hxxps://mega[.]nz/file/xBsTwLgK#JH3UKNgVt23Gsv2ZmsXY4B3h3erJnOHYtL_jaq3evX8

Analysis

user interaction
yes
max time kernel
98s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/08/2026, 07:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/xBsTwLgK#JH3UKNgVt23Gsv2ZmsXY4B3h3erJnOHYtL_jaq3evX8
Sample260815-jhttbsgp4z

Score

7^/10

defense_evasion discovery pyinstaller

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2744	GPI MOE LESTER.exe
1692	GPI MOE LESTER.exe

Loads dropped DLL 8 IoCs

pid	Process
1692	GPI MOE LESTER.exe
1692	GPI MOE LESTER.exe
1692	GPI MOE LESTER.exe
1692	GPI MOE LESTER.exe
1692	GPI MOE LESTER.exe
1692	GPI MOE LESTER.exe
1692	GPI MOE LESTER.exe
1692	GPI MOE LESTER.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\GPI MOE LESTER.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0005000000000435-394.dat	pyinstaller

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1652	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312532501422983"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{709EB506-1D1B-4806-A3BC-5BAE6574A852}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\GPI MOE LESTER.exe:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 4228	1212	msedge.exe	80
PID 1212 wrote to memory of 464	1212	msedge.exe	81
PID 1212 wrote to memory of 1652	1212	msedge.exe	82
PID 1212 wrote to memory of 464	1212	msedge.exe	81
PID 1212 wrote to memory of 464	1212	msedge.exe	81
PID 1212 wrote to memory of 3616	1212	msedge.exe	83
PID 1212 wrote to memory of 3616	1212	msedge.exe	83
PID 1212 wrote to memory of 2608	1212	msedge.exe	85
PID 1212 wrote to memory of 2608	1212	msedge.exe	85
PID 1212 wrote to memory of 2608	1212	msedge.exe	85
PID 1212 wrote to memory of 3436	1212	msedge.exe	86
PID 1212 wrote to memory of 3436	1212	msedge.exe	86
PID 1212 wrote to memory of 3436	1212	msedge.exe	86
PID 1212 wrote to memory of 2492	1212	msedge.exe	87
PID 1212 wrote to memory of 4744	1212	msedge.exe	88
PID 1212 wrote to memory of 4088	1212	msedge.exe	89
PID 1212 wrote to memory of 2492	1212	msedge.exe	87
PID 1212 wrote to memory of 2492	1212	msedge.exe	87
PID 1212 wrote to memory of 4744	1212	msedge.exe	88
PID 1212 wrote to memory of 4744	1212	msedge.exe	88
PID 1212 wrote to memory of 4088	1212	msedge.exe	89
PID 1212 wrote to memory of 4088	1212	msedge.exe	89
PID 1212 wrote to memory of 3180	1212	msedge.exe	90
PID 1212 wrote to memory of 3180	1212	msedge.exe	90
PID 1212 wrote to memory of 3180	1212	msedge.exe	90
PID 1212 wrote to memory of 5028	1212	msedge.exe	93
PID 1212 wrote to memory of 396	1212	msedge.exe	94
PID 1212 wrote to memory of 5028	1212	msedge.exe	93
PID 1212 wrote to memory of 396	1212	msedge.exe	94
PID 1212 wrote to memory of 4504	1212	msedge.exe	96
PID 1212 wrote to memory of 5096	1212	msedge.exe	97
PID 5096 wrote to memory of 716	5096	msedge.exe	98
PID 1212 wrote to memory of 228	1212	msedge.exe	99
PID 1212 wrote to memory of 228	1212	msedge.exe	99
PID 1212 wrote to memory of 3364	1212	msedge.exe	100
PID 1212 wrote to memory of 3364	1212	msedge.exe	100
PID 1212 wrote to memory of 1692	1212	msedge.exe	101
PID 1212 wrote to memory of 5048	1212	msedge.exe	102
PID 1212 wrote to memory of 2872	1212	msedge.exe	103
PID 1212 wrote to memory of 3848	1212	msedge.exe	104
PID 1212 wrote to memory of 3848	1212	msedge.exe	104
PID 1212 wrote to memory of 3420	1212	msedge.exe	106
PID 1212 wrote to memory of 2560	1212	msedge.exe	107
PID 1212 wrote to memory of 3420	1212	msedge.exe	106
PID 1212 wrote to memory of 2560	1212	msedge.exe	107
PID 1212 wrote to memory of 2560	1212	msedge.exe	107
PID 1212 wrote to memory of 388	1212	msedge.exe	108
PID 1212 wrote to memory of 2744	1212	msedge.exe	109
PID 2744 wrote to memory of 1692	2744	GPI MOE LESTER.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/xBsTwLgK#JH3UKNgVt23Gsv2ZmsXY4B3h3erJnOHYtL_jaq3evX8
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ffa9184c188,0x7ffa9184c194,0x7ffa9184c1a0
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,14220970566612934709,15904664210503025697,262144 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,12814351621553155142,2604010936621431960,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,17708179510840814502,1957799456580558826,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:13
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,9295729629567542555,17362746264780478401,2097152 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,6839186343833176375,5793879385656141464,2097152 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,9232589142547221163,15272024039404134526,2097152 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,2499415251220981904,12678627616001170989,2097152 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:9
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4272,i,5308778595929208656,14454517739208384727,2097152 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4316,i,6962897867859408171,1983987058752364234,2097152 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:9
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,18315016456352283642,12799639111435317434,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:14
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,8543273410996429461,16989540521324893030,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,962072388116670324,12987994014781451158,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,962072388116670324,12987994014781451158,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,5955506704023090785,17352534029693468842,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,8785901537980484251,13889986082210985301,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,6402624517326737748,14186398158788295939,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:12
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,17814088791535999743,7715722559257264494,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,14069942334730953754,15693854069675319279,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,14511407209706708882,4868029451056617067,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,14195130425158985603,16123104614366905502,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,6758158385357626757,1213140346229066082,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6904,i,4876589148023567551,888871811019283812,2097152 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,2882687749304724458,3594853493359151139,524288 --field-trial-handle=2188,i,13306515121034505467,16117419065339551912,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:388
- C:\Users\Admin\Downloads\GPI MOE LESTER.exe
  "C:\Users\Admin\Downloads\GPI MOE LESTER.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\Downloads\GPI MOE LESTER.exe
    "C:\Users\Admin\Downloads\GPI MOE LESTER.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

235b6009-1938-4e23-9609-0951f640a26d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\235b6009-1938-4e23-9609-0951f640a26d.tmp
Size 22KB
SHA256 ac027772e92aa7c1220e00f05407bd39040359940b2372ffd2ecbec183273481
MD5 1b1b52489f1a8f0baa54f426eeadb98f
SHA1 9cbbc39a1f867962e323cb2c6aa788cb7af3f6fb
SHA512 17f65797bebb57ee269878847d388ce3c4abfb42b39de863aea1ac0954dad2faf765f65606b21bc5ad127591c89f4edf0185a7c2c3fc6f29eca37437a4c5a39c
SSDEEP 384:BiFiZcI48Nx8TUNTUlIlmHoI4SUu8YPMrOOPrXLpe8C/Ktr:oFQ4swg2w7CErOi9Pftr
TLSH
T182B27E729CA8A86BBDB7AA84F98632039FF45063E5856F54E7DCAF0C01D719C130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 78c995b83ed0e6d3b5467e07a3b8932fab72db47ce193ad24acc5f973de6e01e
MD5 e195d384d884590b689a66388b708f9c
SHA1 313896873a7640de254e9b9fedb1762bf958ce7d
SHA512 8df8ec7e1a19b060e18e80d91d29fdf618a02139d31085a6b6049e547f500ca2a16ea3e4cbd9099747227490d772a1f68e3848d9cf0a6a6c4fd3ff924a159102
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
TLSH
T143B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

67de3d6f-ec76-48f5-9e3a-d54aa12bf608.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67de3d6f-ec76-48f5-9e3a-d54aa12bf608.tmp
Size 31KB
SHA256 17b54ddf2fbae5fd35cce78d5f0b32c2638c1b220a7aba95160cfa74ca92d890
MD5 c8095d0e6f528ee7d602f97e48f72f3a
SHA1 e495f24436958e9684c843d67e5773e361f79eaa
SHA512 d79b489e1f1dbf10d75ba2420c001d949a81a2a282c03b5f07072fc3cd3fc07c32daf3a7f34d8fbb1be937b9ff2095f6ab1637332b720bfa534e82b8422ccc2a
SSDEEP 768:31c0s8Ww2YfWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0OhUroQU:31c0s8Ww2YfWRm/JQg1u1jaKBOLpTuOz
TLSH
T1B1E20A3B284CCB7E4F840E9CEC26AF966ED801CB66684D5447FE494C03C77EA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dd9dd3313e2c04b2fa1f34b94e6aa15ce8dffcf87bebaaf15147164c309c5b4b
MD5 d7cc7189600b1aa226032bb56f070bf6
SHA1 2c21608dd0aae0cac6d262ffd954183576e8b539
SHA512 0f9a438b08c9c929b57fd993664e5d75b426ce1cabcca3573b05c0d3627d2ced23c0349c3d2322d332def0853884ff3a535f45535c416452c60b197ce51e306f
TLSH
T1E871702E8735069FD7A015BB63D102CC3DFC56949B133E970AF8E97B1906762C992178
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5884bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5884bb.TMP
Size 3KB
SHA256 c6a79ec438c56f1e6104127e99cd95196ec72b51fdc85778284b17935f567031
MD5 bac8e7ffee4b7adafb5b4b824ded195c
SHA1 1b2562dbd9953d5791d2d917a07ef5a3370e8ba2
SHA512 fde1558d234f2110b89ea9c07c565deea495380121e2f95f19ab20bc27a410a577761dce62dba55706cee564c754f19cecaa4a21b42bdc181f47ae9130eb8345
TLSH
T173717F2E8735039FE3A054BB63D102CC3DFC5A959B133E970AFCE97B1906762C992168
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e1ad77235bd997c077e14760d21b17eb83fcf0484ce8f00eca9adb6b52b85719
MD5 003aec36bdb6abdd7cedc4dc00e59cf6
SHA1 4cae73e951fa2747636392e6a9dc1176bb70c0d1
SHA512 fb6f0fa62607485dbcc37016e01f5a6201b2e2f281ec72284d2af04048e38c9d095be62612c933539c66166f7cefb06bb9a5698e0877cae08727f3c932c4c52f
TLSH
T1D23199F783B185AEDA1156F0AA14AE2BCF5C011653AC385A8AD4AF1793B3471E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 23ea53d0ed6a2d4a02acc00609c3fd001d81d81f91053c658b669c40d3b90bf4
MD5 821268af542fb775a4b88308182fcba3
SHA1 05b2464c9b8b0a569e5ea26a4b6f1d59e4948969
SHA512 fee2ac1c7c191ab0a56fafe1a464ed41acf687ede6b419c18f2ee4c3aba436510ae1eaad57946872873f5d729efdc9ba4789375a685019b839612f1e89cc1244
SSDEEP 192:sxZARGyM/jK1Ml8MFH/fJsHzoIdpgs/W6+WNQTk/Y0o/wU8IgrJ:sxZAAdH/fJsHzZZ/bt/5/9
TLSH
T1EE52E6116A38A977CCCBD209FA45BF53D6F90573A2900E44A9FC9A1C04E6AED6207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 14e6a9a878db775d9c9811d9779fd3ab56906af3556f1f70eb8e63ea9180d2ef
MD5 4ab64743cc8093b9957203e435f8ed49
SHA1 484d97bfa7363c59710100cecb2dc56e7b4ecbf0
SHA512 fdecb3bd21d3e83c1a34d0294364302893eecbe07b04504963e30e719faa8da3aa0a2bffd73ac7edac75dbffcebae16d48ddb098584834c7276497db5c569022
SSDEEP 192:sxZARGyM/jK1Ml8MoH/fJsZwoIdpGs/W6+WNQ1KxY0onzb8Ig5gJ:sxZAAQH/fJsZwZr/bnx5L6
TLSH
T11952D8126A386977CCCBD20DB945BF53D6F90573A2904E44AAFCDA1C04E6BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 1487b6ca450d16c5ffc59d1e068018948f7d4c22e8bd7717792ec51bcfbdad10
MD5 213bfa64d07385272ea7dc0551f0c834
SHA1 2b1fb22c5bda0fd587ccdc41691db39e32ca2bf1
SHA512 d6a26ab104fe031fe6ca1954a7c7c04ac3d220cff256fadbe8505b1f25b1615a82c29c082e6405169d2744741aab3f157da465ad2f4091582cd5e268fb8e21d3
TLSH
T11BA002254D558561D00002F491B352852621C9600E59621140B80158CC54286825246D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cee4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cee4.TMP
Size 48B
SHA256 6bab4455a799c1b47a88c444b977c445249dd07060cc22acccb2fcc2364affac
MD5 0ff80f0200992a98e0c21aee1fb4fc6d
SHA1 75e62113baf95ea64a59a25b5c9df5fb7652b91c
SHA512 10bfcc5f98020e1a327397d99005b68e425912c8c5451592def636c16870679c5bfff43b98cc4f325ab1b9594e644e1b320fabcb0fbf04461969a99f9d1b431e
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9a7f478e4f6dce99d317cc6a7d6518157cb8b6a1910b4e6aee44626b9cb6fc9a
MD5 42e2941cbe225cf4db5b45d74bd3468f
SHA1 5072ada622fac3ac3cec6bd322d3aed62f5b5330
SHA512 d956041326176f83776b2f88eee68d8c41614d7d80f23728f1fa53772824d389d4bc968f006e782656e5c49d32fd6111ebb2d51f58748f94f2a6958b3e0fb710
SSDEEP 96:KcqYKrKCNITM4CO6MS+dXkgMK8Zk6Moo4dSTyrYE6wglFsZYvMlKHUvqlzSahsAC:enNITM4CO6h+dUg0Zk6Bo4dSTyrYE6wv
TLSH
T19591219236FA12113C7EB81C96959716164376B73058E87F3FA880A20F67E105EFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590882.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590882.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ea5535e6e0c6593d726071498b0a18f033ee990aa34ee0a54a609232651c1d48
MD5 568a8bcd03f38e24bbc8e02dec90d64f
SHA1 f0e18fee63c9b0570d126c1fc126dc309c48dd9a
SHA512 9e5afe06eeb9f5061bdc2c2a68a52c1f316bd3ee3fb576aaf6c7e5f4eca9d2788ce4ed849cb05d01fb88e6943b14069a7e4d7df1faa4f94dabc4f0e5e166fcfa
SSDEEP 384:xZcIh8NPPHol4SUu8YPsrOOPrXLpe8C/Ktr:Zhij7CUrOi9Pftr
TLSH
T115928DB1A8BC6C676DB7A585F98636035FB85023F6C52F4496ECBF0C01EA598130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 af52303a9e13781e2eb40bdb3929920bf3a91b1743302f8619ed1d5223dd8ee4
MD5 4227e79c2f00151975a8e5de510fa264
SHA1 aa96cebb7e3893e82571ea0398f997acb66faa20
SHA512 e09dcd6be020c7ac4c144cc993e5483eda89fed9cb2fe3ab8147c44ac122ff9d24b4f65b6a614a9b1336055200476e8746cf9336e1bda6a89d6006d3d4f4cda6
SSDEEP 384:TZcIh8NPmHol4SUu8YPsrOOPrXLpe8C/Ktr:Lhfj7CUrOi9Pftr
TLSH
T177928DB1ACBC6C676DB7E584F98636035FB85023F6C92F4496ECAF0D01DA568130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 efea2e0ff09c8df9b85ef84697bf5fcba745191d62263a0d5bb7632428bb5ef8
MD5 8503684d05edfa4d0d7d637e0149ab7a
SHA1 2deca750176af981c812285b054e75861f763439
SHA512 90c9c0d5fe3ddc3bb0db2b202ed6799cac36251f69f16e0272d9bd1db233fce9f513628318ff54dd2a0b9082b2205e622cf6040c3bfebee7a7cdd5f295112662
SSDEEP 192:XGNI6jCQmiUyaIlf4SufoPxzYVImYSnLkVgU6:XGNI6qFKfju8YVAaU6
TLSH
T19B02D975AC6C786BAEA3AE45F98736135FA4213BD9852F44CAF81F1C00D764C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 048385057696a34a6f4afcf8e48f4637f456f4d93c2e8cdee49143511ce8b36d
MD5 0134818ad309d061ebbb502452a4ee4e
SHA1 6ce43a54605201718c3bd9bc0908da806dca5f64
SHA512 bb90400901b455fb564e50d2e8e104cf7f83875a84f07c1d27446059a7e42b601e23ff270ea2cc35c20db252226345315580f528f2c8890cdae78b738baa56df
SSDEEP 192:lGN66j/QmiUyMlO4SufoPxzYVIm3SmYxWOMOqHU6:lGN669VOju8YPrrU6
TLSH
T156120971A8A8BC6B5DA3A594F58735135F741127EE8A3F44C6EC2F1C01EF69C630B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_bz2.pyd
Size 85KB
SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
MD5 207d4a4b7a113ef494514918f2dccdf3
SHA1 74b59453b5bb6194e0d2587d26d499d0f7e1aed5
SHA512 f7e5a2608ee19fd400d4bfe27e8603289a219af6a4a4a9e65ebb76c715d926fb9b08293fc2a3fed2195784804764265fa0b356547f23c501ec8ff9487c948b27
SSDEEP 1536:xtMtz7eksNCb6YVVEFxO2RqOyuzotWw8pRbIiQIG3VTy1Ni9QfIY6utw:PMtzSqurjOqqfgotWrplIiQIG3VtKtw
TLSH
T14A837E86B3B462B6F59B81B496910353F730FF960710A3BFB25482863F13B91AF58365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_ctypes.pyd
Size 139KB
SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
MD5 eeabc0c7756ed7a29e33e467c398737f
SHA1 ec5c401946a9df4e4ab764ddb4639e4e33e1ce40
SHA512 5e1e93545e1be34880fc680ca12004792076e88baa6cac4512fdbbdb90091a9ae441a16b8d24f64c6b03bf14903babddecfa783ce5c016759ed790c0eabc189b
SSDEEP 3072:G/n1qQ8/27N56EBZrGwrb1OzIJswKRW2r7rw8IGGPzoGc:wn1JDT6wrszIJfUDwtc
TLSH
T1A3D38F4B336841E6DA678138C6739E47FBB1F4511A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_decimal.pyd
Size 283KB
SHA256 8d41a84db20a9b985e98c802ad6833cf9625c744ad35478dd346f54f81488706
MD5 4bebc4da7d6319283a8c664bfc55408e
SHA1 4dc69a8105272711673afa5f712af982a18532e1
SHA512 411cd0ee4189654e836579efb4df509a02cba39cd9793e6d7250aa4e239449dafb6936ac57cb8ee7bd97cf2fb178beea17f658bf6ae7149ed8ed927a7c47bdf3
SSDEEP 6144:ASM9SUWXvOOiSx1u8llV6zeGqqM43fIWeA9O8O8OOT6MPgz/:ASM9SUWfQSx1ucapLIz/
TLSH
T1D5547C52A3490CA4EF7384388A479A57F7B2B8414360D78F47A48A972F933E3677E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_hashlib.pyd
Size 67KB
SHA256 36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2
MD5 dcf15b3e1858d9324be2c719e4e990c9
SHA1 8311c2fb0bb75342367a83fcca7161a0f7fadafb
SHA512 fa2783d0cbbba477a08bf4f2fa3df21d6d0bf5bd5bc7cef25254a3d29fc7d01229337ad5dd54c2f0e67b956fd43953aa98586240102511ddd48d04c674b7ff93
SSDEEP 1536:KXwAzOYBQca7JKs2+C5oIGDIUy1Ni97BfIkxd8:0J/yJKs2+IoIGDIm6o8
TLSH
T1EF635B8AA6984092DA2382B5C9E34F43F974F252271197DF6678C18E2F233C3573B756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_lzma.pyd
Size 157KB
SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
MD5 cada2b240b280f172aeb32a1666b21e6
SHA1 c15dc39329444433c255309eb89bae188aae1b22
SHA512 8b12298efd28549d46e2c48cff94b07039cf513bbac25063ebad8bae57b96e07eefd7df82229441af142c1b96dc837dec468263c0873d14da280e3ed6e42eb9e
SSDEEP 3072:BJ66g4T5QW7JfyjEqkSkA51b4pznfJ9mNopUpdbQIGI1HFk:BUR4Tp4QPZ8N4RxYOgbPa
TLSH
T110F34C86B794F0E6F7328C38D2624F57E6F578590320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_socket.pyd
Size 85KB
SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
MD5 7a16a21ad11d3e9829ca3b379a2bb010
SHA1 90707b5c1662a1e4553f1cc10ba96c7452def7c2
SHA512 5e0268af7dad1646903ddb5e61fb38896a7ae964cadb38b5c28bc1524a69a87b7c09f501f3f570ec6bf78c8fa873b8fbe062bbe06cf839e32a2735f1efd0cae1
SSDEEP 1536:hcVuncT0XH3XAJtZypxm7XP+66wSzC/jAjI/Lb6NsQ3cs8PgMr8IGGwby1Ni9DFo:SEny2+jypxm7XPz6wSzC/jAjQOsQssV2
TLSH
T19B835B01A66040FAEB77C176C2639E63FBB4B5C01294A75F1466C55A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_ssl.pyd
Size 186KB
SHA256 5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad
MD5 e4ba5a52f5fa2a64baec46486cbdcf82
SHA1 ff213b504a70d50871eb8432cea1b22563364cb4
SHA512 111c926a0157d46c48a26da30face546b065eb4afddb6dcf27442fd4f73432808de43978f78f5b297b22a63d82d0d5bf305701e137f6060f59cbd601012e61fa
SSDEEP 3072:FVpZeIk2MZ7IifVvQto7qrvYLrgp8VuMG4eJ9i1zktdsQ/3Omca45gMqTVBOrQII:Bxk2MZZVvQtmL4457qTVMrQ
TLSH
T1AD147B47B5446EF7D802E8BAC6234543FBB4F045331297DE48D6EA520F03746AE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\_zstd.pyd
Size 491KB
SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
MD5 035b0a033dd00dbe887556f4d4b852c3
SHA1 e86cf52d825f9b68177354c54edaa57e962012c3
SHA512 0b428aa10a9e977e07023918870368a9c00e0eb4ab4f7cf1e88950d4aebd2ba5774ebea9f3779d05e370bbe315da6634922834106077d511b710c6131d29dc65
SSDEEP 12288:KccWmYLKvveeFSeX0ro+Q2J5BCl9VNqdp:KccWJKvveeFSeX0roMZdp
TLSH
T143B48D43F29943EDE53BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\base_library.zip
Size 1.3MB
SHA256 8073a706feb7da6a00b6c9eac7df7da45d6a86b9ab4613fe752b42363c00b396
MD5 70cf5b9b0fcea1feb06aec6b1ac177ef
SHA1 95341b1243959565bebedd5f15f92d57ef7b329c
SHA512 a383ea54dd16b5701966cd373a97f10a00adcea2088884e6c9bba10e60fe40a1260f97380e92e84004988993fc1d93627dfab2dbd790666a9e05bb8e9c7a4e65
SSDEEP 24576:eOdguUFbYGQeOdP2m2dfyRQZ3lbvyLJRp4sH:5dguUFbYG/GRR7
TLSH
T1EB552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\libcrypto-3.dll
Size 6.0MB
SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
MD5 4191d4288230515c5098cc07f699a604
SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
TLSH
T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\libssl-3.dll
Size 1.3MB
SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
MD5 d99207e7e513f87ad7571c4c2450771b
SHA1 b904eb3989c9a1ad77e3a541e40d84ae890e3df7
SHA512 bccd034e633b96c2c7dff6ca96c2bb8a8c0f90a872f256e8467e470ed57fc4b442c74da488b258b5a255feba26767a5c95293a636c94c754e2644ed91c5be7ac
SSDEEP 24576:gk2RrDo2iVOF8hXN1hyeWsoSvSZlRg5aYsC:gRFDo2uOKJ8sIRg5aYsC
TLSH
T11F556D5AA7B8016DD5B6C17CC6938B23D2B2F41623709BEF06658A790F23BD6273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\python314.dll
Size 6.5MB
SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
MD5 006b0746b5abaf438d1bc753261c6d2c
SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
TLSH
T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\select.pyd
Size 32KB
SHA256 fab1b4cee101359d82d72061b83cff1855337b3677b9fe01cd69f7548f4c496e
MD5 43a869da7432298fce80f8c163ad8e7f
SHA1 65d259ba8350561668706a563ee0800c1748c173
SHA512 26c57d276b82fcb9c4f971a8e74847e14dc1a3b942a62f442740d6244ee8f23ba29c9e56b5001c2734db3fd1ac52a6bda02926f47d12cf727e38703971fa9d55
SSDEEP 768:TB7YLZnCaqF8IGRGCy1KPuBL2Ip4pTxf1ml9dHu7L3:TB7C5CaqF8IGRGCy1Ni9bfIbHun3
TLSH
T17FE28CCAAB345047EA63C671C6A2CE83FA39F7E35611469F31B5918A1E237C1A337354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27442\unicodedata.pyd
Size 741KB
SHA256 0d4f124b2d6622d276d777f7106972219f9b310edb5df8149c253da7c013d6d8
MD5 4df357dfce07299b9e6759583f41ca68
SHA1 d5810b7f7d05ac3a37592566ee898f428919cb53
SHA512 f741882d4444a4be4342f89932b2510c57fd943cf782079551c202c419805a90a06203464cdf1a209a8da3e56677426dc9af388b2077a5746b3daf0f2da1f69f
SSDEEP 12288:jIwYBAPtrZmDtBPcH+dEYJ5EYub+z70lDJPT36mwtyqt:jIwYS5ZmDPqO54lDJPTMyqt
TLSH
T11EF4E5F5BB838C16E69B767A48D3210F4E50C2B35F1A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GPI MOE LESTER.exe

Path C:\Users\Admin\Downloads\GPI MOE LESTER.exe
Size 8.6MB
SHA256 89cf4644a1acb5ea182c8975e1c6831107f36c0bc2ffe8b803af183119a70ffd
MD5 6c63e48ce9b7e1026a72ef9b62479d9f
SHA1 826b09de5d080aa0f6ec778dfb89b2719321d9df
SHA512 6f3bd735a2636595df33464a52f7d51b2fb885842e5252a9e499964015a5a85c7be40cc6c94ad1002d848df2d3f69bccc71f0b745558b2dcfa4254b932f52d85
SSDEEP 196608:Hhcd3wLbiXEpXnH2ph1iut1/1QpL0uQg+RBtK7voKgpVFSZ:HhAEmXEAphVtrQSg+RHK7vFgtS
TLSH
T14C96339CA2D049FEF8B3843D9DA1D811D6B2B8512FA2D1FF17A059190E377D14E38AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GPI MOE LESTER.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\GPI MOE LESTER.exe:Zone.Identifier
Size 52B
SHA256 161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67
MD5 dfcb8dc1e74a5f6f8845bcdf1e3dee6c
SHA1 ba515dc430c8634db4900a72e99d76135145d154
SHA512 c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d
TLSH
T1A190025B044444440A9571C495DC9658A41F79994D4512C4EC8044D69D840AC51E452A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1692-461-0x00000246F8000000-0x00000246F86F4000-memory.dmp

Download

memory/1692-471-0x00000246F8000000-0x00000246F86F4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads