hxxps://cdn[.]discordapp[.]com/attachments/1225577090619801620/1225577183410655322/lilith-launcher-windows-s3[.]exe?ex=6621a2b2&is=660f2db2&hm=59267620384c54050cdceddd903df67bcbaabb76272575fe3c25d86369391938&

Analysis

max time kernel
1799s
max time network
1773s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1225577090619801620/1225577183410655322/lilith-launcher-windows-s3.exe?ex=6621a2b2&is=660f2db2&hm=59267620384c54050cdceddd903df67bcbaabb76272575fe3c25d86369391938&

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	lilith-win-1-0-36.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	lilith-win-1-0-36.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	lilith-win-1-0-36.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	lilith-win-1-0-36.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	lilith-win-1-0-36.exe

Executes dropped EXE 6 IoCs

pid	Process
316	lilith-launcher-windows-s3.exe
3728	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
4996	lilith-win-1-0-36.exe
3892	lilith-win-1-0-36.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
79	discord.com
80	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133567446035090887"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-399997616-3400990511-967324271-1000\{799D109F-3CE0-4010-8E35-15966DA968E1}	chrome.exe

Modifies system certificate store 2 TTPs 6 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	lilith-launcher-windows-s3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	lilith-launcher-windows-s3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	lilith-launcher-windows-s3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	lilith-launcher-windows-s3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	lilith-launcher-windows-s3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	lilith-launcher-windows-s3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1628	chrome.exe
1628	chrome.exe
4044	chrome.exe
4044	chrome.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
3728	lilith-win-1-0-36.exe
4508	powershell.exe
4508	powershell.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
640	lilith-win-1-0-36.exe
2188	powershell.exe
2188	powershell.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
1664	lilith-win-1-0-36.exe
4152	powershell.exe
4152	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe
Token: SeShutdownPrivilege	1628	chrome.exe
Token: SeCreatePagefilePrivilege	1628	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe
1628	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 4328	1628	chrome.exe	86
PID 1628 wrote to memory of 4328	1628	chrome.exe	86
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 1932	1628	chrome.exe	91
PID 1628 wrote to memory of 4416	1628	chrome.exe	92
PID 1628 wrote to memory of 4416	1628	chrome.exe	92
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93
PID 1628 wrote to memory of 4892	1628	chrome.exe	93

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1225577090619801620/1225577183410655322/lilith-launcher-windows-s3.exe?ex=6621a2b2&is=660f2db2&hm=59267620384c54050cdceddd903df67bcbaabb76272575fe3c25d86369391938&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98f099758,0x7ff98f099768,0x7ff98f099778
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:2
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5344 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5496 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4752 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4568 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4912 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:4704
- C:\Users\Admin\Downloads\lilith-launcher-windows-s3.exe
  "C:\Users\Admin\Downloads\lilith-launcher-windows-s3.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:316
- - C:\Users\Admin\LilithLauncher\lilith-win-1-0-36.exe
    C:\Users\Admin/LilithLauncher/lilith-win-1-0-36.exe --iknowwhatimdoing
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      PID:2360
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      4⤵
      PID:3064
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:4880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      PID:2524
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        
        PID:852
- - C:\Users\Admin\LilithLauncher\lilith-win-1-0-36.exe
    C:\Users\Admin/LilithLauncher/lilith-win-1-0-36.exe --iknowwhatimdoing
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      PID:4448
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:5096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      4⤵
      PID:3984
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:1684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      PID:3472
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        
        PID:4252
- - C:\Users\Admin\LilithLauncher\lilith-win-1-0-36.exe
    C:\Users\Admin/LilithLauncher/lilith-win-1-0-36.exe --iknowwhatimdoing
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      PID:5012
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:2716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      4⤵
      PID:3352
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:3616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      PID:3492
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        
        PID:540
- - C:\Users\Admin\LilithLauncher\lilith-win-1-0-36.exe
    C:\Users\Admin/LilithLauncher/lilith-win-1-0-36.exe --iknowwhatimdoing
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      PID:864
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:1700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      4⤵
      PID:3084
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:3644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      PID:2204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      PID:3896
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        
        PID:3296
- - C:\Users\Admin\LilithLauncher\lilith-win-1-0-36.exe
    C:\Users\Admin/LilithLauncher/lilith-win-1-0-36.exe --iknowwhatimdoing
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      PID:4572
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:3000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      4⤵
      PID:3360
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        5⤵
        
        PID:2028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
      4⤵
      PID:1432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      PID:1796
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        
        PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1764 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1592 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5636 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5732 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4756 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6008 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4748 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4600 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=2396 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=1600 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6348 --field-trial-handle=1876,i,4077322211282389925,6112860086311361438,131072 /prefetch:1
  2⤵
  PID:3944

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:528

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
f9f71a61bed70d078d93d06b92ebd257

SHA1
b88a613c17415c66ab6c4e40dc057cd8d44035e5

SHA256
445125c6b20727aca2e85fc1e1fae687e1baa40ea8712450d7ebf2a7768cbd2e

SHA512
021f8095b6baea58e532855befdba71fd9889382decded800de7ace23cdfe4139eef1f40aacaa0c11476202214d080389332679e47d4adf8169b31c7bd3bfdc9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\109b9f9d-1588-4642-9078-9dcbd20880c7.tmp

Filesize
128KB

MD5
445f4a4dfaee6a78e7f9279183e53032

SHA1
30058960613f5055d3e83ab65863eff19e087bbc

SHA256
47898fee527fe5916c1206ea1b8ad4f31c8f149a4863514d472bbdd308c9d611

SHA512
49c42a6779bcf7eb81255170cfba2fecb82be99130ddeafb6af50e266a4a078bad99f472f11593a4240cd3a522e74dafba45fa2464dd9b5a984684393c096ca5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027

Filesize
198KB

MD5
319e0c36436ee0bf24476acbcc83565c

SHA1
fb2658d5791fe5b37424119557ab8cee30acdc54

SHA256
f6562ea52e056b979d6f52932ae57b7afb04486b10b0ebde22c5b51f502c69d1

SHA512
ad902b9a010cf99bdedba405cad0387890a9ff90a9c91f6a3220cdceec1b08ecb97a326aef01b28d8d0aacb5f2a16f02f673e196bdb69fc68b3f636139059902

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

Filesize
24KB

MD5
b82ca47ee5d42100e589bdd94e57936e

SHA1
0dad0cd7d0472248b9b409b02122d13bab513b4c

SHA256
d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d

SHA512
58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
41d96369ba66a8fc56a8f1b19d5e123a

SHA1
ab195e274f36f2c275a10cd8983f690622eb37a8

SHA256
cd24e7daa76a2c8b6c7fd8457b406837bab2a70d4b1c691320f858a4d5e29b94

SHA512
567f53ce08e887104338ec7cf158a290cd6db231a2581f9bd0d1361972a154e64c4768dfab7fd08d1eddaeab28ea0a2bfb1a94fc3b9f68634835f75fd6b62883

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0573f65a7e054ca8b432dab5f5835c9f

SHA1
893fcb8f2027a89362cfc2b60f796a90b1af88e6

SHA256
126184b2f525f8be5ebad96431a5354e8deada07acbf46945afc71ca64eb9e2b

SHA512
89a78b3ace56bbfe95419f6445f51e86b5ef069ed7fb746f1f6adcb9839e01aca6b2b4969b264fa511300d1d07ff0819c96a73da98713652d0fad782696bdf16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4b4e268caf54b4a04460896f701af97e

SHA1
429a0b610311c6e73df32e881beeead88d5ccc3c

SHA256
1e5594082e08885ba4a5ac7f10743fb0d55896b626213f00783a006e5f5e7e65

SHA512
b9a5f54188b58938e523dbba1efcc65476f542b3f3b45792c2ccbf953853f7d01700de69b57bf0a6475e1e32e28a6a199c680e7659fd8670419f6b64e9ba1a60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
26ee6ab89b6233f6b95723349e2f935a

SHA1
c9b5002a5b861321277089ab7896e44045b71f78

SHA256
8880af60727f2ffef34497d482d1f8ca3c9330bf510d89425dd0d55315162774

SHA512
4bed711324cee809e7f6c2fe189c3a6a859dae22247eeee103fae6e8720a9fb3201bf6239d92cb437360ba29c07b33ef02e45e3b0dc047b72547a568f7bfe39a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b49c8768f4ff5d34c78bae635acd2236

SHA1
eae8690a73d0e1a86a057b372b78fea82445d93b

SHA256
697e0cdaf2e758b9ead14cc3c0685257707aea76984e364152edf2862b4b3717

SHA512
860506e8ddccf2d638b1a64876d0dfb6fbaad0a6ed85beaa92eac37ba3c97272b3d6f6a4bcf7a13d6d82e0f3879f2b07f0a86b9b2429b8528c839c735b91b3e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6355692522ab145fd8d24f1ebda925e1

SHA1
c371a6239043923c7685d88e6fb4484fabaed93b

SHA256
d8737571b51dd5002fd5f6c3dfd6cbcaf25fc0a8355eab9e697f6bffc60f37fb

SHA512
62e0d896d4e062ebd8f7c2571848e084ca9f3318797bbec127ba4d59d187448fbc4d6b7979cb4e7e5e23d5f07a89cdfe116d82dc05da2d049c9f7303458a367d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4ee7d27c2f25dc190575082247c09e7e

SHA1
8eef6489545afaa57316d1ee876de3a9c7b9a712

SHA256
ad46278770d1fd1ffb74654bc3e41cd304af4abd1aa824ec33f12be0c51194d1

SHA512
9672bfd707ffe456847ecb3adf51653031189078efb2e0a82852c325e1e42996bcc526add8672b1c8196302301fd7527ab8fa36b90cf3d5f2e952fe4c88521cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
871B

MD5
c713f20466a53201b1ee0b2df21a43e0

SHA1
b0647c737e757bfec376c92781b335de7c00a819

SHA256
41e4a17cb44630a8126c69685bdedc15970eecad6d11d3dcc3989dfdca82a5c3

SHA512
c11650bb84a0c3c7db00c1c5402f4fb4005809163ebdf129d6668bfd0005b5ff3b60522079a4aae81da0e17fbfee919fab3fdd978a91636084e6158bb85ef951

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
38847f0ffca7b64348434fad9bf8d5a9

SHA1
dd55a49592ca95aa8d07eb727b820464edd24e0e

SHA256
dbce04dfb0a17dc2970c4b51036abefbd6257233f4b98e32807a9d9d2f6f46e9

SHA512
87092110a50bada9617ccd3e88fb1d1ab6fe7fd7c8128f30950aa592c7dcc9c2e8dcb996d38bba205b4b10b418be98c7cc5e81e3e2104099b15e60758c2c7d0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
aacbb5bc68835468566e3cc8b07caa20

SHA1
3c0aff0658d47207f254f0e83694e360fb977d36

SHA256
62aa2aa31f02b7f70789354db9078baaa9c69611880345c7af439e73b9cfb22d

SHA512
512e8372f541652095ceb3422cda08ec00f6ed1f645eb499e77e34501d0520ec2f2dbc0f628bc860e3438926ffd59b55c4ab3db50fad3ecbb0238a93a8d265c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
b2358e3081129d8e74b1fbac8f053816

SHA1
247d16090fb79c052cbc769826d3a05d68b55e30

SHA256
1dbad521e08ea0676f0d6752d83accfc5d849c67eec2ee63a422afb66dae22a8

SHA512
d96a9050ded9b28f2410e445cfe5655a40ce84783665673cc20aa363e17c0d282b9a493d04ad45ba3914cb383b64f7650512445ebc24104783b65a081ff7f7be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
5c8bdd9d044cd2133940b84672485874

SHA1
708a46b3db65d01812b94ffa2fd25ca9a5fd64e4

SHA256
589d7c42627ef2890e492b01b35098b96ffb510965a23f8c37ead04aa640bf98

SHA512
19f6f67501813c7d527a737bc309d3edba16ca3e3ca20784237adbde7daabb878125dcc97e75c4ad9779780e1d16f5a2d6ba0767bb5cdff99a40cfc62b974640

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
2f5ee6811a6cfa6e1941fcf3628e9f2c

SHA1
e543f4a3059280125eba59e405059e94692f3175

SHA256
2dea2de37579855745ff18bcf4a0ef73cf2574b83f8726e5f904321faa4a9cec

SHA512
254ed7ff50e7874a78737f25a48cc3fe50db83ba4a1fc62078d30189cb936e54b0cb8e235b640a6a220c134af8f5cf1276636146dc6516409526411e6dcd3ee5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
ee93c2e7f12eb339c33caef8d40547ce

SHA1
9362bd5cff1defb89e0fbe665cae36837a8be8a1

SHA256
76a68ce53d01194c99839ee700f7c6b26229648979dffe709ceaaeac02bc7e9b

SHA512
e29fe88c938696671a5749d1f4b543872bd2b0704e01a7cee68d09ffcfab1d7d2c65d50432fc880cd2feb31583d8e0f4b9d75e97e275b8ecc2908b3665467e34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
a25752fd5248af5cb4f670d4bb0e1325

SHA1
9a1dda980aa54a9d15922c1eaab284971f02bfb9

SHA256
20192f3e0e012faa1f61257aa863d513a1f78910dc92f957af0c803761bae768

SHA512
0b11d9ff5eda6aa35470fc73ddc152405b75c0e439b2bb868c73be673123b672b0ebd4e6bc2cd937384855ea40522ccab2c08b4c052d021be77ef0e175837635

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
10cf1eb53d6be607b6e2e57469d1e9a4

SHA1
7dc43dea6d6db25ad90feb39af2d3f80d8843680

SHA256
d6e674291ca4b88caca7255bcfb880bbf0684223b12c2f937d828347c9788f63

SHA512
69b46af9a694d05edde407411fd63f07deb9028b855a1a7a4c000abe99d22cca01f0f9f58f33193e1fdd4a5373a5089c7b8adc9a19fa43f33e4ba5629e73d5e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ce9a0ca80a89d98fe7bbe74b2f7ab3b6

SHA1
2b875720761d56e22107e4ef2fe1b6014c5128b4

SHA256
aa3cce683381c7c876fada13ba8cb9df5004ab305f490ef4992f649657fed1bc

SHA512
08094d1975441cf3137877faa94231025a95caec69403cbebae59e143fe1cd1f18ca2bfb9675596db1af01ef501521e74e24a36628f6f94bfa4fcb3216b8b58f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8ad7f29947b4e24964c5f8deb04b7b33

SHA1
425e4b4c3baaa68e934dc22a0fc9de9f947194f2

SHA256
bf92c18a0ba61746b821427c64305085216ceb030e32a467333ebe1a23295a34

SHA512
1ba850fe13d2d62441248a721f3f39f900318fb5b911e02874a7a0cc45f3ca83389f53de6965995b5dba0282d44ff2359393c49214035d9e458e9008d10df700

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f74992510db86524f7bf6a8d9a2c5372

SHA1
ea9807fdbdeead85c38dbffed218b4fc697b5b6b

SHA256
697beb4f1828f3e16833c0e8ab6ece3e7845f0515c52f94008cfb16718c5f486

SHA512
0d942febd75c90fcfb7d747da23cc784d633e9c9d1627f720a4d4d6a163170e51b631be2f137134672af83ea26f39d2aa07c9a4a3446f5598b1b1716f4ca4a20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
190fc53eb23cf9b45e05280ff0ba5e40

SHA1
718c1fb1ca08ed1b7502bb1aaf90c2f3ff085725

SHA256
b57c7050d0c50b9ff4181a9f70523b956b6b495266a7cce963d02f1ca8bcfba4

SHA512
cd5eb25995eea3c8669080f32924997c9fb442f996be712661eea61b9e4e73694cad42c1b4fa014b89e9f037e84489b8ebcbbee8c8502607bb8dbc0a836b7117

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b3913f63cc7c6844b85704b0d725aad7

SHA1
443e735fb417eb772bd9dd9df3916db5712f2cd6

SHA256
521f5849ab850d95dd9ddfe0070d4f9369ce41a037d659ec295661f9d516aaf4

SHA512
0277f0ba57efcd14c619419355a27c2ccf4ceabb6c3a8d2fa6453682db73cce790bb07f74146955b56f78fd723a9b290821847eca3d4d472bb86a5ab0ee55f8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
f8dc27d1c4539de962b7af68e2cfb9ea

SHA1
4419c0b1b7b952ce32f409954adabee30c7bce93

SHA256
9387f96daf3e6ee9801e4609434ed5c2e75b7806840fb2253a4fc38dc3943c96

SHA512
61d3f32fa2a5a9e26273e82de8ea72db51f57470e615680b1ad0fa9bdec0b10c89fe73b5670a74d16df265930325092216085c13e10a551da5d2e023bf2e1772

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
bb3caddc7745752a6a57a7dc256261d3

SHA1
dc34ea250b91e46d3e2fc7bfa6ff3bf0f3e3d0ef

SHA256
01e7fc091d3b54a4d070ef415c6e6c28f268b0cd832b6b4e05c492f8a0cb71d5

SHA512
961d9ab3e77c4b512b28f6a1c91a6ac84fe64cf35c31755f0429aa5504a242d3dcd94b7ee187f3e5bb9fdc0f6974b1b4d6feedfe7c790ca7909d1d568fff0a3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
ad8c09612ff1178a8077e6730d7ef948

SHA1
d3c635766eb9a2c42d04d7f48cb0ae66039cff29

SHA256
4ad5a23cc7c0aa998325115fcb8cddf3de51ad757512452ca39c36ed8df7865a

SHA512
e511a12db4b1539de008f9ae3d445d1a3b155c4feedb287b40696a01d84a50e3cef3d86fab6e10c7ee7e9f37a4f4d2d2d989b192e0861ebd532f715d21f3d7a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
ced5b77a1b603a6b12340187e0ab3779

SHA1
70980bd57713792cac58e7e0895b91f508dd610f

SHA256
c94db88694170142c4b37d77bcc0ece8d946905e68292f090b2b6838016543c8

SHA512
93e195a5e92ea716957852ff90858efc5070a46b46e101fe71226e7cd519b224d7125e5a29b9b37ab012a26d097703135649f6ef8ee02f353de706f8a0b15401

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f1db9643850a64dd89c5a41e84edcb72

SHA1
edcf8e88219255d94b629bcf03bc8b87168239ba

SHA256
1f91c6ab754fb8e55fd373de12dfb1a89dfebfb00f79d59815e13f1b015fe24a

SHA512
27221dbb76438b52cad518b5edc219928033ebb1195e576615749111df63a7e5b8337eaefae41d03b763c74b3bad29e5468d1420771d20fdd0051e5be0e779e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
7b5ecb7ee5e61b472e75e235c491c09d

SHA1
b324413d36a6c6db7d3ab34ea764e7832fe9bb86

SHA256
3325e55c05b91753d9462a9b68591a7cdfc95ce15fdaf6fc13918521d85c47a9

SHA512
dc55d4d35ef2f007cbdcbfc11f3165bb8236e97ebd7e1953601e297a8765594464b3f4d84ed5a5ce03ea7616299b188533a4941257ab0ce27b35b002402c2bf0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
86656d21e3a1ad92d9ab65f88dc0729e

SHA1
85457a1b8fd2b517ee182537c753ed0daa8d39f2

SHA256
bcc7db1c0083473df9fcbbf5a8e6324a618e534d8d514085f9f9159b553f3601

SHA512
9e2fc3e72cb110e348b5009c7330f389b9737ec690f383031721a741a55156502d19439baca1b9109530d644a71cdd437acbc60694eec1e16d58cdea83961984

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\55dd229f45b2580be81f90228cc8cb5a4c3003c3\5ddc0add-bd0f-4399-8199-e0a0c781a61f\index-dir\the-real-index

Filesize
1KB

MD5
86db7797da67fe7744e3bbe53c1a79cd

SHA1
0c5b56cf86e8f574426bb7e76d28808e54533200

SHA256
614909a9cc71a73289f855c00e44737acd78f42577486e928084c34d465b74eb

SHA512
0d165c1e405802b44f747965526da41cac0c48a38432cd63f237acde06deab2e52d358179468badff0aac5624afc7014850fbc5714c80670a15a3ecadf374bbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\55dd229f45b2580be81f90228cc8cb5a4c3003c3\5ddc0add-bd0f-4399-8199-e0a0c781a61f\index-dir\the-real-index~RFe5fa764.TMP

Filesize
48B

MD5
149bafa139f1b09a2a411288b4de3892

SHA1
e6010a904bbb41727646e2540e66b48826b62c0a

SHA256
3f85a27a64ac08a7e2656072427ee1af49996a43d8ea7f74b346283045cb5478

SHA512
fccb4c52509febf935cef1513eaa83c27fca28b996e59857fb7d7dc0821fc838e8baceb27fa2b742d84de091b5be5afb7464e51a2e7cabaf41df5a3876201112

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\55dd229f45b2580be81f90228cc8cb5a4c3003c3\index.txt

Filesize
130B

MD5
145918a7c6d7ad974d0f8393cd5e96a0

SHA1
39d449e247e613c16114afc695da8aba2be93fbd

SHA256
e240d43d543858c27eefbecc1ae8d297adfdf9192939052afcc22fe861d040c2

SHA512
4467ab8b76d9eabefdc5c522020217a77898c6d4af95aa2ca38c78e64c8dae505757877ef46c483689e968b7cb8c44f686f2d18ec832e24f411e461590af244b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\55dd229f45b2580be81f90228cc8cb5a4c3003c3\index.txt~RFe5fa7a3.TMP

Filesize
134B

MD5
ecb641b5476c62967058cc70d1429662

SHA1
027e5bd568c56f1594dd55ef8aa6d9f46fd5ff5e

SHA256
f3a1149b5d5b411ec11839fc69f7003313d345907bbde181cac41c276be4a6f4

SHA512
a114f90c38552282db3598722e78d63c6aae77dcd7164f3fc466ea299118c25310e250ad3c442074d9e17a6d176d64b622a7d4fc5e38f429facb1298486ae758

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
62ea6f7f099ca158a56ddd8b6b2cdbcd

SHA1
1bdf03631993b74c2a0b6378419f4fd8d09e5c63

SHA256
b2845149b96b8da3ffb3903e28fac9f0e486b144780526ff900c5210a1ba0c32

SHA512
f2c0f0863dd4eaf5212c6f47e64abc73ca32f0391d14a3d20cf819eed84c097c4e99f0f222370f50d8a76b182ba93ba2b2bff085e67b52b4112d342324c9c1b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f9757.TMP

Filesize
48B

MD5
db501250f2f5cff1e48a4302fd7b4de6

SHA1
83fc8b8570ae46eed6830ebe7603a2f8837d797e

SHA256
f083985025d5fa4090a96e310e6471dbca22eda374437410bd866677d0b97755

SHA512
0093ee96428a814bc188c9cbf0e55b0e2a9e847ed1f70af6cec452a6192900a4b5316e8a72b512ac2655efa0f0c73993043b5d8cdfa625ed07359d95343808d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
e85625a0c6ab3929ab31398b10715424

SHA1
c3c33be6d5887e65e28cd3cacadc73dacf4b9dea

SHA256
47410e47e945042b686f013cdf84ec7ecab208b59217f31b11f4e687225308b2

SHA512
b66499cf6793fef3c6dc7aef653681cae048da39a4aac6c4de001597573ecc018b4cf89036cde368eae43537bca16998046c5fdca2a7d037daac8a34b44c7bab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
c0e0bdb5a519f3397196885540e151ba

SHA1
4530fb399444f9858c6cdd4d094926d09f972cea

SHA256
1f4fdb3accb5d3cdca63ccbbf4d81e0dd8c916abbbb7b2a9e290f656a12afb0d

SHA512
b2273366a1146b08b67cf2d5e4e5e850e4c1aa65ad34484601d595e6c3250639da4a56fe78face75d98d332e363d87a7a1e29ddbff0de6d39532fd1a9cc207ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
117KB

MD5
31f2cca61561a15459b581989be8ad6f

SHA1
1ecaf61a73cb6e4f2e5736c69cbe1d074124aeb3

SHA256
0bae507b98331aed538cba4f2ad8a03754d3649a07c5298d662ad2534604c5f4

SHA512
6fc461c3ef55ae64e704f6793bfd07027688ec699e9af0c229aef6e56b22150e1e3bf9d748f93e171c37f73ad77a0bc14c3326f272ede30b628045d24ab6b62b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
118KB

MD5
a2f294b692372fe3815b6010ba3e482b

SHA1
4e3ac09404ab7e51e75eeb71244d8bb16fa92b76

SHA256
261f9ab083741abb96ab2f540bf5a8935bf7d1d0ed45311db7f384c99392fece

SHA512
2c3e842ece644698465c9ad1a0833baa43ddcb0e1411dfb22ead9ae501e3da2c4f53934685066a158b8b043fc96dfc04f329e196a0472df6c6143087f648b2e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59d8e2.TMP

Filesize
107KB

MD5
9f58ba01aac08d5e15e72f0df5650a06

SHA1
ad8c5009fa995116d1c6d05cb54f3c79b589891a

SHA256
597cb052fe4c1edb074f386e200c3a484bf091d59daee9c40fde43b6c6c48af5

SHA512
a2f38f9ae081877be75e3f0627c5f56b01a5d81a25f8abd0147ec8086430b4e1ccfd5a8c6257c0c929a66c36c57d2b35a3aada1c2943653b1c548f358e61e247

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f7fbd782-2f36-4c99-8594-a8f126faf5ac.tmp

Filesize
128KB

MD5
f00453d5d4a7b1ebaf3028b871a05e62

SHA1
15ec6f0ca84716180093136fee800f77c6444d99

SHA256
ff4f5946ebefd8bf4f6768ebe6d77de115d338f19f26ab1eed4f8f603bef70fb

SHA512
b8e7953f31bb6ecdaddcba6997aa9fd96fdf689751872fb403d8c1bd2fddbe3dc5b820fff9bd8aa487affdf698249ae6e6661d55e559543c70b4202302910382

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
5c3cc3c6ae2c1e0b92b502859ce79d0c

SHA1
bde46d0f91ad780ce5cba924f8d9f4c175c5b83d

SHA256
5a48860ad5bdf15d7a241aa16124163ec48adc0f0af758e43561ac07e4f163b2

SHA512
269b79931df92c30741c9a42a013cb24935887272ed8077653f0b6525793da52c5004c70329d8e0e7b2776fc1aba6e32da5dadf237ae42f7398fdf35a930663e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
ab13b757b4bcd48bd1bdb7b483505495

SHA1
9397e76f73aad79d05e86f7a9f075bd6a1ec570a

SHA256
f7eef16878d0808231b3e9f0ba7593eac4afd546e6138bee1e4dcb26fd7c7d98

SHA512
148b322cde0708a838688a7d856aea3ffbac6bab7ca369a0e5f764ed05e6bc13e3dcfd9d66c2284af14ae8e0312f86b970c6efee4482065d9517be031585f76a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
453b0833cceafedb493813d450536f3d

SHA1
8d182a668eac53574c74ca964f2c88dc23d6030c

SHA256
65636415aecfc59f45fbca3abf79e57c53e120a8d9099a6b7f9c066f11af67af

SHA512
68454de814c652972b76bfedff247a089affd8ea0a5d870b10a5eb1fb8752d2928a4f7104822a95101aa4100bc4acdcbab87e8a6c518cd9a28a1f1eec8e00049

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
2f87410b0d834a14ceff69e18946d066

SHA1
f2ec80550202d493db61806693439a57b76634f3

SHA256
5422bc17b852ad463110de0db9b59ffa4219e065d3e2843618d6ebbd14273c65

SHA512
a313702f22450ceff0a1d7f890b0c16cf667dbcd668dbafa6dbecd0791236c0bc68e834d12113cc75352365c2a2b6cfcf30b6ef7c97ea53ed135da50de389db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
0eeaed65f885e95e24e85914afec3820

SHA1
d1d022be01bc4aed0b7ae39dd8a8c23d785c61ed

SHA256
064f0654256ec17db8c0f1e5b171b7370a12e5c02428721bc27d7d75b324dd7f

SHA512
cb606dfbac0945185f11917e3e3d17876a2d64820083dc362b70e8e48b1519af6fb3b055d966d369c408c951be43b7b48fed8df1b88245b837fb527c9506b21d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tl1ewmsl.1em.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\lilith-launcher-windows-s3.exe

Filesize
6.4MB

MD5
888b418deba43641f6f12217d4cc3a10

SHA1
01f76792e995b2eff93c07387888049e9a627514

SHA256
b0b5ae1b1dddb8ad9ecaa6521d007d5dcc4a313541a5f74f4c2ddf6994aaea2f

SHA512
4146becad7e17260f9cb74cddc0fdb8ce48d40c02dd7ea37190e03f7167009abef4d76c460ae79adc211228f6bec234eeefe25cb1dc0c0bfe4edf6883829e493

Download Submit
C:\Users\Admin\LilithLauncher\lilith-win-1-0-36.exe

Filesize
97.3MB

MD5
c8a9624b05c2b433ddeea3e898a78d5b

SHA1
1298c825b5642b479212e0d7c0463a47b3d540a1

SHA256
fa53c51bd31bf9a154ce4d4c8fdcc07aec56c74880f0a9447bc97df04277e9ba

SHA512
35c8860a26899e06325e07f7d9670520de326a5e5b2b81f7b418ab3d641dbb71b5726aac82bca76a44e81e2a3e7048030ca4adcbf6a54ddfca1eadc5df7c7b42

Download Submit
C:\Users\Admin\lilith\lilith.log

Filesize
655B

MD5
44be41bbbbb0b4ecca2420eaf2750c75

SHA1
f21081c95ac4a2f52c4c657da435bd5c8aecf1bd

SHA256
8cca4467caa4d69746bf31cc3097443c57b4ceb49bf8e803a291480e5f76f946

SHA512
658b0c758eb07c4b51f1c3c8aec4cc8bf3817c4362854ae355baf71b34e3599f6497ba5b07d59d18f938e4c1861dfa5a7606870015317950aa0215c04c5771e2

Download Submit
C:\Users\Admin\lilith\lilith.log

Filesize
325B

MD5
f33331d349a2712c6ea89db5044f147a

SHA1
cf0cb3aa1411945394c6f1b5da49d55a2244cd5b

SHA256
7d139364634fd3bbfece073a0f344aa3e2c22ed4bac3f040be8657be69ce318f

SHA512
aa14dd8f09d525169be837b3dd1070d5118676c0bfb55c78d6f56abb66b45205e465f8568b9ed5c84f5b2c01d894baea265fa0c3201715673b7854da41091b91

Download Submit
C:\Users\Admin\lilith\lilith.log

Filesize
435B

MD5
1877a3562e23c7e2b870204c5d0aaa8f

SHA1
3fe0b325d0329e37ceddabbccb888c9cb2e60a07

SHA256
97f727743ea737a090fb5041b10c6f0bc800e988fb978d2159d0e805d469b8ca

SHA512
1601fbdc8e8f973b88d21cca0aa26504de7701edd3ed0c60ba593804d9959deb21591fb1ec027f635e4731c8681f36e101927ae5127788f49b5832d517c24873

Download Submit
C:\Users\Admin\lilith\lilith.log

Filesize
545B

MD5
6d2864cd5416f2f483ffb4c480c82152

SHA1
a7bfd412a4247be183b3b9474849fc1c3a3eaacf

SHA256
773c6d3b6136cd8e923a6432606c5f685d19c327448529cb5ba74c9b1b01911c

SHA512
942be7e8b7134e1c14227f6939860dffe209bef89453981a9d4d0a978156117e7704b298b7dd75bdb15083b6df069dc5c74dc1cdbf3868d3c1089796f61db828

Download Submit
C:\Users\Admin\lilith\store.json

Filesize
2KB

MD5
840ef170f890cc86d05aed6f03d9b5d9

SHA1
24e66206bd5fd23fa88015a3efd10ff8e2c67f25

SHA256
002a7ad334c37af91eb0106d89a50885f2db05709a52ccae57c9320d32eac73d

SHA512
645b78a8edec759e05e6c71b649096f48d07286d2b98e476474e325bb85c28f883f20d99399d12dd152f7f0764d41bbf0e69eb9a1e2d66329350bb5c6eff0761

Download Submit
memory/1432-1078-0x0000024FC2510000-0x0000024FC2520000-memory.dmp

Filesize
64KB

Download
memory/1432-1076-0x00007FF97D230000-0x00007FF97DCF1000-memory.dmp

Filesize
10.8MB

Download
memory/1432-1085-0x00007FF97D230000-0x00007FF97DCF1000-memory.dmp

Filesize
10.8MB

Download
memory/1432-1082-0x0000024FC2510000-0x0000024FC2520000-memory.dmp

Filesize
64KB

Download
memory/1432-1079-0x0000024FC2510000-0x0000024FC2520000-memory.dmp

Filesize
64KB

Download
memory/1488-1145-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Filesize
4KB

Download
memory/1488-1152-0x0000025F4DF00000-0x0000025F4DF01000-memory.dmp

Filesize
4KB

Download
memory/1488-1174-0x0000025F4E140000-0x0000025F4E141000-memory.dmp

Filesize
4KB

Download
memory/1488-1173-0x0000025F4E030000-0x0000025F4E031000-memory.dmp

Filesize
4KB

Download
memory/1488-1172-0x0000025F4E030000-0x0000025F4E031000-memory.dmp

Filesize
4KB

Download
memory/1488-1170-0x0000025F4E020000-0x0000025F4E021000-memory.dmp

Filesize
4KB

Download
memory/1488-1158-0x0000025F455E0000-0x0000025F455E1000-memory.dmp

Filesize
4KB

Download
memory/1488-1155-0x0000025F4DEF0000-0x0000025F4DEF1000-memory.dmp

Filesize
4KB

Download
memory/1488-1122-0x0000025F45D40000-0x0000025F45D50000-memory.dmp

Filesize
64KB

Download
memory/1488-1150-0x0000025F4DEF0000-0x0000025F4DEF1000-memory.dmp

Filesize
4KB

Download
memory/1488-1149-0x0000025F4DF00000-0x0000025F4DF01000-memory.dmp

Filesize
4KB

Download
memory/1488-1148-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Filesize
4KB

Download
memory/1488-1147-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Filesize
4KB

Download
memory/1488-1146-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Filesize
4KB

Download
memory/1488-1144-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Filesize
4KB

Download
memory/1488-1106-0x0000025F45C40000-0x0000025F45C50000-memory.dmp

Filesize
64KB

Download
memory/1488-1143-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Filesize
4KB

Download
memory/1488-1142-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Filesize
4KB

Download
memory/1488-1141-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Filesize
4KB

Download
memory/1488-1140-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Filesize
4KB

Download
memory/1488-1139-0x0000025F4E2C0000-0x0000025F4E2C1000-memory.dmp

Filesize
4KB

Download
memory/1488-1138-0x0000025F4E2A0000-0x0000025F4E2A1000-memory.dmp

Filesize
4KB

Download
memory/2188-169-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/2188-167-0x00000113F2CA0000-0x00000113F2CB0000-memory.dmp

Filesize
64KB

Download
memory/2188-152-0x00000113F2CA0000-0x00000113F2CB0000-memory.dmp

Filesize
64KB

Download
memory/2188-153-0x00000113F2CA0000-0x00000113F2CB0000-memory.dmp

Filesize
64KB

Download
memory/2188-151-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/2204-1006-0x0000016FC3740000-0x0000016FC3750000-memory.dmp

Filesize
64KB

Download
memory/2204-1018-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/2204-1015-0x0000016FC3740000-0x0000016FC3750000-memory.dmp

Filesize
64KB

Download
memory/2204-1007-0x0000016FC3740000-0x0000016FC3750000-memory.dmp

Filesize
64KB

Download
memory/2204-1000-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/4152-454-0x0000017F1B850000-0x0000017F1B860000-memory.dmp

Filesize
64KB

Download
memory/4152-536-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/4152-453-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/4152-455-0x0000017F1B850000-0x0000017F1B860000-memory.dmp

Filesize
64KB

Download
memory/4508-135-0x00000280F0710000-0x00000280F0734000-memory.dmp

Filesize
144KB

Download
memory/4508-139-0x00000280F0600000-0x00000280F0610000-memory.dmp

Filesize
64KB

Download
memory/4508-140-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Filesize
10.8MB

Download
memory/4508-134-0x00000280F0710000-0x00000280F073A000-memory.dmp

Filesize
168KB

Download
memory/4508-124-0x00000280F0600000-0x00000280F0610000-memory.dmp

Filesize
64KB

Download
memory/4508-122-0x00000280F04F0000-0x00000280F0512000-memory.dmp

Filesize
136KB

Download
memory/4508-131-0x00000280F0790000-0x00000280F0806000-memory.dmp

Filesize
472KB

Download
memory/4508-130-0x00000280F0570000-0x00000280F05B4000-memory.dmp

Filesize
272KB

Download
memory/4508-125-0x00000280F0600000-0x00000280F0610000-memory.dmp

Filesize
64KB

Download
memory/4508-123-0x00007FF97CC00000-0x00007FF97D6C1000-memory.dmp

Filesize
10.8MB

Download