hxxps://cdn[.]discordapp[.]com/attachments/1225577090619801620/1225577183410655322/lilith-launcher-windows-s3[.]exe?ex=6621a2b2&is=660f2db2&hm=59267620384c54050cdceddd903df67bcbaabb76272575fe3c25d86369391938&

Analysis

max time kernel
1799s
max time network
1773s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1225577090619801620/1225577183410655322/lilith-launcher-windows-s3.exe?ex=6621a2b2&is=660f2db2&hm=59267620384c54050cdceddd903df67bcbaabb76272575fe3c25d86369391938&
Sample240404-2qzzesce2v

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	lilith-win-1-0-36.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	lilith-win-1-0-36.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	lilith-win-1-0-36.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	lilith-win-1-0-36.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	lilith-win-1-0-36.exe

Executes dropped EXE 6 IoCs

pid	Process
316	lilith-launcher-windows-s3.exe
3728	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
4996	lilith-win-1-0-36.exe
3892	lilith-win-1-0-36.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
79	discord.com
80	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133567446035090887"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-399997616-3400990511-967324271-1000\{799D109F-3CE0-4010-8E35-15966DA968E1}	chrome.exe

Modifies system certificate store 2 TTPs 6 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	lilith-launcher-windows-s3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	lilith-launcher-windows-s3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	lilith-launcher-windows-s3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	lilith-launcher-windows-s3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	lilith-launcher-windows-s3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	lilith-launcher-windows-s3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1628	chrome.exe
1628	chrome.exe
4044	chrome.exe
4044	chrome.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
4508	powershell.exe
4508	powershell.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
2188	powershell.exe
2188	powershell.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
4152	powershell.exe
4152	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 4328	1628	chrome.exe	86
PID 1628 wrote to memory of 4328	1628	chrome.exe	86
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 4416	1628	chrome.exe	92
PID 1628 wrote to memory of 4416	1628	chrome.exe	92
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1225577090619801620/1225577183410655322/lilith-launcher-windows-s3.exe?ex=6621a2b2&is=660f2db2&hm=59267620384c54050cdceddd903df67bcbaabb76272575fe3c25d86369391938&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98f099758,0x7ff98f099768,0x7ff98f099778
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:2
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5344 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5496 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4752 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4568 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4912 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:4704
- C:\Users\Admin\Downloads\lilith-launcher-windows-s3.exe
  "C:\Users\Admin\Downloads\lilith-launcher-windows-s3.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:316
- - C:\Users\Admin\LilithLauncher\lilith-win-1-0-36.exe
    C:\Users\Admin/LilithLauncher/lilith-win-1-0-36.exe --iknowwhatimdoing
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      PID:2360
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      4⤵
      PID:3064
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:4880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      PID:2524
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        
        PID:852
- - C:\Users\Admin\LilithLauncher\lilith-win-1-0-36.exe
    C:\Users\Admin/LilithLauncher/lilith-win-1-0-36.exe --iknowwhatimdoing
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      PID:4448
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:5096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      4⤵
      PID:3984
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:1684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      PID:3472
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        
        PID:4252
- - C:\Users\Admin\LilithLauncher\lilith-win-1-0-36.exe
    C:\Users\Admin/LilithLauncher/lilith-win-1-0-36.exe --iknowwhatimdoing
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      PID:5012
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:2716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      4⤵
      PID:3352
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:3616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      PID:3492
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        
        PID:540
- - C:\Users\Admin\LilithLauncher\lilith-win-1-0-36.exe
    C:\Users\Admin/LilithLauncher/lilith-win-1-0-36.exe --iknowwhatimdoing
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      PID:864
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:1700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      4⤵
      PID:3084
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:3644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      PID:2204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      PID:3896
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        
        PID:3296
- - C:\Users\Admin\LilithLauncher\lilith-win-1-0-36.exe
    C:\Users\Admin/LilithLauncher/lilith-win-1-0-36.exe --iknowwhatimdoing
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      PID:4572
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:3000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      4⤵
      PID:3360
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:2028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      PID:1432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      PID:1796
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        
        PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1764 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1592 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5636 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5732 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4756 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6008 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4748 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4600 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=2396 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=1600 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6348 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:3944

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:528

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

store.jfm

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm
Size 16KB
SHA256 445125c6b20727aca2e85fc1e1fae687e1baa40ea8712450d7ebf2a7768cbd2e
MD5 f9f71a61bed70d078d93d06b92ebd257
SHA1 b88a613c17415c66ab6c4e40dc057cd8d44035e5
SHA512 021f8095b6baea58e532855befdba71fd9889382decded800de7ace23cdfe4139eef1f40aacaa0c11476202214d080389332679e47d4adf8169b31c7bd3bfdc9
SSDEEP 12:5Ur66uyZmaGRG+Kh2H/N/cvi9DT/rNvrNBGs:5e8rKheFUIDTDNzN3
MD5 SHA1 SHA512 SSDEEP

Submit Download

109b9f9d-1588-4642-9078-9dcbd20880c7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\109b9f9d-1588-4642-9078-9dcbd20880c7.tmp
Size 128KB
SHA256 47898fee527fe5916c1206ea1b8ad4f31c8f149a4863514d472bbdd308c9d611
MD5 445f4a4dfaee6a78e7f9279183e53032
SHA1 30058960613f5055d3e83ab65863eff19e087bbc
SHA512 49c42a6779bcf7eb81255170cfba2fecb82be99130ddeafb6af50e266a4a078bad99f472f11593a4240cd3a522e74dafba45fa2464dd9b5a984684393c096ca5
SSDEEP 3072:e/t4Yb3E/NdvXCNpbMhZGBo4DL0penxA5akNbef2+ZK:eyASNdvXCNpbMHtCMpSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 198KB
SHA256 f6562ea52e056b979d6f52932ae57b7afb04486b10b0ebde22c5b51f502c69d1
MD5 319e0c36436ee0bf24476acbcc83565c
SHA1 fb2658d5791fe5b37424119557ab8cee30acdc54
SHA512 ad902b9a010cf99bdedba405cad0387890a9ff90a9c91f6a3220cdceec1b08ecb97a326aef01b28d8d0aacb5f2a16f02f673e196bdb69fc68b3f636139059902
SSDEEP 3072:UpHreF1T30JYH13kQCsC42wpBFKjFyjd2twH1XCR42UiRxGNMm6t/9durtK:UpLE5EWHxj7dFKjqd8wgR42UYGNg1sxK
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 24KB
SHA256 d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d
MD5 b82ca47ee5d42100e589bdd94e57936e
SHA1 0dad0cd7d0472248b9b409b02122d13bab513b4c
SHA512 58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383
SSDEEP 384:WVO9Au5n8w8JCE3z7e7Ttbu5+Esl5fnOoHYSDzExWCI3+IEesI1uBVm5ih5DTcOU:fWkn0RSdu59s3nOc5zExGd5Mt4OU
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cd24e7daa76a2c8b6c7fd8457b406837bab2a70d4b1c691320f858a4d5e29b94
MD5 41d96369ba66a8fc56a8f1b19d5e123a
SHA1 ab195e274f36f2c275a10cd8983f690622eb37a8
SHA512 567f53ce08e887104338ec7cf158a290cd6db231a2581f9bd0d1361972a154e64c4768dfab7fd08d1eddaeab28ea0a2bfb1a94fc3b9f68634835f75fd6b62883
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 126184b2f525f8be5ebad96431a5354e8deada07acbf46945afc71ca64eb9e2b
MD5 0573f65a7e054ca8b432dab5f5835c9f
SHA1 893fcb8f2027a89362cfc2b60f796a90b1af88e6
SHA512 89a78b3ace56bbfe95419f6445f51e86b5ef069ed7fb746f1f6adcb9839e01aca6b2b4969b264fa511300d1d07ff0819c96a73da98713652d0fad782696bdf16
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 1e5594082e08885ba4a5ac7f10743fb0d55896b626213f00783a006e5f5e7e65
MD5 4b4e268caf54b4a04460896f701af97e
SHA1 429a0b610311c6e73df32e881beeead88d5ccc3c
SHA512 b9a5f54188b58938e523dbba1efcc65476f542b3f3b45792c2ccbf953853f7d01700de69b57bf0a6475e1e32e28a6a199c680e7659fd8670419f6b64e9ba1a60
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 8880af60727f2ffef34497d482d1f8ca3c9330bf510d89425dd0d55315162774
MD5 26ee6ab89b6233f6b95723349e2f935a
SHA1 c9b5002a5b861321277089ab7896e44045b71f78
SHA512 4bed711324cee809e7f6c2fe189c3a6a859dae22247eeee103fae6e8720a9fb3201bf6239d92cb437360ba29c07b33ef02e45e3b0dc047b72547a568f7bfe39a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 697e0cdaf2e758b9ead14cc3c0685257707aea76984e364152edf2862b4b3717
MD5 b49c8768f4ff5d34c78bae635acd2236
SHA1 eae8690a73d0e1a86a057b372b78fea82445d93b
SHA512 860506e8ddccf2d638b1a64876d0dfb6fbaad0a6ed85beaa92eac37ba3c97272b3d6f6a4bcf7a13d6d82e0f3879f2b07f0a86b9b2429b8528c839c735b91b3e5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d8737571b51dd5002fd5f6c3dfd6cbcaf25fc0a8355eab9e697f6bffc60f37fb
MD5 6355692522ab145fd8d24f1ebda925e1
SHA1 c371a6239043923c7685d88e6fb4484fabaed93b
SHA512 62e0d896d4e062ebd8f7c2571848e084ca9f3318797bbec127ba4d59d187448fbc4d6b7979cb4e7e5e23d5f07a89cdfe116d82dc05da2d049c9f7303458a367d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ad46278770d1fd1ffb74654bc3e41cd304af4abd1aa824ec33f12be0c51194d1
MD5 4ee7d27c2f25dc190575082247c09e7e
SHA1 8eef6489545afaa57316d1ee876de3a9c7b9a712
SHA512 9672bfd707ffe456847ecb3adf51653031189078efb2e0a82852c325e1e42996bcc526add8672b1c8196302301fd7527ab8fa36b90cf3d5f2e952fe4c88521cb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 871B
SHA256 41e4a17cb44630a8126c69685bdedc15970eecad6d11d3dcc3989dfdca82a5c3
MD5 c713f20466a53201b1ee0b2df21a43e0
SHA1 b0647c737e757bfec376c92781b335de7c00a819
SHA512 c11650bb84a0c3c7db00c1c5402f4fb4005809163ebdf129d6668bfd0005b5ff3b60522079a4aae81da0e17fbfee919fab3fdd978a91636084e6158bb85ef951
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 dbce04dfb0a17dc2970c4b51036abefbd6257233f4b98e32807a9d9d2f6f46e9
MD5 38847f0ffca7b64348434fad9bf8d5a9
SHA1 dd55a49592ca95aa8d07eb727b820464edd24e0e
SHA512 87092110a50bada9617ccd3e88fb1d1ab6fe7fd7c8128f30950aa592c7dcc9c2e8dcb996d38bba205b4b10b418be98c7cc5e81e3e2104099b15e60758c2c7d0b
SSDEEP 96:nxkN0L26cNrG5GMuWWGiMGHRGsYE5GVGtGKGrGhGvhV:nGN0L26ctEHuWW6C/YYcWBIwoV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 62aa2aa31f02b7f70789354db9078baaa9c69611880345c7af439e73b9cfb22d
MD5 aacbb5bc68835468566e3cc8b07caa20
SHA1 3c0aff0658d47207f254f0e83694e360fb977d36
SHA512 512e8372f541652095ceb3422cda08ec00f6ed1f645eb499e77e34501d0520ec2f2dbc0f628bc860e3438926ffd59b55c4ab3db50fad3ecbb0238a93a8d265c6
SSDEEP 96:nxkN0L26cNrG5GMuWWGiMGHRGsYUGtGKGrGtGaG8bGvhV:nGN0L26ctEHuWW6C/YUWBIAzHboV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1dbad521e08ea0676f0d6752d83accfc5d849c67eec2ee63a422afb66dae22a8
MD5 b2358e3081129d8e74b1fbac8f053816
SHA1 247d16090fb79c052cbc769826d3a05d68b55e30
SHA512 d96a9050ded9b28f2410e445cfe5655a40ce84783665673cc20aa363e17c0d282b9a493d04ad45ba3914cb383b64f7650512445ebc24104783b65a081ff7f7be
SSDEEP 96:+IN0L26INrG5GMuWWGiMGHRGsYUGtGKGrGtGTGTGdRuhV:+IN0L26ItE7uWW6C/YUWBIA2mZV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 589d7c42627ef2890e492b01b35098b96ffb510965a23f8c37ead04aa640bf98
MD5 5c8bdd9d044cd2133940b84672485874
SHA1 708a46b3db65d01812b94ffa2fd25ca9a5fd64e4
SHA512 19f6f67501813c7d527a737bc309d3edba16ca3e3ca20784237adbde7daabb878125dcc97e75c4ad9779780e1d16f5a2d6ba0767bb5cdff99a40cfc62b974640
SSDEEP 96:nxkN0+P26cNrG5GMuWWGiMGHRGseGvGp3GvGUGD0hV:nGN0+P26ctEHuWW6C/eqqwjKqV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2dea2de37579855745ff18bcf4a0ef73cf2574b83f8726e5f904321faa4a9cec
MD5 2f5ee6811a6cfa6e1941fcf3628e9f2c
SHA1 e543f4a3059280125eba59e405059e94692f3175
SHA512 254ed7ff50e7874a78737f25a48cc3fe50db83ba4a1fc62078d30189cb936e54b0cb8e235b640a6a220c134af8f5cf1276636146dc6516409526411e6dcd3ee5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 76a68ce53d01194c99839ee700f7c6b26229648979dffe709ceaaeac02bc7e9b
MD5 ee93c2e7f12eb339c33caef8d40547ce
SHA1 9362bd5cff1defb89e0fbe665cae36837a8be8a1
SHA512 e29fe88c938696671a5749d1f4b543872bd2b0704e01a7cee68d09ffcfab1d7d2c65d50432fc880cd2feb31583d8e0f4b9d75e97e275b8ecc2908b3665467e34
SSDEEP 96:+IN0L26INrG5GMuWWGiMGHRGsYUGtGKGrGtGaG5xGDhV:+IN0L26ItE7uWW6C/YUWBIAzwxkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 705B
SHA256 20192f3e0e012faa1f61257aa863d513a1f78910dc92f957af0c803761bae768
MD5 a25752fd5248af5cb4f670d4bb0e1325
SHA1 9a1dda980aa54a9d15922c1eaab284971f02bfb9
SHA512 0b11d9ff5eda6aa35470fc73ddc152405b75c0e439b2bb868c73be673123b672b0ebd4e6bc2cd937384855ea40522ccab2c08b4c052d021be77ef0e175837635
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 d6e674291ca4b88caca7255bcfb880bbf0684223b12c2f937d828347c9788f63
MD5 10cf1eb53d6be607b6e2e57469d1e9a4
SHA1 7dc43dea6d6db25ad90feb39af2d3f80d8843680
SHA512 69b46af9a694d05edde407411fd63f07deb9028b855a1a7a4c000abe99d22cca01f0f9f58f33193e1fdd4a5373a5089c7b8adc9a19fa43f33e4ba5629e73d5e8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 aa3cce683381c7c876fada13ba8cb9df5004ab305f490ef4992f649657fed1bc
MD5 ce9a0ca80a89d98fe7bbe74b2f7ab3b6
SHA1 2b875720761d56e22107e4ef2fe1b6014c5128b4
SHA512 08094d1975441cf3137877faa94231025a95caec69403cbebae59e143fe1cd1f18ca2bfb9675596db1af01ef501521e74e24a36628f6f94bfa4fcb3216b8b58f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 bf92c18a0ba61746b821427c64305085216ceb030e32a467333ebe1a23295a34
MD5 8ad7f29947b4e24964c5f8deb04b7b33
SHA1 425e4b4c3baaa68e934dc22a0fc9de9f947194f2
SHA512 1ba850fe13d2d62441248a721f3f39f900318fb5b911e02874a7a0cc45f3ca83389f53de6965995b5dba0282d44ff2359393c49214035d9e458e9008d10df700
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 697beb4f1828f3e16833c0e8ab6ece3e7845f0515c52f94008cfb16718c5f486
MD5 f74992510db86524f7bf6a8d9a2c5372
SHA1 ea9807fdbdeead85c38dbffed218b4fc697b5b6b
SHA512 0d942febd75c90fcfb7d747da23cc784d633e9c9d1627f720a4d4d6a163170e51b631be2f137134672af83ea26f39d2aa07c9a4a3446f5598b1b1716f4ca4a20
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 b57c7050d0c50b9ff4181a9f70523b956b6b495266a7cce963d02f1ca8bcfba4
MD5 190fc53eb23cf9b45e05280ff0ba5e40
SHA1 718c1fb1ca08ed1b7502bb1aaf90c2f3ff085725
SHA512 cd5eb25995eea3c8669080f32924997c9fb442f996be712661eea61b9e4e73694cad42c1b4fa014b89e9f037e84489b8ebcbbee8c8502607bb8dbc0a836b7117
SSDEEP 96:dQtrX1KIZxs8iZRy7Di+6MsmdezOPe0AwPjVhYtjEsXt0/cg2Vup:d+rFG8syy+FPPotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 521f5849ab850d95dd9ddfe0070d4f9369ce41a037d659ec295661f9d516aaf4
MD5 b3913f63cc7c6844b85704b0d725aad7
SHA1 443e735fb417eb772bd9dd9df3916db5712f2cd6
SHA512 0277f0ba57efcd14c619419355a27c2ccf4ceabb6c3a8d2fa6453682db73cce790bb07f74146955b56f78fd723a9b290821847eca3d4d472bb86a5ab0ee55f8a
SSDEEP 192:o+rFG8syy+FOA1xIk9PkTVPotjEsXtScPS:o+qyxlkOtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 9387f96daf3e6ee9801e4609434ed5c2e75b7806840fb2253a4fc38dc3943c96
MD5 f8dc27d1c4539de962b7af68e2cfb9ea
SHA1 4419c0b1b7b952ce32f409954adabee30c7bce93
SHA512 61d3f32fa2a5a9e26273e82de8ea72db51f57470e615680b1ad0fa9bdec0b10c89fe73b5670a74d16df265930325092216085c13e10a551da5d2e023bf2e1772
SSDEEP 192:M+rFD8yuyy+FOA1x7Ik9/k2vkTAVkFXP8tjEsXtScPS:M+KyxNhEAg0tIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 01e7fc091d3b54a4d070ef415c6e6c28f268b0cd832b6b4e05c492f8a0cb71d5
MD5 bb3caddc7745752a6a57a7dc256261d3
SHA1 dc34ea250b91e46d3e2fc7bfa6ff3bf0f3e3d0ef
SHA512 961d9ab3e77c4b512b28f6a1c91a6ac84fe64cf35c31755f0429aa5504a242d3dcd94b7ee187f3e5bb9fdc0f6974b1b4d6feedfe7c790ca7909d1d568fff0a3f
SSDEEP 96:oQtrX1KIZxs8iZRy7Di+6M/RgmdepGka1HOPe0AwPjVhYtjEsXt0/cg2Vup:o+rFG8syy+F/RkaKPotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 4ad5a23cc7c0aa998325115fcb8cddf3de51ad757512452ca39c36ed8df7865a
MD5 ad8c09612ff1178a8077e6730d7ef948
SHA1 d3c635766eb9a2c42d04d7f48cb0ae66039cff29
SHA512 e511a12db4b1539de008f9ae3d445d1a3b155c4feedb287b40696a01d84a50e3cef3d86fab6e10c7ee7e9f37a4f4d2d2d989b192e0861ebd532f715d21f3d7a9
SSDEEP 192:o+rFG8syy+FOA1Ik9ppkPlgAPotjEsXtScPS:o+qyxL+4tIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 c94db88694170142c4b37d77bcc0ece8d946905e68292f090b2b6838016543c8
MD5 ced5b77a1b603a6b12340187e0ab3779
SHA1 70980bd57713792cac58e7e0895b91f508dd610f
SHA512 93e195a5e92ea716957852ff90858efc5070a46b46e101fe71226e7cd519b224d7125e5a29b9b37ab012a26d097703135649f6ef8ee02f353de706f8a0b15401
SSDEEP 192:M+rFD8syy+FOA1xIk9PkTAfk42PotjEsXtScPS:M+HyxlkAL5tIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 1f91c6ab754fb8e55fd373de12dfb1a89dfebfb00f79d59815e13f1b015fe24a
MD5 f1db9643850a64dd89c5a41e84edcb72
SHA1 edcf8e88219255d94b629bcf03bc8b87168239ba
SHA512 27221dbb76438b52cad518b5edc219928033ebb1195e576615749111df63a7e5b8337eaefae41d03b763c74b3bad29e5468d1420771d20fdd0051e5be0e779e6
SSDEEP 96:dQ9rX1KIZxs8iZRy7Di+6MsmdeAOPe0AwPjVhYtjEsXt0/cg2Vup:dSrFG8syy+FWPotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 3325e55c05b91753d9462a9b68591a7cdfc95ce15fdaf6fc13918521d85c47a9
MD5 7b5ecb7ee5e61b472e75e235c491c09d
SHA1 b324413d36a6c6db7d3ab34ea764e7832fe9bb86
SHA512 dc55d4d35ef2f007cbdcbfc11f3165bb8236e97ebd7e1953601e297a8765594464b3f4d84ed5a5ce03ea7616299b188533a4941257ab0ce27b35b002402c2bf0
SSDEEP 192:M+rFD8yuyy+FOA1jx7Ik9/k2vkTADkTSP8tjEsXtScPS:M+Kyx5hEAELtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 bcc7db1c0083473df9fcbbf5a8e6324a618e534d8d514085f9f9159b553f3601
MD5 86656d21e3a1ad92d9ab65f88dc0729e
SHA1 85457a1b8fd2b517ee182537c753ed0daa8d39f2
SHA512 9e2fc3e72cb110e348b5009c7330f389b9737ec690f383031721a741a55156502d19439baca1b9109530d644a71cdd437acbc60694eec1e16d58cdea83961984
SSDEEP 96:dQ9rX1KIZxs8iZRy7Di+6MsmdeyIOPe0AwPjVhYtjEsXt0/cg2Vup:dSrFG8syy+FzRPotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\55dd229f45b2580be81f90228cc8cb5a4c3003c3\5ddc0add-bd0f-4399-8199-e0a0c781a61f\index-dir\the-real-index
Size 1KB
SHA256 614909a9cc71a73289f855c00e44737acd78f42577486e928084c34d465b74eb
MD5 86db7797da67fe7744e3bbe53c1a79cd
SHA1 0c5b56cf86e8f574426bb7e76d28808e54533200
SHA512 0d165c1e405802b44f747965526da41cac0c48a38432cd63f237acde06deab2e52d358179468badff0aac5624afc7014850fbc5714c80670a15a3ecadf374bbc
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5fa764.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\55dd229f45b2580be81f90228cc8cb5a4c3003c3\5ddc0add-bd0f-4399-8199-e0a0c781a61f\index-dir\the-real-index~RFe5fa764.TMP
Size 48B
SHA256 3f85a27a64ac08a7e2656072427ee1af49996a43d8ea7f74b346283045cb5478
MD5 149bafa139f1b09a2a411288b4de3892
SHA1 e6010a904bbb41727646e2540e66b48826b62c0a
SHA512 fccb4c52509febf935cef1513eaa83c27fca28b996e59857fb7d7dc0821fc838e8baceb27fa2b742d84de091b5be5afb7464e51a2e7cabaf41df5a3876201112
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\55dd229f45b2580be81f90228cc8cb5a4c3003c3\index.txt
Size 130B
SHA256 e240d43d543858c27eefbecc1ae8d297adfdf9192939052afcc22fe861d040c2
MD5 145918a7c6d7ad974d0f8393cd5e96a0
SHA1 39d449e247e613c16114afc695da8aba2be93fbd
SHA512 4467ab8b76d9eabefdc5c522020217a77898c6d4af95aa2ca38c78e64c8dae505757877ef46c483689e968b7cb8c44f686f2d18ec832e24f411e461590af244b
MD5 SHA1 SHA512

Submit Download

index.txt~RFe5fa7a3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\55dd229f45b2580be81f90228cc8cb5a4c3003c3\index.txt~RFe5fa7a3.TMP
Size 134B
SHA256 f3a1149b5d5b411ec11839fc69f7003313d345907bbde181cac41c276be4a6f4
MD5 ecb641b5476c62967058cc70d1429662
SHA1 027e5bd568c56f1594dd55ef8aa6d9f46fd5ff5e
SHA512 a114f90c38552282db3598722e78d63c6aae77dcd7164f3fc466ea299118c25310e250ad3c442074d9e17a6d176d64b622a7d4fc5e38f429facb1298486ae758
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b2845149b96b8da3ffb3903e28fac9f0e486b144780526ff900c5210a1ba0c32
MD5 62ea6f7f099ca158a56ddd8b6b2cdbcd
SHA1 1bdf03631993b74c2a0b6378419f4fd8d09e5c63
SHA512 f2c0f0863dd4eaf5212c6f47e64abc73ca32f0391d14a3d20cf819eed84c097c4e99f0f222370f50d8a76b182ba93ba2b2bff085e67b52b4112d342324c9c1b0
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5f9757.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f9757.TMP
Size 48B
SHA256 f083985025d5fa4090a96e310e6471dbca22eda374437410bd866677d0b97755
MD5 db501250f2f5cff1e48a4302fd7b4de6
SHA1 83fc8b8570ae46eed6830ebe7603a2f8837d797e
SHA512 0093ee96428a814bc188c9cbf0e55b0e2a9e847ed1f70af6cec452a6192900a4b5316e8a72b512ac2655efa0f0c73993043b5d8cdfa625ed07359d95343808d0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 47410e47e945042b686f013cdf84ec7ecab208b59217f31b11f4e687225308b2
MD5 e85625a0c6ab3929ab31398b10715424
SHA1 c3c33be6d5887e65e28cd3cacadc73dacf4b9dea
SHA512 b66499cf6793fef3c6dc7aef653681cae048da39a4aac6c4de001597573ecc018b4cf89036cde368eae43537bca16998046c5fdca2a7d037daac8a34b44c7bab
SSDEEP 3072:e/P4Yb3E/NdvXCNpbMhZGBo4DL0penxA5akNbef2+ZK:eYASNdvXCNpbMHtCMpSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 114KB
SHA256 1f4fdb3accb5d3cdca63ccbbf4d81e0dd8c916abbbb7b2a9e290f656a12afb0d
MD5 c0e0bdb5a519f3397196885540e151ba
SHA1 4530fb399444f9858c6cdd4d094926d09f972cea
SHA512 b2273366a1146b08b67cf2d5e4e5e850e4c1aa65ad34484601d595e6c3250639da4a56fe78face75d98d332e363d87a7a1e29ddbff0de6d39532fd1a9cc207ef
SSDEEP 384:AyEN+YGeoOIu2gRLThTUHAa1pWOaZZ2ED18QkfYgvwpqKIgHz3bi54GruDY8a3Ou:w+YONPJAdHD3Qkcwz6hqK3exe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 117KB
SHA256 0bae507b98331aed538cba4f2ad8a03754d3649a07c5298d662ad2534604c5f4
MD5 31f2cca61561a15459b581989be8ad6f
SHA1 1ecaf61a73cb6e4f2e5736c69cbe1d074124aeb3
SHA512 6fc461c3ef55ae64e704f6793bfd07027688ec699e9af0c229aef6e56b22150e1e3bf9d748f93e171c37f73ad77a0bc14c3326f272ede30b628045d24ab6b62b
SSDEEP 384:tyEN+YGeoOIu2gzoLThTUHAa1pWOaZZ2ED18QkfYgvwpqKISMuHz3bi54GruDY8J:l+YO+PJ6DdHD36kcwz6hqK3exR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 118KB
SHA256 261f9ab083741abb96ab2f540bf5a8935bf7d1d0ed45311db7f384c99392fece
MD5 a2f294b692372fe3815b6010ba3e482b
SHA1 4e3ac09404ab7e51e75eeb71244d8bb16fa92b76
SHA512 2c3e842ece644698465c9ad1a0833baa43ddcb0e1411dfb22ead9ae501e3da2c4f53934685066a158b8b043fc96dfc04f329e196a0472df6c6143087f648b2e1
SSDEEP 384:OyEN+YGeoOIu2gzoLThTN2HAa1pWOaZZ2ED18QkfYgvwpqKISMuHz3bi54GruDYG:++YOKPJ6DdHD36kcwz6hqK3exF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe59d8e2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59d8e2.TMP
Size 107KB
SHA256 597cb052fe4c1edb074f386e200c3a484bf091d59daee9c40fde43b6c6c48af5
MD5 9f58ba01aac08d5e15e72f0df5650a06
SHA1 ad8c5009fa995116d1c6d05cb54f3c79b589891a
SHA512 a2f38f9ae081877be75e3f0627c5f56b01a5d81a25f8abd0147ec8086430b4e1ccfd5a8c6257c0c929a66c36c57d2b35a3aada1c2943653b1c548f358e61e247
SSDEEP 384:/yEN+YGeoOIuxLThTUHAa1pWOaZZ2ED18QkfYgvwgKIgHz3bD4GruY8axZBleMQC:H+YcPJfH+hkcwX6hqKdexK
MD5 SHA1 SHA512 SSDEEP

Submit Download

f7fbd782-2f36-4c99-8594-a8f126faf5ac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f7fbd782-2f36-4c99-8594-a8f126faf5ac.tmp
Size 128KB
SHA256 ff4f5946ebefd8bf4f6768ebe6d77de115d338f19f26ab1eed4f8f603bef70fb
MD5 f00453d5d4a7b1ebaf3028b871a05e62
SHA1 15ec6f0ca84716180093136fee800f77c6444d99
SHA512 b8e7953f31bb6ecdaddcba6997aa9fd96fdf689751872fb403d8c1bd2fddbe3dc5b820fff9bd8aa487affdf698249ae6e6661d55e559543c70b4202302910382
SSDEEP 3072:e/o4Yb3E/NdvXCNpbMhZGBo4DL0penxA5akNbef2+ZK:eDASNdvXCNpbMHtCMpSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 5a48860ad5bdf15d7a241aa16124163ec48adc0f0af758e43561ac07e4f163b2
MD5 5c3cc3c6ae2c1e0b92b502859ce79d0c
SHA1 bde46d0f91ad780ce5cba924f8d9f4c175c5b83d
SHA512 269b79931df92c30741c9a42a013cb24935887272ed8077653f0b6525793da52c5004c70329d8e0e7b2776fc1aba6e32da5dadf237ae42f7398fdf35a930663e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 f7eef16878d0808231b3e9f0ba7593eac4afd546e6138bee1e4dcb26fd7c7d98
MD5 ab13b757b4bcd48bd1bdb7b483505495
SHA1 9397e76f73aad79d05e86f7a9f075bd6a1ec570a
SHA512 148b322cde0708a838688a7d856aea3ffbac6bab7ca369a0e5f764ed05e6bc13e3dcfd9d66c2284af14ae8e0312f86b970c6efee4482065d9517be031585f76a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 65636415aecfc59f45fbca3abf79e57c53e120a8d9099a6b7f9c066f11af67af
MD5 453b0833cceafedb493813d450536f3d
SHA1 8d182a668eac53574c74ca964f2c88dc23d6030c
SHA512 68454de814c652972b76bfedff247a089affd8ea0a5d870b10a5eb1fb8752d2928a4f7104822a95101aa4100bc4acdcbab87e8a6c518cd9a28a1f1eec8e00049
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 5422bc17b852ad463110de0db9b59ffa4219e065d3e2843618d6ebbd14273c65
MD5 2f87410b0d834a14ceff69e18946d066
SHA1 f2ec80550202d493db61806693439a57b76634f3
SHA512 a313702f22450ceff0a1d7f890b0c16cf667dbcd668dbafa6dbecd0791236c0bc68e834d12113cc75352365c2a2b6cfcf30b6ef7c97ea53ed135da50de389db4
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 064f0654256ec17db8c0f1e5b171b7370a12e5c02428721bc27d7d75b324dd7f
MD5 0eeaed65f885e95e24e85914afec3820
SHA1 d1d022be01bc4aed0b7ae39dd8a8c23d785c61ed
SHA512 cb606dfbac0945185f11917e3e3d17876a2d64820083dc362b70e8e48b1519af6fb3b055d966d369c408c951be43b7b48fed8df1b88245b837fb527c9506b21d
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_tl1ewmsl.1em.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tl1ewmsl.1em.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

lilith-launcher-windows-s3.exe

Path C:\Users\Admin\Downloads\lilith-launcher-windows-s3.exe
Size 6.4MB
SHA256 b0b5ae1b1dddb8ad9ecaa6521d007d5dcc4a313541a5f74f4c2ddf6994aaea2f
MD5 888b418deba43641f6f12217d4cc3a10
SHA1 01f76792e995b2eff93c07387888049e9a627514
SHA512 4146becad7e17260f9cb74cddc0fdb8ce48d40c02dd7ea37190e03f7167009abef4d76c460ae79adc211228f6bec234eeefe25cb1dc0c0bfe4edf6883829e493
SSDEEP 98304:dk3+3Zqj9EFEhVaKrDAJIJ0wb1h89c3YalKo:++8jPh4W+Iv2mIX
MD5 SHA1 SHA512 SSDEEP

Submit Download

lilith-win-1-0-36.exe

Path C:\Users\Admin\LilithLauncher\lilith-win-1-0-36.exe
Size 97.3MB
SHA256 fa53c51bd31bf9a154ce4d4c8fdcc07aec56c74880f0a9447bc97df04277e9ba
MD5 c8a9624b05c2b433ddeea3e898a78d5b
SHA1 1298c825b5642b479212e0d7c0463a47b3d540a1
SHA512 35c8860a26899e06325e07f7d9670520de326a5e5b2b81f7b418ab3d641dbb71b5726aac82bca76a44e81e2a3e7048030ca4adcbf6a54ddfca1eadc5df7c7b42
SSDEEP 1572864:fiAQIH5kH6XPmzZRWNrTrnRWNrTrAejgBd9Z1abKGjPLNaY/8W5DTFnZUV:P5kHAmzZ89Pn89PTs/9Z1i7paY8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

lilith.log

Path C:\Users\Admin\lilith\lilith.log
Size 655B
SHA256 8cca4467caa4d69746bf31cc3097443c57b4ceb49bf8e803a291480e5f76f946
MD5 44be41bbbbb0b4ecca2420eaf2750c75
SHA1 f21081c95ac4a2f52c4c657da435bd5c8aecf1bd
SHA512 658b0c758eb07c4b51f1c3c8aec4cc8bf3817c4362854ae355baf71b34e3599f6497ba5b07d59d18f938e4c1861dfa5a7606870015317950aa0215c04c5771e2
MD5 SHA1 SHA512

Submit Download

lilith.log

Path C:\Users\Admin\lilith\lilith.log
Size 325B
SHA256 7d139364634fd3bbfece073a0f344aa3e2c22ed4bac3f040be8657be69ce318f
MD5 f33331d349a2712c6ea89db5044f147a
SHA1 cf0cb3aa1411945394c6f1b5da49d55a2244cd5b
SHA512 aa14dd8f09d525169be837b3dd1070d5118676c0bfb55c78d6f56abb66b45205e465f8568b9ed5c84f5b2c01d894baea265fa0c3201715673b7854da41091b91
MD5 SHA1 SHA512

Submit Download

lilith.log

Path C:\Users\Admin\lilith\lilith.log
Size 435B
SHA256 97f727743ea737a090fb5041b10c6f0bc800e988fb978d2159d0e805d469b8ca
MD5 1877a3562e23c7e2b870204c5d0aaa8f
SHA1 3fe0b325d0329e37ceddabbccb888c9cb2e60a07
SHA512 1601fbdc8e8f973b88d21cca0aa26504de7701edd3ed0c60ba593804d9959deb21591fb1ec027f635e4731c8681f36e101927ae5127788f49b5832d517c24873
MD5 SHA1 SHA512

Submit Download

lilith.log

Path C:\Users\Admin\lilith\lilith.log
Size 545B
SHA256 773c6d3b6136cd8e923a6432606c5f685d19c327448529cb5ba74c9b1b01911c
MD5 6d2864cd5416f2f483ffb4c480c82152
SHA1 a7bfd412a4247be183b3b9474849fc1c3a3eaacf
SHA512 942be7e8b7134e1c14227f6939860dffe209bef89453981a9d4d0a978156117e7704b298b7dd75bdb15083b6df069dc5c74dc1cdbf3868d3c1089796f61db828
MD5 SHA1 SHA512

Submit Download

store.json

Path C:\Users\Admin\lilith\store.json
Size 2KB
SHA256 002a7ad334c37af91eb0106d89a50885f2db05709a52ccae57c9320d32eac73d
MD5 840ef170f890cc86d05aed6f03d9b5d9
SHA1 24e66206bd5fd23fa88015a3efd10ff8e2c67f25
SHA512 645b78a8edec759e05e6c71b649096f48d07286d2b98e476474e325bb85c28f883f20d99399d12dd152f7f0764d41bbf0e69eb9a1e2d66329350bb5c6eff0761
MD5 SHA1 SHA512

Submit Download

memory/1432-1078-0x0000024FC2510000-0x0000024FC2520000-memory.dmp

Download

memory/1432-1076-0x00007FF97D230000-0x00007FF97DCF1000-memory.dmp

Download

memory/1432-1085-0x00007FF97D230000-0x00007FF97DCF1000-memory.dmp

Download

memory/1432-1082-0x0000024FC2510000-0x0000024FC2520000-memory.dmp

Download

memory/1432-1079-0x0000024FC2510000-0x0000024FC2520000-memory.dmp

Download

memory/1488-1145-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Download

memory/1488-1152-0x0000025F4DF00000-0x0000025F4DF01000-memory.dmp

Download

memory/1488-1174-0x0000025F4E140000-0x0000025F4E141000-memory.dmp

Download

memory/1488-1173-0x0000025F4E030000-0x0000025F4E031000-memory.dmp

Download

memory/1488-1172-0x0000025F4E030000-0x0000025F4E031000-memory.dmp

Download

memory/1488-1170-0x0000025F4E020000-0x0000025F4E021000-memory.dmp

Download

memory/1488-1158-0x0000025F455E0000-0x0000025F455E1000-memory.dmp

Download

memory/1488-1155-0x0000025F4DEF0000-0x0000025F4DEF1000-memory.dmp

Download

memory/1488-1122-0x0000025F45D40000-0x0000025F45D50000-memory.dmp

Download

memory/1488-1150-0x0000025F4DEF0000-0x0000025F4DEF1000-memory.dmp

Download

memory/1488-1149-0x0000025F4DF00000-0x0000025F4DF01000-memory.dmp

Download

memory/1488-1148-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Download

memory/1488-1147-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Download

memory/1488-1146-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Download

memory/1488-1144-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Download

memory/1488-1106-0x0000025F45C40000-0x0000025F45C50000-memory.dmp

Download

memory/1488-1143-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Download

memory/1488-1142-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Download

memory/1488-1141-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Download

memory/1488-1140-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Download

memory/1488-1139-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Download

memory/1488-1138-0x0000025F4E2A0000-0x0000025F4E2A1000-memory.dmp

Download

memory/2188-169-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Download

memory/2188-167-0x00000113F2CA0000-0x00000113F2CB0000-memory.dmp

Download

memory/2188-152-0x00000113F2CA0000-0x00000113F2CB0000-memory.dmp

Download

memory/2188-153-0x00000113F2CA0000-0x00000113F2CB0000-memory.dmp

Download

memory/2188-151-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Download

memory/2204-1006-0x0000016FC3740000-0x0000016FC3750000-memory.dmp

Download

memory/2204-1018-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Download

memory/2204-1015-0x0000016FC3740000-0x0000016FC3750000-memory.dmp

Download

memory/2204-1007-0x0000016FC3740000-0x0000016FC3750000-memory.dmp

Download

memory/2204-1000-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Download

memory/4152-454-0x0000017F1B850000-0x0000017F1B860000-memory.dmp

Download

memory/4152-536-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Download

memory/4152-453-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Download

memory/4152-455-0x0000017F1B850000-0x0000017F1B860000-memory.dmp

Download

memory/4508-135-0x00000280F0710000-0x00000280F0734000-memory.dmp

Download

memory/4508-139-0x00000280F0600000-0x00000280F0610000-memory.dmp

Download

memory/4508-140-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Download

memory/4508-134-0x00000280F0710000-0x00000280F073A000-memory.dmp

Download

memory/4508-124-0x00000280F0600000-0x00000280F0610000-memory.dmp

Download

memory/4508-122-0x00000280F04F0000-0x00000280F0512000-memory.dmp

Download

memory/4508-131-0x00000280F0790000-0x00000280F0806000-memory.dmp

Download

memory/4508-130-0x00000280F0570000-0x00000280F05B4000-memory.dmp

Download

memory/4508-125-0x00000280F0600000-0x00000280F0610000-memory.dmp

Download

memory/4508-123-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Download