0f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b2c32378-7eb1-4117-99a9-ccf270d8f0f7.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a60c89dd-a9bd-433f-9c23-29d773ebf173\index-dir\temp-index
Size 360B
SHA256 1b16a3f69e0d61cde586f2fb2c7a478b6335f6affcbfd6d94761077293cecff2
MD5 ed15e280e0e729ee810201f6664f4412
SHA1 248b271e930da8c915ca47416761c8fe9c01cf00
SHA512 4dc30232c4a400eaa00dfe7379e72350e5ee5e3468391513849a3800d3619c5460a7273fbf16caf9ed00c739ec27264587589de8b956ccf2adff47a6d0379bcf
TLSH
T128E02B991D23524BFC554171743EA171573124FC5324160F74FDE45A8C4A384BE47728
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a60c89dd-a9bd-433f-9c23-29d773ebf173\index-dir\the-real-index
Size 360B
SHA256 d7c2e58e9694d50a21b9a217e1fabcb121b134db581d10fe5387d813e7834a56
MD5 268346a24eeea05a9e5eb5f8da60f05d
SHA1 b849a91c4117d155c3703718d118f094bfaa45b1
SHA512 68c1de13104ff50153237769f982b23616648bc943ae9a016ffa02a313c8bc587c728c28a4786a5c826738bab9e56069aeba9122289c65f9684841185e51e9b5
TLSH
T132E0955906138186F8184031787E71716272641CD330170F71EF8056CC87F445E02F24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 8c96b616e2559431bd9788815d502a0246bab7a667ef6bbffc4baa79a00ff302
MD5 8f13cf1133ee0bab466e4e3b70490955
SHA1 73aab27afde26c68dc1c5cf9aced209e3c811cf9
SHA512 e0d9d8cc4b2418937ab363ad65a67b193b5a9ca244805a1b8b704e34ba468bfa31f12ef0c90eb720c14b892347dcd58e5cae14115e2a23082b5e279a0a4e232e
TLSH
T1DDE068BB2DF65820EC9B83D6243215D400027C58980CAC9EA016A287007122924AAC63
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a98bf70da7a31d3fc25d269793ab85a88774e437d4ffa10db192e8e9f77b6a18
MD5 23ccee253878c741fc0cb1af47853acb
SHA1 7d76deea4573e267afd68a0fa455de0ed9f688ba
SHA512 5738800d0602bce536599c1ed2d4d3dff917041d675ab7c34c97941d7d412b556f621a7f0573170d04b64cad5207205da99320f6e1e2dbf1d19f4fc5ad22ce9d
SSDEEP 48:K0HqTnpJZybRcBIS3yK931dyx3iYUFn7yL5IVpz3Lkb10JF3jXYbLuLISdYK991R:KU0wKBeiiZCoKP626qoKHqQz
TLSH
T180A1E205307B02813CBE294A85B58B1A524335F33018E62BBFBD54D25D6FE055EFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae5c2ad7-771c-441e-86c0-4ed03d61857c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae5c2ad7-771c-441e-86c0-4ed03d61857c.tmp
Size 11KB
SHA256 1cc65e4417187e7b1b6b596f9212aee65094f43915e5003140852de93259a3ce
MD5 c2ebcc3b0df3931a11e2d42bdadfcf7e
SHA1 99ed8bd46ec7bb7aeb5cbc4a0cbed67b3853177a
SHA512 ea8621df9fd11e1fc114fe4fa7f15ab4537190303494d3797c364b83ebe4deddc8c0b5ab725668d7bf5d363e9a5beab94663738d9e0a6ea018e9c99e4c49c9c7
SSDEEP 192:sxZIRjnZ/fesmkBIdpCcuwbyb6HW6+WN1vNiBW/Yappo3Ig5MJ:sxZIBZ/fesmV6SHbZ/YK
TLSH
T1EF42CA626A3459FB8CD7D21DB655BB63D2F5503291D01E48E7FC891C08E7BDE120390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc7c2200-cae6-4289-94d0-669f8a24fdbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc7c2200-cae6-4289-94d0-669f8a24fdbe.tmp
Size 27KB
SHA256 bc1847ac0ad45a60fd648ebad5652176b8a030e6003905751226ba93c2bfa0dc
MD5 4617faca94965a7242fa8d1ac67ac6bf
SHA1 1bff8663214cafdc02d66c2477f2872a6f2f8976
SHA512 61f62f1a0d3684418c88ce067fa7f1d063ae9616914b2f8a36ee4ebd79320d4052e1fd81f44a6e333983b408920bf59ace930a1ecfb68f7afd0d6cb39037be7a
SSDEEP 768:QIWPcLKWvKece8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy75ro4cSVmR+:QIWPcLKWvKeceu1jaClLiF7y4cSVmR+
TLSH
T1DEC2FB3F640CCB7E5FC01A9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9d6c76e-02c8-4183-a0f5-7caeb973167a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c9d6c76e-02c8-4183-a0f5-7caeb973167a.tmp
Size 11KB
SHA256 8ef325a6661be7e22992e8e842c636bb039dbc2d3952edac8cea230cbbc868a5
MD5 8be82c9cb6811c3d0d5f747aa53baa1e
SHA1 314816fe48de82540e3437806afdea978eff6d64
SHA512 5beb562fe59eee877b3af2ee0437353a722d7ef41dc135ad2937185a95aa60b71b61b6d93cfeb2fedfdcbdf90577e0c13f2c7579c2841c2a191cc211c790a3a0
SSDEEP 192:sxZIRjnZ/feswkBIdpQcuwbyb6HW6+WN1vNiBW/Yap/o3Ig5mJ:sxZIBZ/feswVYSHbZ/Ww
TLSH
T1D532CA626E3459BB8CD7D21DBA55BB53D2F9503291D05E48F6FC891C08E7BDE220390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dff8fc8b-b549-4741-b672-6f56fc613145.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dff8fc8b-b549-4741-b672-6f56fc613145.tmp
Size 11KB
SHA256 244de2dbfb68d7c458808cd7a8f158d070dee2b63c6aaeb5cbadd3456206866f
MD5 947158544caf60b8968b57c31972acbc
SHA1 9d8189e3892f7d0419a03ee9b41909dd37ecfcb5
SHA512 f9f909480ef3d18222125400bb283da6ce859646f0d2aa0a53c4f955ce5ea7e907a5a5caffc3f8ead41ffc7634682128d858d84747852c258a6e4c9431c829d2
SSDEEP 192:sxZIRjnZ/fesmkBIdpQcuwbyb6HW6+WN1vNiBW/YapSo3Ig5MJ:sxZIBZ/fesmVYSHbZ/tK
TLSH
T19332C9626A3459FB8CD7D21DB655BB53E2F9503291D04E48E7FC8A1C09E7BDE220390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34b384b6-244f-4180-9c3e-c79477aa0c57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\34b384b6-244f-4180-9c3e-c79477aa0c57.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e15a130ac8455da330c8f8233525f2a0877c0a40ab3d513887dffe11380b72aa
MD5 a2ebb987c3ea2f8af9dcc0b4e6110e96
SHA1 a7db9ecfc84983b6739df5bb25b22ade0281b3e5
SHA512 05ad6d533b91b043e88a1c7cd8201a93b7565d8a005ef2b8c26dc5004594d7ac87e85e7794406910b6550d0affb96747e23919877777162f212d28018950e2be
TLSH
T11CE002C2D20001BFC06D033000D31F213DB2456413D701540B300A7C2C357003A31E90
MD5 SHA1 SHA512 TLSH

Submit Download

a3597d61-6864-4755-bd1f-602e4dd9fda3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a3597d61-6864-4755-bd1f-602e4dd9fda3.tmp
Size 392B
SHA256 1e9c96a10ca89d36a87d6439ea9c086b5b2b507d633f3a4a07ef96ca2b42cbbe
MD5 1c4ee1c2384a14da10f3277e2dfaa07d
SHA1 27fd0fd2e51c264c2d4c419f48b8789ce190d52b
SHA512 db3228bde5ed1e723bf8796b35c0aa872d0c760e20a0a9c8951699f0de8a0e8d719becb65e3ea53bcef210d740fec7644f3034df1e879abaf5d6b7e7a918f9af
TLSH
T1B4E00182D30002BBC06D433004D32F212DB295A413D741250B300A7C3D357087A21E91
MD5 SHA1 SHA512 TLSH

Submit Download

b372cb50-6fd3-4fd1-a160-bbca64545c16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b372cb50-6fd3-4fd1-a160-bbca64545c16.tmp
Size 26KB
SHA256 b5ccbe27d337352c6435cd63d0c35e568494fc0ecab26c3ade879370e3f84755
MD5 21169699e5ffd19ae66a6e015ed4f2d2
SHA1 8274b82deb999210ee367fd0f6d7b6c34d1285f3
SHA512 8257e901dff42010efcbb74e1d79c8922bef687104b7fc6fd2b1a9418f122f3de90f0ef6eea53a61f6afc594b19b65f2b3c65b44d89b4015fd1f1931f58cf54f
SSDEEP 384:CiFPZcIvLsND8TUNTUlIlRFY4iPU1Q6KAg2zIGmQ2msMFJirtgOIwZOyWgo4:JFHTewglYoXgAT2x8JirXs4X
TLSH
T13BC22AF388E788B6D9AE5747A77D2D138D7CC157B280AA90B3C8560CCC961BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3f18b3d-f6c6-4146-b75f-5c6e7572a6ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b3f18b3d-f6c6-4146-b75f-5c6e7572a6ce.tmp
Size 26KB
SHA256 4d65c010b6f9bb2adae8763c63a49ffd8ebabf40ece33d4812bfbda07fbae598
MD5 9ed6ec9bcef2b88901830ca8b8722c63
SHA1 a26a248517234111044a8c23b6d67e5e3d54e3e4
SHA512 dd8ac06e25501dc82fe349307fa74a02f7473a60b30504a83b7260a1046398b918dd109e8be64a55f49d361ce41c8deadb6306315bccd63659433090b8cc4645
SSDEEP 384:CiF/ZcIvosN98TUNTUlIRROY4iPU1Q3KVLzIGmQ2msMxirtgOIwZOyWgo4:JFXQUwgiYoTfT2x8irXs4X
TLSH
T1C2C22AF288E788B6E9AE9747A77D2D034D7CC117B6C4AA90B3D8550CCC961BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0c8e6c7-5cd3-4c25-a829-3aa6d6b4c07b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c0c8e6c7-5cd3-4c25-a829-3aa6d6b4c07b.tmp
Size 26KB
SHA256 4efe454c7b121746bcd78e8157a6fca83460c40a5b8a4e440dc65f086686d4a7
MD5 6c1dbf86d303c307952d96ceccd5262d
SHA1 0be7a5c3f185b3522f7b75d4428faffcfbcc823f
SHA512 db256a3bda6645795979b70407cf7ce08e58f4d3586ba7c78abb285753f9b2952c9b0d36852e70cd973c7f1ba65f1fb30d13510fb1f47cb44becad264fefa623
SSDEEP 384:CiFBZcIvEsNo8TUNTUlIlRFY4iPU1Q/KVLzIGmQ2msMUirtgOIwZOyWgo4:JFJs7wglYo7fT2xZirXs4X
TLSH
T1AAC22AF288E788B6D9AE9747A77D2D138D7CC157B684A690B3C8560CCC961BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca95ec7c-ef54-41a1-b2fa-4187099c9ad5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ca95ec7c-ef54-41a1-b2fa-4187099c9ad5.tmp
Size 8KB
SHA256 42f5707a3ae182f5c09c225c5d9c2b34b212b9307552289eccc40e86d4b8950a
MD5 bfc0a91bca6b2aff330a884c96decc49
SHA1 6e60beef98f52ed03f277a4d6bea2846201e2fe8
SHA512 0c332795a281d6e208c47ae050403580a862ecde3ab1e106ed3a277e3cb5bd8a4c022d0e6ddaac9096e103998022834744e7e51970b85bbb2495c7480cecbc1a
SSDEEP 192:aONE6IE3QmiUyMqsT9uIGmQ2msMB27HJqulU6:aONE6DZXH9uIGmQ2msMuHrU6
TLSH
T156120B36AC78ACA75EE3A944F4833A235DA58227E7C57F90D5DC2B1C00EF25C5307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7dc8b52-79ca-4708-bbeb-d772f047151b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e7dc8b52-79ca-4708-bbeb-d772f047151b.tmp
Size 18KB
SHA256 df53f37e91105abe0fb2091a21c620aaa1845006d6eb0f12a571ab94c4f49542
MD5 5ad1a149b4bf767150b5f717b792ce2d
SHA1 b6b0716b6b4ba183fcc134c7a0b743f7cb7c0c5d
SHA512 719c0c12137099b7141a5e84d85e76ac490082af253dc24e8abb90fcf6c7387a41065912b3c0bfef40960b79dc7ce8f5c09286891b05a8a9a7212fd09e785f14
SSDEEP 384:WZcI9sNxRFY4iPU1Q6Klg2zIGmQ2msMairtgOIwZOyWgo4:E9+YomgAT2xzirXs4X
TLSH
T111827D739CB89CB76DE7A144F58636139EB48127A3C5AF84C4ED5B1C00DB2A9130BE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebf85419-f932-4b4c-9a2a-85653a986d7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ebf85419-f932-4b4c-9a2a-85653a986d7f.tmp
Size 8KB
SHA256 67be6e3444ae6f69ca71efe3223f6b91006a9f58ddb35e521fd6253060e34e36
MD5 ce574d097cf467dc0fb88ba0d62643c8
SHA1 2d780405ef5060c297ba836c42a36d956839ec07
SHA512 b5b0d80065c675c7cdc14c86dcc0a352747e5b5974fee07bac4078f69213546d33b0e83ba65880918a4445c8588784a78c4595285bfb9720eaf128114a8e2502
SSDEEP 96:3qONk2Qsjpfe/tyng7X5ih/cIPURHl8h4otop5wYDsNBnP9ZvEI0IG2jbb0DqssR:aONe6IE7QmiUyhsTPuIGmQ2mdC7ss1U6
TLSH
T15002E939ACBC7CA7DFF3AD48F5872B235EA5112BA6952F84D9D81A1D00DB25C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f8cdd84-7281-4e25-84ef-fc4b0a83a278.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8f8cdd84-7281-4e25-84ef-fc4b0a83a278.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1a0e7c93022241a99fa535fe22a4989c165efe10de820776ce435ecabd9806bf
MD5 7475b64423340f7078a5de928b26ec12
SHA1 b7bbef793508bb1899053c019baedd860ac72a86
SHA512 2f056792ecc9ae97c56b18f838cb1f1eace61a4fac2496392c254e5ec44f0153dac4db0767f3e34ba01dd67be38135350827c2bc4797654c500eab1e116d8727
TLSH
T1F641299CB6F91149B3B76F156BF2A86E487F7C732E06D45E00110D4F0A66B40D961737
MD5 SHA1 SHA512 TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nss542E.tmp\LangDLL.dll
Size 5KB
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
TLSH
T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nss542E.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

078dbc8e-6e64-46de-947d-220db1d90444.tmp

Path C:\Users\Admin\Downloads\078dbc8e-6e64-46de-947d-220db1d90444.tmp
Size 7KB
SHA256 2fbe2a96f9b7835d50917fa0a4340ec4c159bf81bdb7c52d7dec2f511787d42b
MD5 20311c875850160a17fa3bb8ace6728a
SHA1 b6d143378f7944f42eb3a6045e99719a013c0337
SHA512 e1d7fe65f3ff4d1e409aa22390897368e45f286cb5152dc8f77e9f1bd169a9a7efb0a43b28a25595e0542dff8c709de14d63f69b7139dc89d56449d0a3010d30
SSDEEP 96:UmXSPgjhZ/K5eJtM4csF7xqTjubiZNYQSgNHLiOa2KNylq/SAu7aCSDUO319thUI:5XWgjhZSMTrcsd6ZNYTgNHuOpY6v7amI
TLSH
T15DF12B35B166D963DC230771173F92757BA2C6120BE2B4935B302EAC7E63B51E50EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

105c4d1c-c67a-477b-934f-56553054cbb8.tmp

Path C:\Users\Admin\Downloads\105c4d1c-c67a-477b-934f-56553054cbb8.tmp
Size 15KB
SHA256 10fa002c927189567e54bb2bbe9ce5a80318452672a776dfe3d4dd8df781f442
MD5 44e4a044ed04df790873675979bcf540
SHA1 05a6282d8f6a64dffe6764a8923cb18d1ce43860
SHA512 ed73ed6db968aec77fd5254a3ce70eb6a9f91ac03ce7c402c245e123ee06c5f28becd0f2d39c594d446fad44c30671b010fe86f30e2f473395ff32357cba4971
SSDEEP 384:DI+r7y+XJOHys3UMPr2lEEa6aTChEnK5gchAZ+z2HXqD16:DTXZJh0UEnKac6r66
TLSH
T12862E13AE4A76312D0E2607B67A0C1950DF7ED68CB35A787F23001F4DF126E268891E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

processlassosetup64.exe

Path C:\Users\Admin\Downloads\processlassosetup64.exe
Size 2.9MB
SHA256 0af9d4727e151ba3ac0cefeaf2cdefe498907eabc1b9623dba0f5dc1f254750a
MD5 0d4dbc5af2af0d573a79aa8b0a866cba
SHA1 5a1914fd9a036328f50632ae5b75b282fd356c60
SHA512 1e884fd08976ede32c9c2f08b219ef1d22c2884f9efdfaad3b61aeefc95732bdd0fc2d517aa1887b5817efe26c7ee51d97988ef7a53696f39f0bf92c4b966abf
SSDEEP 49152:z6zgcqQD3PMNCuzc+x/KaX9piEOXcfyagmwIg1Wen3VrhKQRW6uz/TgAudR0+eGh:zyg3mg/c+xCsVKmw3WenphKQRW1radRt
TLSH
T154D501D10ABACDACD051CEBC8AC5CCC9A1CF9E0C953E36365678341C5FBCB9AA594C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 cd815f9c63ecf7258b6e9b836aee4dcbd9e5089daaf0647162f9d6b9c854984a
MD5 b3f2c2b5cdbabdb64138329f9099282b
SHA1 1493199d87320e976f46d97178ac2aa2c3beabab
SHA512 fd37f84e666f2dc16c469bde0f1f0b721f1958e4d815b80ccf05f90689945d70882254544277a354c23ef2329768fd90dbb05b78a799514485705447fdcfe89e
TLSH
T1B121BB260689916D26B341E5091CB82FA31FD0EF0E2B8D8D3E8E450F7BA2A1C5366646
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6080-331-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/6080-289-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/6080-272-0x0000000000400000-0x0000000000592000-memory.dmp

Download