sheetrat | hxxps://github[.]com/nagasaikiran010/Ultimate-RAT-Collection-yuankong666/tree/main/LiberiumRat/Liberium%201[.]8

Analysis

geolocation tags

brbrazilsouth-america
user interaction
yes
max time kernel
899s
max time network
758s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 03:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/nagasaikiran010/Ultimate-RAT-Collection-yuankong666/tree/main/LiberiumRat/Liberium%201.8
Sample261024-dqqtrahv2m

Score

10^/10

defense_evasion discovery sheetrat persistence ransomware trojan

Malware Config

Extracted

Family

sheetrat

Version

Attributes

localhost
127.0.0.1:7777

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/files/0x000b00000001c7f5-1636.dat	family_sheetrat_v1

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/files/0x0004000000016aee-1645.dat	family_sheetrat_v4
behavioral1/memory/1964-1647-0x0000000000E10000-0x0000000000E8A000-memory.dmp	family_sheetrat_v4

Executes dropped EXE 2 IoCs

pid	Process
3232	Server.exe
1964	jei2dlw3wwl95sly.exe

Loads dropped DLL 12 IoCs

pid	Process
3232	Server.exe
3232	Server.exe
3232	Server.exe
3232	Server.exe
3232	Server.exe
3232	Server.exe
3232	Server.exe
3232	Server.exe
3232	Server.exe
3232	Server.exe
3232	Server.exe
3232	Server.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
112	raw.githubusercontent.com
113	raw.githubusercontent.com
114	raw.githubusercontent.com
115	raw.githubusercontent.com
48	raw.githubusercontent.com
49	raw.githubusercontent.com
52	raw.githubusercontent.com
58	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jei2dlw3wwl95sly.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jei2dlw3wwl95sly.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4720	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Control Panel\Colors	Server.exe

Modifies registry class 63 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	Server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Server.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	Server.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	Server.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{27A404BB-11CD-46B5-9047-A08EBE860DED}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Downloads"	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Server.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Server.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3232	Server.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	5364	7zG.exe
Token: 35	5364	7zG.exe
Token: SeSecurityPrivilege	5364	7zG.exe
Token: SeSecurityPrivilege	5364	7zG.exe
Token: SeDebugPrivilege	1964	jei2dlw3wwl95sly.exe
Token: SeIncBasePriorityPrivilege	1964	jei2dlw3wwl95sly.exe
Token: SeDebugPrivilege	3232	Server.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
5364	7zG.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3232	Server.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 4640	2564	msedge.exe	89
PID 2564 wrote to memory of 4720	2564	msedge.exe	90
PID 2564 wrote to memory of 5076	2564	msedge.exe	91
PID 2564 wrote to memory of 5076	2564	msedge.exe	91
PID 2564 wrote to memory of 5076	2564	msedge.exe	91
PID 2564 wrote to memory of 4400	2564	msedge.exe	92
PID 2564 wrote to memory of 4400	2564	msedge.exe	92
PID 2564 wrote to memory of 5072	2564	msedge.exe	93
PID 2564 wrote to memory of 3736	2564	msedge.exe	94
PID 2564 wrote to memory of 5072	2564	msedge.exe	93
PID 2564 wrote to memory of 5072	2564	msedge.exe	93
PID 2564 wrote to memory of 3736	2564	msedge.exe	94
PID 2564 wrote to memory of 3736	2564	msedge.exe	94
PID 2564 wrote to memory of 3348	2564	msedge.exe	96
PID 2564 wrote to memory of 3348	2564	msedge.exe	96
PID 2564 wrote to memory of 3348	2564	msedge.exe	96
PID 2564 wrote to memory of 3100	2564	msedge.exe	97
PID 2564 wrote to memory of 3100	2564	msedge.exe	97
PID 2564 wrote to memory of 3100	2564	msedge.exe	97
PID 2564 wrote to memory of 2464	2564	msedge.exe	99
PID 2564 wrote to memory of 2464	2564	msedge.exe	99
PID 2564 wrote to memory of 4856	2564	msedge.exe	100
PID 2564 wrote to memory of 4856	2564	msedge.exe	100
PID 2564 wrote to memory of 1476	2564	msedge.exe	102
PID 2564 wrote to memory of 848	2564	msedge.exe	106
PID 2564 wrote to memory of 3680	2564	msedge.exe	107
PID 2564 wrote to memory of 3108	2564	msedge.exe	108
PID 2564 wrote to memory of 4636	2564	msedge.exe	109
PID 2564 wrote to memory of 4636	2564	msedge.exe	109
PID 2564 wrote to memory of 1088	2564	msedge.exe	111
PID 2564 wrote to memory of 4464	2564	msedge.exe	112
PID 2564 wrote to memory of 4464	2564	msedge.exe	112
PID 2564 wrote to memory of 3908	2564	msedge.exe	113
PID 2564 wrote to memory of 3908	2564	msedge.exe	113
PID 2564 wrote to memory of 3908	2564	msedge.exe	113
PID 2564 wrote to memory of 5800	2564	msedge.exe	114
PID 2564 wrote to memory of 2064	2564	msedge.exe	119
PID 2564 wrote to memory of 2064	2564	msedge.exe	119
PID 2564 wrote to memory of 4880	2564	msedge.exe	120
PID 2564 wrote to memory of 4880	2564	msedge.exe	120
PID 2564 wrote to memory of 2148	2564	msedge.exe	121
PID 2564 wrote to memory of 2148	2564	msedge.exe	121
PID 2564 wrote to memory of 5328	2564	msedge.exe	124
PID 2564 wrote to memory of 5328	2564	msedge.exe	124
PID 2564 wrote to memory of 2760	2564	msedge.exe	125
PID 2564 wrote to memory of 2760	2564	msedge.exe	125
PID 2564 wrote to memory of 2200	2564	msedge.exe	126
PID 2564 wrote to memory of 2200	2564	msedge.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/nagasaikiran010/Ultimate-RAT-Collection-yuankong666/tree/main/LiberiumRat/Liberium%201.8
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffe1596c188,0x7ffe1596c194,0x7ffe1596c1a0
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,1042765970635436568,16480359222088721659,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,11948823952307593297,13775691955394915814,262144 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,12725551070520121318,747999335655751629,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:13
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,841867968511624537,582403543835384307,2097152 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,12999866901634055160,12063263629598989257,2097152 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,18207569078848871162,12055264600633242647,2097152 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,1277800935561871656,3883795394759280374,2097152 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:9
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,15252628111390793572,50747788044432,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,8467115342682028438,6066177508449415626,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,7033576859116543654,9187850656601871085,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,7033576859116543654,9187850656601871085,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,12059773550315203846,2052536220434983240,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,10158499277558322438,11123521161608564420,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,7738164937995281497,2914472769456574431,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3220,i,7476905402368955472,12982540860325810772,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5456,i,2065253333337567158,8589281704405585271,262144 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,9131386722954773317,9759021886709259362,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5444,i,2949442047245071134,18126832043283329709,2097152 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,15923090989091450876,12635766876360343798,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,11784880828219975342,6198638308671779590,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,13774801386983345976,13033470182918467032,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,18253274348869657782,9056378113357733084,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,14026577376275372690,17551451472199003852,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,18099065800911165287,15273983901484363156,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,3248966966053173482,9982422797888125473,524288 --field-trial-handle=2220,i,7148975567414269209,13147979356595803783,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
  2⤵
  PID:2200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3980

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Liberium 1.8\" -spe -an -ai#7zMap30838:84:7zEvent20621
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5364

C:\Users\Admin\Downloads\Liberium 1.8\Server.exe
"C:\Users\Admin\Downloads\Liberium 1.8\Server.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3232

C:\Users\Admin\Downloads\jei2dlw3wwl95sly.exe
"C:\Users\Admin\Downloads\jei2dlw3wwl95sly.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4376

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

02490539-c2e0-4d88-87c4-6252c5efdb1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\02490539-c2e0-4d88-87c4-6252c5efdb1f.tmp
Size 41KB
SHA256 6957c5f5eb1b55352e5c3aafd7dd3c77fd2ba034181276ccbf6eb9275ae3e26e
MD5 153e7b5e6fd90ad7834eac04c5021f1b
SHA1 de24e2e3cadf3a1ab684254c02cb4aab814ee3e7
SHA512 55ab037a6c29057b498a34d67848a05ef6589f58b2a509e686c5b41c30fdf0ea3edfb162406e4b4765a74c7108e3c595d0f914b4a0b99cbe9f91daea742ac30d
SSDEEP 768:wFt33ywgN8o9TOfkfqSfJtqeJYe1ELsAvC8/YEH2Vyc1:633DfkfVfvYe1EQujYTVv1
TLSH
T1F2135BF298D78937DDAD9B47A37D2E02AEBCC113B4985A50B3C9250CCD871BFD20A855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

248d5d5b-28fb-423e-805b-30915726d727.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\248d5d5b-28fb-423e-805b-30915726d727.tmp
Size 41KB
SHA256 93e82f95a9b2b0fd620ca6b57bc7d88c139e8f676982e0d78df447cc1ff982fe
MD5 9e6bbe78352ce3454ecb040e9fe77bbc
SHA1 7311e637ed0b2aed3c8481d345aa950922e412bb
SHA512 eb057af81be7479b9bedbdc6f5e92e2245fe7be2d03cacd87eb0bd275fb97e39635fc18c13d44c2d73dc34825ae2135d729d29f44e837368980b046c3f88b89c
SSDEEP 768:wFd833wgd8o9TOfkfqSfJtvGJYe1ELsAvC8/YEH2Vyc1:083cfkfVfAYe1EQujYTVv1
TLSH
T134134BF298D78937DEAD9747A37D2E02AEBCC113B4985A50B3C9250CCD871BFD20A855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2bac713b-549b-430b-adf4-c55a285e39ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2bac713b-549b-430b-adf4-c55a285e39ce.tmp
Size 38KB
SHA256 3ab47da4dcbca05c6f2943f3954662e3e112787ef7ef9369adb03507c0e500cc
MD5 9ddf42c4e378010fa1fd942ca604fb2f
SHA1 d1b4ac4e28db5e4aa4a113e63546bc84d195137d
SHA512 893eb635c2af9c5fd2e3bc1610c03779f51660b2065f2dcee45894bdf60086e297e476c0eabc34dd4e63d324b0ef5981937ff3bce7cd4c4c32a94ce528640ecb
SSDEEP 768:1/UxvxjgC+i3FW9TOfkfqSfJtQyJYe1ELsAvC8/YNH2SHrkw:YZj3+i3HfkfVfdYe1EQujYkS4w
TLSH
T1FA03CF31ECA48C371EF2A699728A5B17EEF48113C1C46AA455DD2B0C05CB3BC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7243aa64-7a18-42d7-a253-b695c53b3b74.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7243aa64-7a18-42d7-a253-b695c53b3b74.tmp
Size 33KB
SHA256 692960d6c0b4043a817b37089f84d3dd84249dc82eeb3727f6d46a7d105d9103
MD5 6101c9d967e473d5f1c1336f5c686069
SHA1 6a26767168281e3117dc6cfe93dc9f464598614f
SHA512 2110fece56f7fbb182b8c8c8d93dcf319efe91a4806e3e54f3a5174629c3536f06d6b7ea66e0dea1baea69b5f11ab43b90b6c7eb3daf0ea005dfa6fca3919be6
SSDEEP 768:1a3Vko9TOfkfqSfJtryJYe1ELsAvC8/YEH2Vyc1:1a3SfkfVfYYe1EQujYTVv1
TLSH
T1C0F29D71ACA49D771EF19694B24A2B03FFB44213C5DC5B54D6CE2A0C41C76EC630F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d7e3c5d-7bca-4b52-bff4-c9a1321e8451.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7d7e3c5d-7bca-4b52-bff4-c9a1321e8451.tmp
Size 33KB
SHA256 928a3d94a8c8f8fb0e9c1cb502890ecbe3215537df63fed83c1c16a0a1d5ddea
MD5 cd8c6a36deadbec9097fa77a052eab68
SHA1 fa78f0a2ff98ca8563e287d05a721eda6d45c5d1
SHA512 ea47f2a57ab15718dc6857731c005fb44a065b19ec9b825570e05849d96f57f71f267b4f762449805a7d521c755e2e218092134fe18b7af3423d0ea09e430d74
SSDEEP 768:ha3kko9TOfkfqSfJtryJYe1ELsAvC8/YEH2Vyc1:ha3rfkfVfYYe1EQujYTVv1
TLSH
T124F29D71ACA89D771EF19694B24A2B03FFB44213C5DC5B54E6CE2A0C41C76EC630F86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95b03f02-99fd-482d-b754-4170df6b3b2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\95b03f02-99fd-482d-b754-4170df6b3b2d.tmp
Size 37KB
SHA256 5c7fdfcc15a5c7ec8ca6824cab34a0afb7793bed1b47b7fc92970e7de39428f3
MD5 87b62ed6f55bb70cb9b1aba54d0665da
SHA1 2350fbd85fb38041200c2d06ba369795183190b4
SHA512 8b17e2f10535f88c5c60eef2b803155cb6eacb25cf12080995c51b84a3c51d88bfc36495a21628c648701541a638d2587ba49bbfe31ba397b5d12a48695415a2
SSDEEP 768:h/UxvxjgC+i3Or9TOfkfqlKJYe1ELsAvC8/YMbDSHrkw:0Zj3+i3JfkfHYe1EQujYOS4w
TLSH
T13503C035ECA48D371EF2A688774A5717FEF4812394C46BA496DD2B0D05C72BC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1263e0b1-13e5-4692-80af-3eac76b4d399.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\1263e0b1-13e5-4692-80af-3eac76b4d399.tmp
Size 105KB
SHA256 fd5ba6f88e522e1f8e0cb3dbf4cf64f64c10742a5b2aa1c2e0f7b84449039d4c
MD5 58b2e5faf89b3d70b354268b3c98e06b
SHA1 95dd78a1bac7ba60e6dbfa4715e760a2257171b3
SHA512 13e81e13df66264b5967807945b42d065c64c1b95affb910c5b634d1c9b5c295003795f3ef67ca19c1cb542a5e93503c201a02f64278a59e26db384a19da02bb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7M:fwUQC5VwBIiElEd2K57P7M
TLSH
T134B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

0262a909-db79-425d-b281-61898cecde91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0262a909-db79-425d-b281-61898cecde91.tmp
Size 27KB
SHA256 eb3b5e186ea2420a2ffde5b34e53a866d9bdc8f2a49b904275baa1f203416a0b
MD5 f5999a6aabf34bff3dc2f3e4cef76d22
SHA1 239b47a50fe68760b928fddb85130fd6cf66ad80
SHA512 5319e689b73355009c5f478588f764b59116cb7dfceff2b08d488c8e31583f365837fad6352ee27923a832a03054847bf94f1b82705b928653ced38d30c2bb57
SSDEEP 384:sxR0lH/fssR66s8qMpRiYnazAW8pZS15posJWeT+leiDI/5Nd8Ula:s4lH/fx4Mnc7WeT+lex/5f8Uo
TLSH
T18FC208059824D83B9FC39D19A93D7E33EAAC105262C5DFDA5AECCA1C019E1FDAB07417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0668e9e4-8ca5-4f42-96b8-b183ddb0b437.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0668e9e4-8ca5-4f42-96b8-b183ddb0b437.tmp
Size 27KB
SHA256 b291c37ec245502a31a06cd1216196822594214d87ba19032e4a745a77378eb2
MD5 577502831ce482a9908d8c236ddf5388
SHA1 7d059656c605c4afa44ed1bef3054f85a2de0256
SHA512 c4421e09ec79d474dd37bc71dbc0f82fa601bc1f5f938495c00759669e96c03b696cfb12dfecf404462907320cd79572fcf60d43b4dd3664b57c13e2fd87b9b9
SSDEEP 384:sxR0EH/fssR66s8qMpRiYnazAW8pZS15posJWeT+leiDI/5NxxUla:s4EH/fx4Mnc7WeT+lex/5rxUo
TLSH
T116C208059824D83B9FC39D1D693D7E33DAAC105222D5DEDA5AECCA1C019E1FDAB07417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17e7cb75-23a3-4f4d-a444-8a3a572f72c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\17e7cb75-23a3-4f4d-a444-8a3a572f72c4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

230e5a95-806c-4866-bbed-296205a4b111.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\230e5a95-806c-4866-bbed-296205a4b111.tmp
Size 12KB
SHA256 5892aa5df66c88534e55ea328dbe1c6ccfb33947ae3bc638169e19fa3f64313e
MD5 25fb07b98c41e2b992e29ef1360abb81
SHA1 1c902dd77be2a98d88195b1a102debd65254d26c
SHA512 63e734b63255e9bcc95c78ee488430664f64c12181c363767a3d381d43d1085a311cae3cc93b7d5d64f10881a4060e5aa0c286bafaa996935c3143f34138e3fd
SSDEEP 192:sxR0RQbH/feNsuqrViezoA8pysa/g6+WNSWu/YxAQzkUtGeIgDPJ:sxR0cH/fssueiDq/5y/LUlN
TLSH
T12842B8156D68A93F8CDBD21EBB55BF13D2F91032A1A51F44A6FCCA1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c89a8e5-6afc-40b6-8286-ccc5a1f8758f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3c89a8e5-6afc-40b6-8286-ccc5a1f8758f.tmp
Size 13KB
SHA256 18cb157565be4a8377bb963ab8416c046ac32af28f08fe2168eb981d31da0505
MD5 184e7d24f256e9f7116f381de3a2da4e
SHA1 2210596b51af7c6e5bbedb04ad5843060d45ede9
SHA512 5da1eb94c8d383801ae17c4ec403b65ad7bd49c99c783bb7d79ce6e402aee92a08d6f100c8974b0a405517562a1d4ad1a3308467e656340d0d63d9cebe7ab716
SSDEEP 192:sxR0RQOH/feNsuqrViezoA8pwsa/g6+WNSoXZYxaQS5UtGeIgD6J:sxR0lH/fssueiDI/5BZRUla
TLSH
T1F052C855AD68A93F8CC7D21EFB557F13E6F91022A5A41F44E6FC8A1C04E76ED220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f8e9d7a-2eb0-40b0-9f9d-fe62382da5a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5f8e9d7a-2eb0-40b0-9f9d-fe62382da5a3.tmp
Size 23KB
SHA256 aa33f727a2dafb5d81271e212cde35f2153baddfc55d62c2c260efd8c14fa111
MD5 35382fda23f39f29b383f97795144163
SHA1 98a590446ef07325f2fe9d248aaafa1ce0a49a62
SHA512 6fbdc618037485c9c5795b23a2c258d896b037cdce0f1ccc151eff72fcdf8e9ccfd11d70d9fe76d6a9016fa8ec8a900cf2605501bb4bd912e0fb64f3d4dc6dfd
SSDEEP 384:z/ZDnwZfCtgbRFfkWKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVnL9K6RMErowwu:zBDnwFWgbjfkW8F1+UoAYDCx9Tuqh0Vs
TLSH
T1B3B2C92B644DC77F8FC00AAD9C196F9B7D9802C79A548D4047FE994C02C77EEA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94fe4aa9-2065-42ef-92e5-540fd5097627.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\94fe4aa9-2065-42ef-92e5-540fd5097627.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 f6f8056aecabbeadc863fc74ebeb74a531f3da88572cb86b49ba950257f55bec
MD5 81250217e38c139002f612f9b131d091
SHA1 e67bee51c1a97dd6983c4d4f0b7ddd37284a72ac
SHA512 12067fe3c2393df5e784a4f3ea04233e9f63a5b8588691a804ebae02790aa4f250ec4dbfe0f3d13a1456016a24ede7b9e03c920e43431d9d13ecf9e14c1ecd79
TLSH
T190E0268406DCC22EA30874CB62B89B4D9380265BA7E07A0E1740D68CB00A144B7C2ED0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 ccc11c72db668fd7ee3b48e901ad5b959ab481fa0c23563b53bd749a2f75d457
MD5 46b04873f153038bbc1f51e8aa6edee8
SHA1 a3890e1da9cf23b2e76bec40ba2a300dfd0db9f9
SHA512 a0e7a4386b5dd8c6921f8f65ffb8c454a2bd71a43ecf22ac4b641bbe9fdf28d169cc627b8d1f0da871e351fb6a692b681a9de71b763191e688ed1f03bef7e8a8
TLSH
T1A1E020D805D5C21D520E68C711789B5CC790365BD6E06E0D2700C54C7109188E781DD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 5db95e767f43eeb85cf02ce532506c96d3b6363bd170d29129bb5a0def8e638e
MD5 6ded63b0fbc6b8c1b86c0a11b8730b78
SHA1 a1e4f18e432d58735d330a136464064b25d0e3d0
SHA512 77a6a6b2729db5efba01222332459dff429c17d65d7780e15dda0da83810312ab1d141ab4cf3cdae3e6a09d9c66295fd962d7133bb766974d90e31a8f8ff41d9
TLSH
T1F0E026ED06CDC22EB60D64CB13688B4C87A8361BD2C0BA0E5708C68C740D2C0A39BED0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 2a8c56d02df92ec390eeaf3b9f71fcd7e0493bed9b31464b38dd6e578d6fe7b3
MD5 3505c232bc576bafc122979200e8edfc
SHA1 e66fe38e349bfc49b4881348d7cd9e8f29b7e5a4
SHA512 7c035f0ce368afc1b8cd358f7f6512c231e3a7480e68ac2a5a2a2a19dfc70de2ce2fa2f447846fe96e7d10f567cf5efd55c72d385e8d07dc1a5cfddbcd69cff5
SSDEEP 96:hVkGDK8S7He0lUu5iJai1bKQj5ZxSxECQGjuu2aaXkVCHRNnkiEMcbg2FVyKXRy2:PkepU6RrkX7VN+nsBt
TLSH
T125C143BC2E988CE4FF54033456F2ADA2B67043CCA08B0E5134A4F5BCD7C6F5078A9686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7e60f493df574318135fd0d8848d2fae4fcf6a2923491e0ff9bf6f33f5a21302
MD5 6e5886cd9dea0d5752712457c3ef96d6
SHA1 35903b697078a1e943d90e870b70cabfc1493263
SHA512 23a0215b352b7329b7b2bd69fbdccdb36c025bd681a3f18cf66bc67061fc10fc7790c00f55a1c90275765c68fbad4b12636a5fe7253e144264e56348f5146ffd
TLSH
T198513FF5339C90F1F768007147D3FD83B6B045D1D54A1E5214E8CABDA8C63259CEE28A
MD5 SHA1 SHA512 TLSH

Submit Download

a9251fae-8495-48c3-941f-45df32468122.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a9251fae-8495-48c3-941f-45df32468122.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0ab6d58b-6471-4e70-85d2-5d74fd879c63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0ab6d58b-6471-4e70-85d2-5d74fd879c63.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

0b20b0f4-95d5-4ac9-8a21-67618dbdb1ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0b20b0f4-95d5-4ac9-8a21-67618dbdb1ed.tmp
Size 2KB
SHA256 0543dd23bd43b8a71e95f9c258d4d557e08fdccabe4db75b39c25dbceeed4825
MD5 a3a7a8a6f9e865004087e4a2b1cfe39d
SHA1 dce505bd87f708728fe98c7fafe48dedb4912926
SHA512 43f1e82d52b2711be9d1d4e3a3850a41981434586d3861c41d3eefc0a39c5432aa49a21f509e1036e58065196aad384929ffb0a246ec30733ae92a9a15bf77fd
TLSH
T177516AF747B1956D9A1195F0AA08EE1FCF6C0114835C787985E07E57D3E3462E041B6F
MD5 SHA1 SHA512 TLSH

Submit Download

80f69ae4-1a66-485a-bb82-6eae5926c6d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\80f69ae4-1a66-485a-bb82-6eae5926c6d9.tmp
Size 1KB
SHA256 6a1cf26b6121c7ad60b9dea184085f94940e1f0339e41526fd8b6e1c660cfe6f
MD5 a47e7965abce24cdd8de51fc088c9744
SHA1 dd00de10204cedcab0eb55b1c96a53e791ec8b39
SHA512 b0e9744b29e769d5913ed79066280ac8c470bd4809a2dc033b4676bfaf9d9b35d1521014dbbcc5bab665517e54b3d7d0ea6b40bf18dc777dbf4a31b25e33ccbb
TLSH
T1A421AFF7C3F85A7D894196F86B182E1BCE2D0854531C3E5BC8D4AF5B93E18B1E28095E
MD5 SHA1 SHA512 TLSH

Submit Download

a5a955eb-6636-46d4-8f50-a8e3cb848436.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a5a955eb-6636-46d4-8f50-a8e3cb848436.tmp
Size 2KB
SHA256 a054c56e3f50ed6e53db673ff4f745e6f7632a0b9f71196578b2f81c427b8034
MD5 b56e0f396ed8b3041bfd38a951e7eeba
SHA1 685bf430957729f7f442978aa212745c4017f022
SHA512 26bb00a67f4149c6887d3895e830cd361a2c6409014df4ce34d7a45b8e9ba26ad3777ee6957f12184348364975be64ef2c3c5228064c41f1525a3c1b830cbaf7
TLSH
T1E85179F747B5956D9A0196F0AA08EE2BCE2C0510831C786985E4AE57D3E3872E042B5F
MD5 SHA1 SHA512 TLSH

Submit Download

e2c66cfc-4573-459e-b760-64dc32153b61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e2c66cfc-4573-459e-b760-64dc32153b61.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f1affc37-4361-4c97-a645-a193a0a454d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1affc37-4361-4c97-a645-a193a0a454d7.tmp
Size 2KB
SHA256 2ada963db55b1a9887598970fa5626688dfe82a261926939ca3ba5e170f9199d
MD5 6e0d9227648a0b2ee27c3bd0fd8cce4b
SHA1 e14e447271b7fa2df6a9b5e8586125700c612128
SHA512 92f6a1f3a4cd1b810a33b484baa398bdd12d65ed3537e2feba9724843ed6fbf61e0f3b6d47c9aaab0428f74d455910be77e869fec1b04e67ff46e17d78e3dd1e
TLSH
T140517BF747B1956D9A1196F0AA08EE2FCF2C0514831C786985E0BE57D3E3872E041B5F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ebbd165-52a1-4145-b022-179cc6acb872\index-dir\temp-index
Size 1KB
SHA256 3cb0e3c078610d4a21238714b5c13bbab6a4ec756d88a456a446adbb6c1af05f
MD5 4d97906262ad6195b9f9c4d6f5ca7b53
SHA1 955b2688d35013b63b832fa06958e5c523bc8359
SHA512 a6cf26b28e2a8970e6899e49166c705636b4eb517eb6abfb7f315bc8ecac96df4ae12aa35e3396a7d9d1623a43043b2230d5fb3f7820b90ab2ee2edbaa4d7082
TLSH
T19121545B0E510B5BFED45234283D6899733893CC43057A1F51FEA63AACD6B18ED86688
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ebbd165-52a1-4145-b022-179cc6acb872\index-dir\the-real-index
Size 1KB
SHA256 02fa9cd1f33768044a25a5964caae63f3de97530872c21639b7f8a9aba387675
MD5 5874cd90ef74ea2fc6e759cf015e705b
SHA1 cbfb536dbaf747f2ee246d245ab2c7b38614e665
SHA512 2a3ced2f37ab4b4c33872238a36300baa4462709afd29d334ce3a31ed25e088781f687b88a5c2fe62e6ef500e9991d903c08ed6c88c556c2357e730312a31f09
TLSH
T1B321446205B20B67FD402276156869D27335D50843487B1FA3F3A07AEC90B84EC96994
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 ca45b432221b540c7409c704f60007b445b025b0c2cecee53f4258b0dc250026
MD5 323de4dd6c6e5461fd1e0704ec82a1a8
SHA1 f29248ef162502e91eb649001e5d1fef218d6cbc
SHA512 4d6a53a69db711bb935f2a1025cb90c4a1d58327729ea629a374ebbc11deed3609b0a2148c5e3a0e7cdb78f63461cfdcf7a53448595e9567bc7df751fa66feac
TLSH
T1FCE020BE3FF72810ADDFC7D92C7150A10501FD688914AE4F543FD1E355A13752856C66
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 efe8aebf6285482c7e3c9a826167e379f4f94dba93978e8fa1e8f425805210be
MD5 b18f244b540294f8178af993706b516f
SHA1 adea38b7864b221216274e664f76749862b4eba6
SHA512 df8c8eb601981ab831ed2b8fd144af8c332f4b966f570133947867479c1b18e138e7832fd1661e3428fc9f7b0ef1594ad4522fdf4c7391676e36b293cd3c56da
SSDEEP 96:KU+AKrquayhkIy0UhToz8ZghKhIZyh9KiLgs1OK+4C1:2rlnp1
TLSH
T12491531934770214783E760C51E5ABFA538676B33039E72B3BEA48A14E2AE140EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

acb1435a-732f-4852-9a58-09037fbffc57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\acb1435a-732f-4852-9a58-09037fbffc57.tmp
Size 12KB
SHA256 04c0bbba3ad6aaa994da656597ee3ae6a9d7c2c064df567beba6a05e0e4befdb
MD5 d087c08368b50f6b4dc2ee980859ed74
SHA1 938695e47c70d836698410c890e8b8cbfa7c9520
SHA512 64f2f2036e31fd63fa1ee90e6c1d22692824d1352218160a4f4cac0db01c720bee6d4a09938121f71d40593d235098cfa2048b8ead3ed7f1ade4f917a67df3cc
SSDEEP 192:sxR0RQbH/feNsIqrViezoA8pysa/g6+WNSWu/YxEQjkUtGeIgDpJ:sxR0cH/fssIeiDq/5y/dUlf
TLSH
T1E442B715AD68A93F8CDBD21AFB55BF13D6F91032A1A51F44A6FC8A1C04E77ED220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b259e3b5-189a-41d3-9150-0ba9edee3f07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b259e3b5-189a-41d3-9150-0ba9edee3f07.tmp
Size 27KB
SHA256 3563064df96b0e643878d30835ab5a132979f9b21ecd3b385d615cbba17d3bc6
MD5 bf7e7386d666ff6d20d8b208e73bc305
SHA1 1feeb505cfc5003ab8ededd3e3cbb71b670298d1
SHA512 033512b776dec541977e07d878fa8f5f044e5e627321da0c4401262ece711f29f5c655f18f6420845985d177e6c5c8287bd480aad44692eecffb6fb724e368eb
SSDEEP 384:sxR0WH/fssR66s8qMpRiYnazAW8pZS15posJWeT+leiDI/5Nd8Ula:s4WH/fx4Mnc7WeT+lex/5f8Uo
TLSH
T1A9C208059824D83B9FC39D19A93D7E33DAAC105262C5DEDA5AECCA1C019E1FDAB07417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0119651-1f72-4d5f-95a5-872e0c5de516.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0119651-1f72-4d5f-95a5-872e0c5de516.tmp
Size 11KB
SHA256 23e090ac8d68c46d14a5e06741d35cf2797c028499999849b00e53bb8fc4e7f3
MD5 865708fb95fa097867a32a169d72fe3c
SHA1 850c89c6186588748966542e65c80bf4144f6256
SHA512 bf0e6d8d5cea8180dfa1f2829375f6d3645db10fc8c4da6d06f9e9801186735b88e82f5da8b480943f7306e96360cbaafa2ab149cea2a9962b6c1fe461e99748
SSDEEP 192:sxRbRQbH/feNstqrViezoA8pysa/g6+WNSWu/YxEQjkUtGeIgIJ:sxRbcH/fssteiDq/5y/dUls
TLSH
T1FE42B7156D68A93F8CCBD21EFB55BF13D6F91032A5A51F44AAFC8A1C04E76ED220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7c632c6-ae77-42f8-b3c2-eccb81b9f275.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b7c632c6-ae77-42f8-b3c2-eccb81b9f275.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4a5da14-0a34-4b56-be93-02623582b13b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a4a5da14-0a34-4b56-be93-02623582b13b.tmp
Size 38KB
SHA256 a7e7738d94e43725d9cffa19f7d60bdecc11d932ee05e3aa061aca1648102eca
MD5 66eb0f27289a6505998c45686ed2ce54
SHA1 7dafe0994c3668e582632a0a02a947f9805ba555
SHA512 239e30949b8386cbe8dbfcc148528bd20fb2614cc6d08a0927bcf43c61a95f9b1ea99e405e530c71976d0e7ff3eeca3b377a87ffbcc9c707308537142a402f16
SSDEEP 768:o/UxvxjgC+G3HCo9TOfkfqSfJtryJYe1ELsAvC8/YEH2iwC:1Zj3+G3ufkfVfYYe1EQujYTiwC
TLSH
T1DE03BE31ECA8AD371EF1E699734A1B57EEF4411381C86BA485DD2B0D45C73AC630F86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eada7d29-4ba4-4886-b297-bfd7b9c71fdc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eada7d29-4ba4-4886-b297-bfd7b9c71fdc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Liberium 1.8.7z

Path C:\Users\Admin\Downloads\Liberium 1.8.7z
Size 25.1MB
SHA256 61fa8fb3fe908c2302a24c6bc86fa606e9d879440e71a21eb4b9f33a6a460f2e
MD5 f21da58970c7f21e2765294441054a92
SHA1 c1f8ea99b5f6f364d6e73cc95ae8b59df3b72be0
SHA512 500029e8edf7a955ed5facaae6166004064dbf5c87cf038fd4e4f8e0e6977c6ed9320213b82684341ea639f224959d3a56893ee811d7350960ac5fb360997474
SSDEEP 786432:gqoHBk/0HDHin6z+X+2Ykzgnd/QdqUn+FeA0PFV:gqoHG/0HT7zU+2Dcnd/Qkk3
TLSH
T10A4733E751CC701DD0603B825E5FDA0223B8E539B999DADB3CDAE46DC5ED128202BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d-coat.ico

Path C:\Users\Admin\Downloads\Liberium 1.8\Icons\3d-coat.ico
Size 278KB
SHA256 6a33b422ebabbf15266e61ba081cb9e00a17ebee88321f00390394a22896512b
MD5 e2e7bfbefb704df07e72d39856d0311d
SHA1 7096f564e270701cbeb20f0e257b720d0f15dba3
SHA512 c573b0ef913f21b2f88fdd4988eb3a6ab99489af60eae26be091f85f66b337cc755c758684f7b96595b2403ecdcccf15eb4d22cdb68ca08477a7ebb3f82cbc1e
SSDEEP 768:D/+f7NZDktgBE9mHt24bErSOKevlGekmru8jimBrplqAr4jj/7kzgK:Du7D5OKevlGekmru8jimQ/7U
TLSH
T1A054B9DAD5509DD4FD77433900FA1E92AD22FC3E713A914D48E68A24AD62A63142FCCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7657cvkhl.ico

Path C:\Users\Admin\Downloads\Liberium 1.8\Icons\7657cvkhl.ico
Size 54KB
SHA256 1be73ec6804bf73e41a9f8b3f8e732c83ed7dfc0116abb0fc5de4d96ee8b3a6a
MD5 91253f44d99722486f843631c82a20c2
SHA1 ed2de11e26ff47ce086234e71bf8b44f620ee55b
SHA512 e832be77bc58881a95a4cf2391cfb2409c5e5e2e46d887507473d7b64ad3c72bad2c8bad1a7b6250a90ceac72e7b08844e45d7acbd5691faa5fe4a84a5089b8d
SSDEEP 768:deGiBBBBBBBBBBBBBBBBBBBBBRbT8cqBBBBBBBBBB9B/CP:deGq7uCP
TLSH
T111437D83E2E8D0CAD5453C3B6AF245E8D5B4FD686C09A143694CBADF9AF2F4054812DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Leb128.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Leb128.dll
Size 7KB
SHA256 0e9f5e8cdcaa564d6354c15e2fb4d33dbdead917a2e1388050a68bfb1876ff01
MD5 e6650e116617c59d46b6f2d3498ee138
SHA1 f499cf553215a2f4190f0c1e9d35b43dc9e1b092
SHA512 09f9b493a5accc6ba3e724627b74189e08c34a6f30557a5e07f849957db48b22d496fa38a40640b591c67ed3d9cd797f350136fcc6c5f8fdab6c3d645429cc34
SSDEEP 192:lxAvycMDDDDDDDDDDaZF6URpVJVXKy83:/+F6URpVJVXz83
TLSH
T13FF14304A3D44E24DFA642BEA96A470993B4B71D9C43D71F789456E17D0137E2E121FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MaterialSkin.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\MaterialSkin.dll
Size 6.4MB
SHA256 3b0e1b3af6d2b8b3d02b6cd52849277c9c8066c2ae565e68253d4551c37492d3
MD5 022f385e55d9d3d42a33b4ca999bf22a
SHA1 5d2f22d51d2e87ae8d1f2c1acd3f08f4fdddf107
SHA512 7fd663b56a2894d1db2ee1032067091f72a4ac301ee8cd392030c6ab186e3bb960d8e35a8591204fc23e9b5a145a2a9ab0092b1c9e6ae5c9c2dc2adf907a891c
SSDEEP 98304:iZavd9tWpmIgMlqVz+rQVe97lwu9cXvBxDh3DYnskFb06vSXvfnjMK3aYLB+8uNl:ivKv8XcXD4K
TLSH
T138662902D642A62ACAC6F6387D3D933E0D70D429FC5DB62674C59F3194CA904EC69BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Action.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Plugin\Action.dll
Size 27KB
SHA256 37e1b48e02a17a865b18cd315a28ef4f18d702702bc786f557e4eb5d7878184b
MD5 23a7fb014b665f3e017f86d9ca2643e3
SHA1 2727a1b37a4accc74cc13cd087a260ff56230fd1
SHA512 37c67c329dfd41ed01fc7272c1d28a29f8aa4a8d3ad464aa505d288c41050e82be32f9d197cfdeb71ccfbc37aa0676a0f9e85494b607205e28eb1908ef123d3b
SSDEEP 768:9oE6MFY/dEMKix0thSCBsFY/dEMKix0GjRjrEquHp/Uz5x9Lv:+E6IjrEquH2zBL
TLSH
T18EC20A04F7D86A30D1FF07759CB21B15EE35610BD8B2C5193A8C40E82F767598AA1BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AntiProcess.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Plugin\AntiProcess.dll
Size 10KB
SHA256 0563cf42c946bc00760f51e7c81e5b83f5b65077afb2f70e90ed3fc604534cf6
MD5 5713ff897403f3831da890ea800654d6
SHA1 1cad6497a4203fd0a7bc28d4eb52be1187769e98
SHA512 cdd4bab489a89dafe71995346c1d39cc1b9b77eaca2b77c3ede0e677a3db64b577ddc95bef7f206712e4032894e960ea03c78fc3ed11e8f0c584e1845e8b346d
SSDEEP 192:7nGYHQ8s3Zjrt+5Gie/4tusI6ibn7NHaTt:bned+5Gie/6us3ibn75aTt
TLSH
T15C22C6059BE44B30EE6E06BBFC7B875A8734F6554C43DB2F2C9056B13C463A85A62398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoRun.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Plugin\AutoRun.dll
Size 357KB
SHA256 f7884811c963a0b8006f282c121278f39e113e2a1fa8aa2d093e4acdc95c7b15
MD5 c422f2256dad3fa20dfc3701ce4aae96
SHA1 134490ce82f68a49dd9f45e27b825c463f03abf0
SHA512 d7e69874f1a6b168de15205f2c9083c2287e0df4257ad990860abcfba1b0a2c90bbad144cda2d4cc493cd0874a598bfbb44ff867d3bb956c8615cfe12a108fa4
SSDEEP 6144:2tsANPVlFHG7QU9V1X7E0AEfRdq6sLtMwNEamxkUu1t:9AOn1L1AKOMIWxkUu1t
TLSH
T127744B11AFE48237E9BF17B5E4B303100BB5E589E56AEB4F599414E80C63309AD173AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BotKiller.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Plugin\BotKiller.dll
Size 26KB
SHA256 7bd4bfb321794ebbe6fee143fcae77e2b5f35d3d764573800eadaf1dc695e8b5
MD5 b8a4fc3d5fc89408eafe329cfdf4eec3
SHA1 6b3283f76d53b54d689c7ffb81dbd6297bff9f61
SHA512 17dea0a08ae6f6cc7381317aefc90fa1ded9b8fdbef87db4962f41aa5a2b8c9b7e69dd9b1c57f9e062f46a756bd3d32b469bddcc4abe63c213b31babdb1aa6af
SSDEEP 384:ecBitRM8UqlFY/dEMKix0GhmggD8bwKSs7fL1gFt9et/mR17WlvZma8IlJbt:eWitG8jFY/dEMKix0GoDk5d/817ID1
TLSH
T1F1C2B620B7D96234D7BE4F31283262114B71B5269C63CA9D3ECC51950B3A714EA35FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BotSpeaker.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Plugin\BotSpeaker.dll
Size 14KB
SHA256 3df26ae2d03f6cc7732fdc9d1498d8c26f84504327dd57178b778d43f7a1c20d
MD5 4fb49f039d8c3bd89aeda2c63e233ccb
SHA1 f70cecb45e08f82d8d9b71f39e1d0a708a0733ef
SHA512 e3a2121f9dd0bd0efee4f999ede4fe87280206bfb9b896abb7d9b41a9f0748d89757228d702f2a71a720d805db7e78a0c4c97caee09268836bc375d321b6f429
SSDEEP 192:2RlXXmgxQ8wbwlpaFuC+yYYJUT8kUD/4pHc2gPi57lL+ry0gOeMlvOv8RL:QXfQ7sp2Z+yYYJrkK/282giF6gbv8RL
TLSH
T18352C609EFC59B32DAA957BB45B28355CA34E5085C03DB1F7CCC21E5FC06BA92B601E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Camera.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Plugin\Camera.dll
Size 98KB
SHA256 8856c385a682e8ee00209b6c9814d977efa7c9ec8577d4d87c1c097ba510c7ec
MD5 15fe64c0625fad772e585b6329da4c86
SHA1 6ef0b30954cf9f8b9d6e5e461f61ba0ed905a552
SHA512 83f25fe8a2a943ca4afc133e2b0727865d593494991957b5d4a0f990434353c621c04bc192ba94fd2a2ae08925b532399c17069adce7b3644b7f334fda8c71ee
SSDEEP 3072:VCCQQCCc23F99bb99fLgUsOOMMOOQOfVkBmQEQIpZL+S+Y37ikFJo:VCCQQCCcw99bb99fkpOOMMOOQONcpIpH
TLSH
T1CEA34B9167B8C563D5AF57F5A0B74B164B70C203A603F7EB19B424F82CA37411E222EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chat.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Plugin\Chat.dll
Size 47KB
SHA256 adc1426293f7d18f179b564cfa228cd7b7246580b24e6f6fc0eb18628dba9ebd
MD5 5659d95536342389a8265d29b11fa0ea
SHA1 e85d8f444564e2fa9d0b8fa29ad33c72eab59c09
SHA512 ceeac539e9cb09a6b249f84b5ff139e43db6c8ea8dbceb24fd84bd5e1fd8d08c5f65821988fbee279631862226ab37740b406e3676f4d88f7179aaaddd4ff799
SSDEEP 768:oqVJNCa72NLlpjnGFsT+5asw+rBdNZTgM/Bc6909D+ETzYwLgec1:hV2aWTiFw+LTc69UD9ztu1
TLSH
T162230910B318CE3BD6BE0BFEB465126103B5D316BA43DBDA5DD5109CACDB3868A141EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clipboard.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Plugin\Clipboard.dll
Size 13KB
SHA256 9a5c5c1014b569ff92eac1f3a809559145095c8e83b22e53b9277676837499f0
MD5 cb96674be57d0c8d38ac31d3550e73d1
SHA1 e6f9429e1bd47bdd684ae06e24d83e451bb52f0f
SHA512 2fd6c7c5864fb06dd3a717a1ec7f6a966bdd9675118e87d188d8f63fcc2780edb2815f7d19bb44d0ce6897a59bd1413df116f8a823b3a6e2b65606d82a7f0838
SSDEEP 192:2pR8sh0G3FrPpaHHS+r+g9kA8nH/4KNl6mMBqAZ2YFVvYCDdEbCr:FsJPp+y+rVkA8H/LGfLvYyEOr
TLSH
T1F552D905DBA05F31DADF95B794639349C734B1116843EB0F2CCC44E0BD5BBA826326D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clipper.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Plugin\Clipper.dll
Size 15KB
SHA256 7e20a585733f71f441872c02ffd160e3484f1b9a60b2a07a886630dd7599b1c5
MD5 b33db4b62a906fd1ad36c8238c19721e
SHA1 c4cc18121c768d0249c8b6182d3568c35272cc8f
SHA512 38a3b0240f2c3e47ac90badf9d8968b9dea4582d707b9d85e8ea1fb0b1f3e3ebb582693a26729814629744d0b45dae09549aa51d140f8289bcc78bc013bcf9b9
SSDEEP 384:jN7IcTrT3d/c+I+c6kJ8ep/RItSOglOpg:jdIcTXNk+I/6ep/CJg
TLSH
T10B62FB449FD0DA32D5F903FAD8B3A3898634E5045C03DF1F2DDC08E86C5B7996AA25E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DDos.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Plugin\DDos.dll
Size 113KB
SHA256 d02b2d970960070ebd41f931767d50eb8e6fccbefcd35ede140b8c2ecff02522
MD5 14c3eea78012239274b57df062d9afe4
SHA1 01d17f22e71234a85f84558e177ac1766db4bb12
SHA512 1ba35e03b543536b4b3a44d79309a010a6d8add5c6679baab9ef1f1587bdb460aaec9f726674529faceaf8e00981a993f6004f9329ab3ba7bfaaf734471969f1
SSDEEP 3072:gshGcFjKyO+bwqlWj/RxfZwqWHDgAwlq:7pfHXwl
TLSH
T1B8B3A314B3F04319F2B7177DF8F55116AA79F645FC32EB8E2469031E08A2B009986B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Desktop.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Plugin\Desktop.dll
Size 778KB
SHA256 44608a47639bab323d4011ca80eba806ecec75ad42f1122bd7969b520f94750e
MD5 0691e527028bac9f5c145d73a708bfaf
SHA1 39e420b3e9a3e71fc1123a190eec5549df3820f3
SHA512 9e019fcab4116a9e03b88c16c5b1354328fe5fc1efa882e9bebd8c0ae46b56b889f5f8375fa03824a7860d75fad3bec10edd00c5cd8ba50bf312209f671b46a9
SSDEEP 12288:eJqOo1aiGeJ0MRKI0xRt0HgmtI8pHuE4po8U5BAst:eJqOo1aizXRgxRtA5BA
TLSH
T1FC0529C6CE642F26DC0F6A7F74A2651382A1D0900345734B5BD117AE6ACB3A5CB1A7CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RjControls.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\RjControls.dll
Size 31KB
SHA256 3ee6c31ab5c76286cc58c94fb11b00c8163bde35918ebb39cc6d4c3bfc62e36f
MD5 889492bfc195bf189ef7649233da68af
SHA1 0c1c83d6965340593e7607d86a2ae06f6cea4e51
SHA512 52d5fae0544501a9359e0b420e31c3191d93a8ffd5aebbbe05c2a4191e417c0afe28be58b21957bf2265ebc186878c3f9be63a92043caf747ab4f071fb109b5e
SSDEEP 768:YZrDUywW4PaIDWB15WYRnsb6IBhdaoej3Fc:kDUNxaIDsubf0jS
TLSH
T19EE20828A62C922FDBAF0FBDF44419A113F5C2703383D7E8AE85D17E6C93B454611267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Server.exe

Path C:\Users\Admin\Downloads\Liberium 1.8\Server.exe
Size 2.4MB
SHA256 b6b797be96660392207f629cd055d2163986da0e38a412eb9cd65282f4ec0e3e
MD5 bffd12714b205d8d0e417ded3654ebc6
SHA1 3e80d0aaf32b9c53dcd82b465699e33b7012f9d5
SHA512 daaec04c77412497dd984a84aa3899aba18623d4c8186e88df3e8bdc17ecdf562459dc5e9e192b45699c2b607afd0f8aa9dda875bb70a7769c718caf6fd229e8
SSDEEP 49152:pevY0Bu0e6NGHsMiAqrP5eBeYSfSvPeBeKFe:pewm6irheBeleeBeAe
TLSH
T132C5490237A43A9FD6FFC7F21412095C43E564CFC2A39A4DABCA61F845E8B21A456737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Server.exe.config

Path C:\Users\Admin\Downloads\Liberium 1.8\Server.exe.config
Size 1KB
SHA256 303f2ee77f41a12f2826b58d4087de1e56352443a57b88a1b921cbd4680ac978
MD5 dbfde188a065e195708a51d2cab58507
SHA1 36db24ef3e6fa2f0893507425dbfd178555aa4b9
SHA512 0a8ba62dd35f51d4e8e3b4ef6015a650029e56892701f435399f11b9474a33b046cdbc66bbb7221979cbec595dd813b80229446149f66fb1f07cdeda7c89fd4c
TLSH
T1603188F885CE8EBE04310D47B474C480C6ED4392E1924885B8CE25AACBE3CC5231B356
MD5 SHA1 SHA512 TLSH

Submit Download

ServerCertificate.p12

Path C:\Users\Admin\Downloads\Liberium 1.8\ServerCertificate.p12
Size 4KB
SHA256 b8177366a1c932b61b18711b0547b6e6cb92ac64816d4c415e715e37803ad231
MD5 a4472e78ee606f426a623897f03a912c
SHA1 22dec2c55f96c1d1c5bcd0c76d551fc4eefc57fb
SHA512 90fdb478e8af73fb6f8d63e5b1edffadca41d129a7960141095d6724be64eaf6cd0bf0e2b96989a16f4a2109ebd53e599688a51aea0c817da33cf694eae4960f
SSDEEP 96:juboPDiAN7IoDCzveLwQ4kEi9/gRZNke2oPSZx+/0nDou2B:sABIoOreLUji946eu+sDA
TLSH
T150915C255B6077DA7CED809A9028450585D0EF0A3BBB104B717547AA88FAE265CD05F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.exe

Path C:\Users\Admin\Downloads\Liberium 1.8\Stub\Client.exe
Size 44KB
SHA256 5f70e4fa11017918e51ae7eeb9c46b8cf3e1d3ec71b46309878885d38749f797
MD5 24b70dcbdf39074f85c1ab2f0e0a3223
SHA1 9bb3ebd03a59cb5606d8cd7b90edee45ad6e2614
SHA512 a631b67e6a3f3bd7411a119cd82fa6395e865b55f60726fa6bd2eafe30950a0e0e31f61a906a95d7a817def2c86fa91264f63cef856190cd521d260784ce39d7
SSDEEP 768:iUuQWMNwrqA8mkm5r+t2GJTvf1bqRiLODCgkS:in+wrqA8mkm5rS3ZKRWo
TLSH
T1E8132B007BE9C912D6FE0BBD683A42284A71E4536912E74E1CCB14EB1916FC49619FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserMode.obf.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\Stub\UserMode.obf.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cGeoIp.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\cGeoIp.dll
Size 2.3MB
SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
MD5 6d6e172e7965d1250a4a6f8a0513aa9f
SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
SSDEEP 24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
TLSH
T1A2B53982AE8940DA343438DB75A15FAC49149FBD7F112F3D31A937886DF530A788EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnlib.dll

Path C:\Users\Admin\Downloads\Liberium 1.8\dnlib.dll
Size 1.1MB
SHA256 bdb84aa16678189510def7c589851f6ea15e60ff977ea4c7c8c156504e6ac0ff
MD5 3d913aab7b1c514502c6a232e37d470e
SHA1 28ac2d1519ec5ea58b81fe40777645acc043b349
SHA512 311e8f73c52dd65cbaf9f6e008b3231090ea99edf3471bac63cca4156a37a0d874ac590b19c01b15e05345bb6a5b636a11698bbd4e88c59c138dd3f358800027
SSDEEP 24576:2gW20arTgWkk7z2B3Kqwf11Ot9Awr89Iv7f+NGGL:XC3o4swrY
TLSH
T105456C1177EC9BB7E0EE4737E8320A5807F2D5066693EB4F5610ABA96C833589D013B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bulider.json

Path C:\Users\Admin\Downloads\Liberium 1.8\local\Bulider.json
Size 1KB
SHA256 9915c367a05016984567909815c9875b37bf60df33736d83e592e09385fd4895
MD5 5d5965f04088485c4f91cdfc8227b3b2
SHA1 60e7ecfed38dc5659e6eb4dcc0284282711d82c6
SHA512 50180be55eb8018a44d970139ec6f9bad84f5743fefc6ec164011dd1eeea3704dd7ef585ed7aa45d9c1d3616664eb98b3012f8e088835ee721223dd99619262b
TLSH
T13B113436F49850BE68B4035DC912DA82B7661F5B21310C1FF6FF6809A62213B3A49BE1
MD5 SHA1 SHA512 TLSH

Submit Download

Settings.json

Path C:\Users\Admin\Downloads\Liberium 1.8\local\Settings.json
Size 151B
SHA256 b221df29ed9bb77aca8287f1e6008c7dd983c4ed3bfe4e0a66b0b069c17367b0
MD5 f4fd4bbd03513fdd927dafec971d923d
SHA1 84fb58361caa90998d96621120a2de57424848de
SHA512 8a395491c807eeacc08b71fc00d0e55f85bfe59a163dfbf0d9c9dde67d56742a3030af2e74a3994313914bff948ef49a3c60145167170e0fd10c6dcf4bece31c
TLSH
T1DBC08C391210C0BDA2239E13C1082E8A2128050037091C1080C94A3891E23E10178CE3
MD5 SHA1 SHA512 TLSH

Submit Download

jei2dlw3wwl95sly.exe

Path C:\Users\Admin\Downloads\jei2dlw3wwl95sly.exe
Size 462KB
SHA256 aef0641cd10b21cf0d8de6c08acdb39ba8bb7b32ea1787536c33d20aae11490f
MD5 79837a4a028734ae424836cadfc83bbc
SHA1 d02ef6176d081e2590b8cbb787daed6c955b2ce7
SHA512 def916d526345000062d969f3e098820118816ac54e634cb8fd530104c73e7c6e8c40db4a6c9f59e8817669c9fc9b6ab85be3ca5ab95c2f06b1f076cf9975ebc
SSDEEP 6144:mBx6blF1pFqxrxnXRucMlw7nOkC8w1koFn+fkpCKHouf/wO96xICrBQ72JN9lkWU:C6blFla5XRCS/3w6fCyZaqvPkrBV
TLSH
T19DA408257F948E00E591287ECABE2A09CB12E0F225066343374AF7A15D459DEDE3D3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1964-1671-0x000000001CB50000-0x000000001CC1A000-memory.dmp

Download

memory/1964-1714-0x00000000015F0000-0x0000000001602000-memory.dmp

Download

memory/1964-1647-0x0000000000E10000-0x0000000000E8A000-memory.dmp

Download

memory/3232-1635-0x000000000EFD0000-0x000000000F0F6000-memory.dmp

Download

memory/3232-1600-0x0000000007BC0000-0x0000000007BE2000-memory.dmp

Download

memory/3232-1601-0x00000000088B0000-0x0000000008C0B000-memory.dmp

Download

memory/3232-1598-0x00000000054E0000-0x00000000054EA000-memory.dmp

Download

memory/3232-1597-0x0000000005630000-0x00000000056E2000-memory.dmp

Download

memory/3232-1593-0x0000000005430000-0x00000000054C2000-memory.dmp

Download

memory/3232-1592-0x0000000006390000-0x0000000006A04000-memory.dmp

Download

memory/3232-1588-0x0000000005750000-0x0000000005D0A000-memory.dmp

Download

memory/3232-1605-0x00000000087D0000-0x00000000087DE000-memory.dmp

Download

memory/3232-1587-0x00000000002D0000-0x000000000053A000-memory.dmp

Download

memory/3232-1656-0x000000000F410000-0x000000000F4AC000-memory.dmp

Download

memory/3232-1655-0x000000000FDD0000-0x0000000010022000-memory.dmp

Download

memory/3232-1651-0x000000000B9B0000-0x000000000B9B8000-memory.dmp

Download