limerat | 4dd92b5181f82e852aaa58c9bdcb922b1bdfa08b2bec6b90df926f5fc341a36d

Analysis

max time kernel
56s
max time network
133s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-04-2023 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UltraMailer V3.5/UltraMailer V3.5 [CRAX.PRO]/setup.exe
Size

16.4MB
MD5

4b1351f8eab25240a16498ecb0eb6199
SHA1

5f39a1a8e2fbde7b717676c0a1c9540fc3069e51
SHA256

15f012b7f2103d7a21da10e0dc25e0f1b8a4b9e680b4c6f31503fac54f22aa30
SHA512

a32f870e68ae3d1a93fcb85e58209eea15f9b94cc6716a207f3c84ac005d3a2e2578c95366b9f2215676b4bc14f18e2e2e367a7226d191eed418d3596157f164
SSDEEP

393216:3Qp9F1i4CB4Xz8TQEmtOpPaMQlLnDT90+X7OXoGOVzUg7Y11grdW/:3Qp97ixWXEmQPvQHRX7ELOvtrM

Score

10^/10

limerat xmrig evasion miner rat upx

Malware Config

Extracted

Family

limerat

Attributes

aes_key
4777
antivm
false
c2_url
https://pastebin.com/raw/MVpsXzd1
delay
3
download_payload
false
install
true
install_name
wservices.exe
main_folder
AppData
pin_spread
false
sub_folder
\/\
usb_spread
true

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs

description	pid	Process	procid_target
PID 268 created 1380	268	Ahdzyktwl.exe	15
PID 268 created 1380	268	Ahdzyktwl.exe	15
PID 268 created 1380	268	Ahdzyktwl.exe	15
PID 268 created 1380	268	Ahdzyktwl.exe	15
PID 1580 created 1380	1580	updater.exe	15
PID 1580 created 1380	1580	updater.exe	15
PID 1580 created 1380	1580	updater.exe	15
PID 1580 created 1380	1580	updater.exe	15
PID 1580 created 1380	1580	updater.exe	15
PID 776 created 1380	776	conhost.exe	15
PID 1580 created 1380	1580	updater.exe	15

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral3/memory/2036-158-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral3/memory/2036-165-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral3/memory/2036-167-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral3/memory/2036-173-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral3/memory/2036-179-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral3/memory/2036-185-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral3/memory/2036-190-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral3/memory/2036-195-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral3/memory/2036-201-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral3/memory/2036-207-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral3/memory/2036-213-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral3/memory/2036-218-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 11 IoCs

pid	Process
328	Inkhxjl.exe
268	Ahdzyktwl.exe
360	Zdhdajdq.exe
1968	Zdhdajdq.tmp
1084	wservices.exe
1892	wservices.exe
1580	updater.exe
1628	wservices.exe
1180	wservices.exe
848	wservices.exe
1340	conhost.exe

Loads dropped DLL 5 IoCs

pid	Process
1980	setup.exe
360	Zdhdajdq.exe
328	Inkhxjl.exe
328	Inkhxjl.exe
1916	taskeng.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/2036-158-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral3/memory/2036-165-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral3/memory/2036-167-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral3/memory/2036-173-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral3/memory/2036-179-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral3/memory/2036-185-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral3/memory/2036-190-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral3/memory/2036-195-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral3/memory/2036-201-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral3/memory/2036-207-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral3/memory/2036-213-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral3/memory/2036-218-0x0000000140000000-0x00000001407F4000-memory.dmp	upx

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1580 set thread context of 776	1580	updater.exe	86
PID 1580 set thread context of 2036	1580	updater.exe	92

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	Ahdzyktwl.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1996	sc.exe
1576	sc.exe
1984	sc.exe
1172	sc.exe
1776	sc.exe
1084	sc.exe
1008	sc.exe
1740	sc.exe
2004	sc.exe
1612	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 19 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1932	schtasks.exe
2004	schtasks.exe
1332	schtasks.exe
1940	schtasks.exe
1688	schtasks.exe
1980	schtasks.exe
1084	schtasks.exe
1788	schtasks.exe
1544	schtasks.exe
1892	schtasks.exe
1656	schtasks.exe
2040	schtasks.exe
1044	schtasks.exe
848	schtasks.exe
428	schtasks.exe
1912	schtasks.exe
1616	schtasks.exe
1908	schtasks.exe
1348	schtasks.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 00e5107a6e64d901	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
268	Ahdzyktwl.exe
268	Ahdzyktwl.exe
112	powershell.exe
268	Ahdzyktwl.exe
268	Ahdzyktwl.exe
268	Ahdzyktwl.exe
268	Ahdzyktwl.exe
880	powershell.exe
268	Ahdzyktwl.exe
268	Ahdzyktwl.exe
520	powershell.exe
1580	updater.exe
1580	updater.exe
880	powershell.exe
1580	updater.exe
1580	updater.exe
1580	updater.exe
1580	updater.exe
844	powershell.exe
1580	updater.exe
1580	updater.exe
1580	updater.exe
1580	updater.exe
776	conhost.exe
776	conhost.exe
1580	updater.exe
1580	updater.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	112	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	520	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	844	powershell.exe
Token: SeDebugPrivilege	1580	updater.exe
Token: SeAssignPrimaryTokenPrivilege	1088	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1088	WMIC.exe
Token: SeSecurityPrivilege	1088	WMIC.exe
Token: SeTakeOwnershipPrivilege	1088	WMIC.exe
Token: SeLoadDriverPrivilege	1088	WMIC.exe
Token: SeSystemtimePrivilege	1088	WMIC.exe
Token: SeBackupPrivilege	1088	WMIC.exe
Token: SeRestorePrivilege	1088	WMIC.exe
Token: SeShutdownPrivilege	1088	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1088	WMIC.exe
Token: SeUndockPrivilege	1088	WMIC.exe
Token: SeManageVolumePrivilege	1088	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1088	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1088	WMIC.exe
Token: SeSecurityPrivilege	1088	WMIC.exe
Token: SeTakeOwnershipPrivilege	1088	WMIC.exe
Token: SeLoadDriverPrivilege	1088	WMIC.exe
Token: SeSystemtimePrivilege	1088	WMIC.exe
Token: SeBackupPrivilege	1088	WMIC.exe
Token: SeRestorePrivilege	1088	WMIC.exe
Token: SeShutdownPrivilege	1088	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1088	WMIC.exe
Token: SeUndockPrivilege	1088	WMIC.exe
Token: SeManageVolumePrivilege	1088	WMIC.exe
Token: SeLockMemoryPrivilege	2036	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 328	1980	setup.exe	27
PID 1980 wrote to memory of 328	1980	setup.exe	27
PID 1980 wrote to memory of 328	1980	setup.exe	27
PID 1980 wrote to memory of 328	1980	setup.exe	27
PID 1980 wrote to memory of 268	1980	setup.exe	28
PID 1980 wrote to memory of 268	1980	setup.exe	28
PID 1980 wrote to memory of 268	1980	setup.exe	28
PID 1980 wrote to memory of 360	1980	setup.exe	29
PID 1980 wrote to memory of 360	1980	setup.exe	29
PID 1980 wrote to memory of 360	1980	setup.exe	29
PID 1980 wrote to memory of 360	1980	setup.exe	29
PID 1980 wrote to memory of 360	1980	setup.exe	29
PID 1980 wrote to memory of 360	1980	setup.exe	29
PID 1980 wrote to memory of 360	1980	setup.exe	29
PID 360 wrote to memory of 1968	360	Zdhdajdq.exe	30
PID 360 wrote to memory of 1968	360	Zdhdajdq.exe	30
PID 360 wrote to memory of 1968	360	Zdhdajdq.exe	30
PID 360 wrote to memory of 1968	360	Zdhdajdq.exe	30
PID 360 wrote to memory of 1968	360	Zdhdajdq.exe	30
PID 360 wrote to memory of 1968	360	Zdhdajdq.exe	30
PID 360 wrote to memory of 1968	360	Zdhdajdq.exe	30
PID 328 wrote to memory of 1908	328	Inkhxjl.exe	32
PID 328 wrote to memory of 1908	328	Inkhxjl.exe	32
PID 328 wrote to memory of 1908	328	Inkhxjl.exe	32
PID 328 wrote to memory of 1908	328	Inkhxjl.exe	32
PID 328 wrote to memory of 1084	328	Inkhxjl.exe	34
PID 328 wrote to memory of 1084	328	Inkhxjl.exe	34
PID 328 wrote to memory of 1084	328	Inkhxjl.exe	34
PID 328 wrote to memory of 1084	328	Inkhxjl.exe	34
PID 1084 wrote to memory of 1348	1084	wservices.exe	35
PID 1084 wrote to memory of 1348	1084	wservices.exe	35
PID 1084 wrote to memory of 1348	1084	wservices.exe	35
PID 1084 wrote to memory of 1348	1084	wservices.exe	35
PID 1084 wrote to memory of 1892	1084	wservices.exe	39
PID 1084 wrote to memory of 1892	1084	wservices.exe	39
PID 1084 wrote to memory of 1892	1084	wservices.exe	39
PID 1084 wrote to memory of 1892	1084	wservices.exe	39
PID 2044 wrote to memory of 1008	2044	cmd.exe	44
PID 2044 wrote to memory of 1008	2044	cmd.exe	44
PID 2044 wrote to memory of 1008	2044	cmd.exe	44
PID 2044 wrote to memory of 1984	2044	cmd.exe	45
PID 2044 wrote to memory of 1984	2044	cmd.exe	45
PID 2044 wrote to memory of 1984	2044	cmd.exe	45
PID 2044 wrote to memory of 1740	2044	cmd.exe	46
PID 2044 wrote to memory of 1740	2044	cmd.exe	46
PID 2044 wrote to memory of 1740	2044	cmd.exe	46
PID 2044 wrote to memory of 1776	2044	cmd.exe	53
PID 2044 wrote to memory of 1776	2044	cmd.exe	53
PID 2044 wrote to memory of 1776	2044	cmd.exe	53
PID 2044 wrote to memory of 1172	2044	cmd.exe	48
PID 2044 wrote to memory of 1172	2044	cmd.exe	48
PID 2044 wrote to memory of 1172	2044	cmd.exe	48
PID 2044 wrote to memory of 1256	2044	cmd.exe	47
PID 2044 wrote to memory of 1256	2044	cmd.exe	47
PID 2044 wrote to memory of 1256	2044	cmd.exe	47
PID 2044 wrote to memory of 2036	2044	cmd.exe	49
PID 2044 wrote to memory of 2036	2044	cmd.exe	49
PID 2044 wrote to memory of 2036	2044	cmd.exe	49
PID 2044 wrote to memory of 1440	2044	cmd.exe	52
PID 2044 wrote to memory of 1440	2044	cmd.exe	52
PID 2044 wrote to memory of 1440	2044	cmd.exe	52
PID 2044 wrote to memory of 1260	2044	cmd.exe	51
PID 2044 wrote to memory of 1260	2044	cmd.exe	51
PID 2044 wrote to memory of 1260	2044	cmd.exe	51

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1380
- C:\Users\Admin\AppData\Local\Temp\UltraMailer V3.5\UltraMailer V3.5 [CRAX.PRO]\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\UltraMailer V3.5\UltraMailer V3.5 [CRAX.PRO]\setup.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\Inkhxjl.exe
    "C:\Users\Admin\AppData\Local\Temp\Inkhxjl.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:328
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
      4⤵
      Creates scheduled task(s)
      PID:1908
  - - C:\Users\Admin\AppData\Roaming\wservices.exe
      "C:\Users\Admin\AppData\Roaming\wservices.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1084
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        5⤵
        Creates scheduled task(s)
        
        PID:1348
    - - C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        5⤵
        Executes dropped EXE
        
        PID:1892
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        6⤵
        Creates scheduled task(s)
        
        PID:1912
      - C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        6⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        7⤵
        Creates scheduled task(s)
        
        PID:1940
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        7⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        8⤵
        Creates scheduled task(s)
        
        PID:1656
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        8⤵
        Executes dropped EXE
        
        PID:848
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        9⤵
        Creates scheduled task(s)
        
        PID:2040
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        9⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        10⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        11⤵
        Creates scheduled task(s)
        
        PID:1932
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        11⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        12⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        13⤵
        Creates scheduled task(s)
        
        PID:1892
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        13⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        14⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        15⤵
        Creates scheduled task(s)
        
        PID:848
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        15⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        16⤵
        
        PID:924
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        17⤵
        Creates scheduled task(s)
        
        PID:1332
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        17⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        18⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        19⤵
        Creates scheduled task(s)
        
        PID:1788
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        19⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        20⤵
        Creates scheduled task(s)
        
        PID:1616
        
        C:\Users\Admin\AppData\Roaming\wservices.exe
        
        "C:\Users\Admin\AppData\Roaming\wservices.exe"
        20⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        18⤵
        Creates scheduled task(s)
        
        PID:1084
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        16⤵
        Creates scheduled task(s)
        
        PID:1980
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        14⤵
        Creates scheduled task(s)
        
        PID:1044
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        12⤵
        Creates scheduled task(s)
        
        PID:2004
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\/\wservices.exe'"
        10⤵
        Creates scheduled task(s)
        
        PID:1544
- - C:\Users\Admin\AppData\Local\Temp\Ahdzyktwl.exe
    "C:\Users\Admin\AppData\Local\Temp\Ahdzyktwl.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:268
- - C:\Users\Admin\AppData\Local\Temp\Zdhdajdq.exe
    "C:\Users\Admin\AppData\Local\Temp\Zdhdajdq.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:360
  - - C:\Users\Admin\AppData\Local\Temp\is-ORIGH.tmp\Zdhdajdq.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-ORIGH.tmp\Zdhdajdq.tmp" /SL5="$B014A,14772106,121344,C:\Users\Admin\AppData\Local\Temp\Zdhdajdq.exe"
      4⤵
      Executes dropped EXE
      PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:112
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1008
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1984
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1740
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:1256
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1172
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:2036
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:1876
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:1260
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    - Modifies security service
    PID:1440
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#menjt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:880
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#pfglwf#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:520
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
    3⤵
    PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#menjt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:844
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:1160
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe jnptkxyt
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  PID:776
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
  2⤵
  - Drops file in Program Files directory
  PID:1984
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Name, VideoProcessor
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
  2⤵
  - Drops file in Program Files directory
  PID:1988
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe agozuuesgssgjzkk 6E3sjfZq2rJQaxvLPmXgsE/xJWxvWScR7IR6i7mtqleD5ymZ75UxVXtctfHhN4sHHB+AKa1x6lugSPBeCLg0FQKdhkrMIHyCSYG5Ad9euPnDCUOfpUQJB2TLjWcQc2qjchA7riyHJQSHTcqY/nXoYEja/nfNXumql0luSimbIWHGXO0LmEnwkHRzS721QgoGnmMRstbXK6yzK6x/H1XoBQEfuS0PSS9VYqEBdyXDzTuON17kouuvrYAW2ACko24FuBWclfwYbU8E33bwmHHn5V7Yv+Sy5KrmyBSA9hlmzXd8qiBj8hwYEsKsWOM4z88j1B3xSE6xX70sTWwJDPXEtScx8QtmbvGL5zuMQlJwBpAjk1Mhu/JTK1h6LSAj/FWK8aHlCSCWs9pM4YMHyRBn9Q==
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2036

C:\Windows\system32\taskeng.exe
taskeng.exe {8C8B611A-6069-41CC-9D42-3C4833508BA1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Loads dropped DLL
PID:1916
- C:\Program Files\Google\Chrome\updater.exe
  "C:\Program Files\Google\Chrome\updater.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1580

C:\Windows\System32\sc.exe
sc stop bits
1⤵
- Launches sc.exe
PID:1084

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
1⤵
PID:1100

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
1⤵
PID:820

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
1⤵
PID:1584

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
1⤵
PID:924

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
1⤵
- Creates scheduled task(s)
PID:1688

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
1⤵
PID:1632

C:\Windows\System32\sc.exe
sc stop dosvc
1⤵
- Launches sc.exe
PID:2004

C:\Windows\System32\sc.exe
sc stop wuauserv
1⤵
- Launches sc.exe
PID:1996

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
1⤵
- Launches sc.exe
PID:1612

C:\Windows\System32\sc.exe
sc stop UsoSvc
1⤵
- Launches sc.exe
PID:1576

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "13731748822102726815-261356347-73370701-17212291114370259561676550988526571163"
1⤵
- Executes dropped EXE
PID:1340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
2.0MB

MD5
7a8a30f92ac81c2229fc5438612f2534

SHA1
326be1807b2258306a34bc4482138e54f5fe597e

SHA256
5a6d6ad150118a7c31ba4e1e7bb443d71728ee077179281cc7a8a94ce21bdd5f

SHA512
a4dbd475b9f2f2ca33d8f96cbe883198c5984809c39a942ce08a747a5826c7a4836eb4024ce93089935ab96eca775889b72312304b19c6ecb6b1356448063642

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
2.0MB

MD5
7a8a30f92ac81c2229fc5438612f2534

SHA1
326be1807b2258306a34bc4482138e54f5fe597e

SHA256
5a6d6ad150118a7c31ba4e1e7bb443d71728ee077179281cc7a8a94ce21bdd5f

SHA512
a4dbd475b9f2f2ca33d8f96cbe883198c5984809c39a942ce08a747a5826c7a4836eb4024ce93089935ab96eca775889b72312304b19c6ecb6b1356448063642

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
2.0MB

MD5
7a8a30f92ac81c2229fc5438612f2534

SHA1
326be1807b2258306a34bc4482138e54f5fe597e

SHA256
5a6d6ad150118a7c31ba4e1e7bb443d71728ee077179281cc7a8a94ce21bdd5f

SHA512
a4dbd475b9f2f2ca33d8f96cbe883198c5984809c39a942ce08a747a5826c7a4836eb4024ce93089935ab96eca775889b72312304b19c6ecb6b1356448063642

Download Submit
C:\Program Files\Google\Libs\g.log

Filesize
198B

MD5
37dd19b2be4fa7635ad6a2f3238c4af1

SHA1
e5b2c034636b434faee84e82e3bce3a3d3561943

SHA256
8066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07

SHA512
86e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ahdzyktwl.exe

Filesize
2.0MB

MD5
7a8a30f92ac81c2229fc5438612f2534

SHA1
326be1807b2258306a34bc4482138e54f5fe597e

SHA256
5a6d6ad150118a7c31ba4e1e7bb443d71728ee077179281cc7a8a94ce21bdd5f

SHA512
a4dbd475b9f2f2ca33d8f96cbe883198c5984809c39a942ce08a747a5826c7a4836eb4024ce93089935ab96eca775889b72312304b19c6ecb6b1356448063642

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ahdzyktwl.exe

Filesize
2.0MB

MD5
7a8a30f92ac81c2229fc5438612f2534

SHA1
326be1807b2258306a34bc4482138e54f5fe597e

SHA256
5a6d6ad150118a7c31ba4e1e7bb443d71728ee077179281cc7a8a94ce21bdd5f

SHA512
a4dbd475b9f2f2ca33d8f96cbe883198c5984809c39a942ce08a747a5826c7a4836eb4024ce93089935ab96eca775889b72312304b19c6ecb6b1356448063642

Download Submit
C:\Users\Admin\AppData\Local\Temp\Inkhxjl.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Inkhxjl.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Inkhxjl.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zdhdajdq.exe

Filesize
14.5MB

MD5
23d5d5e152f77b4cc7a11f0dbe96bc3c

SHA1
b72ccfad0b180b6e42160772c5007a4aff6f8e1b

SHA256
c1bae52e86ecfdfd96bc6918972a12cd36dfa56871b997c15c55fac2be87218d

SHA512
029232d6e302bd620ea5f84d35b7691d09f82ae6132a64bd49e72fa066aed925d7fb7175a9134d1039b5a91929a755504b69d3b29bb0d77ea79278a85d5aed59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zdhdajdq.exe

Filesize
14.5MB

MD5
23d5d5e152f77b4cc7a11f0dbe96bc3c

SHA1
b72ccfad0b180b6e42160772c5007a4aff6f8e1b

SHA256
c1bae52e86ecfdfd96bc6918972a12cd36dfa56871b997c15c55fac2be87218d

SHA512
029232d6e302bd620ea5f84d35b7691d09f82ae6132a64bd49e72fa066aed925d7fb7175a9134d1039b5a91929a755504b69d3b29bb0d77ea79278a85d5aed59

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ORIGH.tmp\Zdhdajdq.tmp

Filesize
1.1MB

MD5
90fc739c83cd19766acb562c66a7d0e2

SHA1
451f385a53d5fed15e7649e7891e05f231ef549a

SHA256
821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431

SHA512
4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a90592d789c4fc92b661191ffdadb176

SHA1
5cb9c07d1ab9a051afc301192e24f91283492163

SHA256
f7b835e6fc3ceec00535a85d0de3bf78446dfc260be162489a5e79d295b632bd

SHA512
b56452573412b5dbf08c25fc81943f5d3c5546e08de169f179887dfddcc95df5c628dff7204347602573747ae113a135d95662381c6254845a0e9fe0cb5b27d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a90592d789c4fc92b661191ffdadb176

SHA1
5cb9c07d1ab9a051afc301192e24f91283492163

SHA256
f7b835e6fc3ceec00535a85d0de3bf78446dfc260be162489a5e79d295b632bd

SHA512
b56452573412b5dbf08c25fc81943f5d3c5546e08de169f179887dfddcc95df5c628dff7204347602573747ae113a135d95662381c6254845a0e9fe0cb5b27d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D87AZOXN64HZFO5J99TQ.temp

Filesize
7KB

MD5
a90592d789c4fc92b661191ffdadb176

SHA1
5cb9c07d1ab9a051afc301192e24f91283492163

SHA256
f7b835e6fc3ceec00535a85d0de3bf78446dfc260be162489a5e79d295b632bd

SHA512
b56452573412b5dbf08c25fc81943f5d3c5546e08de169f179887dfddcc95df5c628dff7204347602573747ae113a135d95662381c6254845a0e9fe0cb5b27d5

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
C:\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
\Program Files\Google\Chrome\updater.exe

Filesize
2.0MB

MD5
7a8a30f92ac81c2229fc5438612f2534

SHA1
326be1807b2258306a34bc4482138e54f5fe597e

SHA256
5a6d6ad150118a7c31ba4e1e7bb443d71728ee077179281cc7a8a94ce21bdd5f

SHA512
a4dbd475b9f2f2ca33d8f96cbe883198c5984809c39a942ce08a747a5826c7a4836eb4024ce93089935ab96eca775889b72312304b19c6ecb6b1356448063642

Download Submit
\Users\Admin\AppData\Local\Temp\Ahdzyktwl.exe

Filesize
2.0MB

MD5
7a8a30f92ac81c2229fc5438612f2534

SHA1
326be1807b2258306a34bc4482138e54f5fe597e

SHA256
5a6d6ad150118a7c31ba4e1e7bb443d71728ee077179281cc7a8a94ce21bdd5f

SHA512
a4dbd475b9f2f2ca33d8f96cbe883198c5984809c39a942ce08a747a5826c7a4836eb4024ce93089935ab96eca775889b72312304b19c6ecb6b1356448063642

Download Submit
\Users\Admin\AppData\Local\Temp\is-ORIGH.tmp\Zdhdajdq.tmp

Filesize
1.1MB

MD5
90fc739c83cd19766acb562c66a7d0e2

SHA1
451f385a53d5fed15e7649e7891e05f231ef549a

SHA256
821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431

SHA512
4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c

Download Submit
\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
\Users\Admin\AppData\Roaming\wservices.exe

Filesize
28KB

MD5
c2c8e32d1ef332ed5d50c9dc8b1d98e1

SHA1
4000381867c0c640df249104fa87d416d18a0b58

SHA256
24f926c280f22a00a37eede3956f4e4031c6875fcf54b284ab1b18d9cff74db5

SHA512
0f5bf81446821c6313b847f44621bbf9fe8054ed5ed303b236f45e2568e713276ef873c1e274009336cc732b8766cc2ee83e39f7d940e7d1243a89919f23fda2

Download Submit
memory/112-104-0x0000000002630000-0x00000000026B0000-memory.dmp

Filesize
512KB

Download
memory/112-107-0x00000000022D0000-0x00000000022D8000-memory.dmp

Filesize
32KB

Download
memory/112-105-0x0000000002630000-0x00000000026B0000-memory.dmp

Filesize
512KB

Download
memory/112-106-0x000000001B080000-0x000000001B362000-memory.dmp

Filesize
2.9MB

Download
memory/112-108-0x0000000002630000-0x00000000026B0000-memory.dmp

Filesize
512KB

Download
memory/112-109-0x000000000263B000-0x0000000002672000-memory.dmp

Filesize
220KB

Download
memory/268-121-0x000000013F3F0000-0x000000013F601000-memory.dmp

Filesize
2.1MB

Download
memory/268-96-0x000000013F3F0000-0x000000013F601000-memory.dmp

Filesize
2.1MB

Download
memory/328-69-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/360-97-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/360-75-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/520-127-0x0000000002744000-0x0000000002747000-memory.dmp

Filesize
12KB

Download
memory/520-128-0x000000000274B000-0x0000000002782000-memory.dmp

Filesize
220KB

Download
memory/776-178-0x0000000140000000-0x0000000140016000-memory.dmp

Filesize
88KB

Download
memory/776-162-0x0000000140000000-0x0000000140016000-memory.dmp

Filesize
88KB

Download
memory/808-208-0x0000000004C30000-0x0000000004C70000-memory.dmp

Filesize
256KB

Download
memory/844-144-0x0000000019BD0000-0x0000000019EB2000-memory.dmp

Filesize
2.9MB

Download
memory/844-145-0x0000000001164000-0x0000000001167000-memory.dmp

Filesize
12KB

Download
memory/844-146-0x000000000116B000-0x00000000011A2000-memory.dmp

Filesize
220KB

Download
memory/880-141-0x0000000019C90000-0x0000000019F72000-memory.dmp

Filesize
2.9MB

Download
memory/880-115-0x000000001B0E0000-0x000000001B3C2000-memory.dmp

Filesize
2.9MB

Download
memory/880-118-0x00000000026AB000-0x00000000026E2000-memory.dmp

Filesize
220KB

Download
memory/880-117-0x00000000026A4000-0x00000000026A7000-memory.dmp

Filesize
12KB

Download
memory/880-142-0x0000000000844000-0x0000000000847000-memory.dmp

Filesize
12KB

Download
memory/880-143-0x000000000084B000-0x0000000000882000-memory.dmp

Filesize
220KB

Download
memory/880-116-0x0000000002250000-0x0000000002258000-memory.dmp

Filesize
32KB

Download
memory/1084-95-0x0000000000B70000-0x0000000000B7C000-memory.dmp

Filesize
48KB

Download
memory/1260-197-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Filesize
256KB

Download
memory/1440-180-0x0000000004B10000-0x0000000004B50000-memory.dmp

Filesize
256KB

Download
memory/1580-138-0x000000013F2F0000-0x000000013F501000-memory.dmp

Filesize
2.1MB

Download
memory/1580-151-0x000000013F2F0000-0x000000013F501000-memory.dmp

Filesize
2.1MB

Download
memory/1580-155-0x000000013F2F0000-0x000000013F501000-memory.dmp

Filesize
2.1MB

Download
memory/1968-98-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1968-84-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1980-55-0x000000001C200000-0x000000001C280000-memory.dmp

Filesize
512KB

Download
memory/1980-54-0x0000000000340000-0x00000000013B2000-memory.dmp

Filesize
16.4MB

Download
memory/2036-167-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/2036-185-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/2036-179-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/2036-190-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/2036-173-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/2036-195-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/2036-170-0x0000000000860000-0x0000000000880000-memory.dmp

Filesize
128KB

Download
memory/2036-169-0x0000000000840000-0x0000000000860000-memory.dmp

Filesize
128KB

Download
memory/2036-201-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/2036-165-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/2036-159-0x0000000000840000-0x0000000000860000-memory.dmp

Filesize
128KB

Download
memory/2036-207-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/2036-160-0x0000000000860000-0x0000000000880000-memory.dmp

Filesize
128KB

Download
memory/2036-158-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/2036-213-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/2036-156-0x00000000001B0000-0x00000000001D0000-memory.dmp

Filesize
128KB

Download
memory/2036-218-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download