limerat | 9f790fcb2105613d714b4adcb34572d0bba62d2f6dbf72b22bb054779695b05e

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BLTools.exe
Size

29KB
MD5

3a946215b3e2a3d8de77764e999a0eb0
SHA1

af6a6d609a095abc66c753f02b0cb1bc739e6362
SHA256

9f790fcb2105613d714b4adcb34572d0bba62d2f6dbf72b22bb054779695b05e
SHA512

f769b23b1b69eda41caa4021f0eb189ffb832ab65e90f527893af63cd9e893be61522e3ffaca9d76ba09d3fb0638622b212e097e884d747a32a0ccbbdc8deb4f
SSDEEP

384:TB+Sbj6NKoxA6bcAHL054fqDghmq61avDKNrCeJE3WNgr50dAkCtQro3lc6rxsjr:dpoS6bcwLwqhC1445N86dIR+j

Score

10^/10

limerat discovery evasion persistence privilege_escalation rat spyware

Malware Config

Extracted

Family

limerat

Wallets

bc1q0gmdxcfwzc5wnfpk36nmvuyqnuhz775nzlassz

Attributes

aes_key
hakai
antivm
true
c2_url
https://pastebin.com/raw/GmxD75vS
delay
5
download_payload
false
install
true
install_name
MSVCHOST.exe
main_folder
AppData
pin_spread
true
sub_folder
\Microsoftt\
usb_spread
true

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/GmxD75vS
download_payload
false
install
false
pin_spread
false
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Limerat family
limerat
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2240	netsh.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	RDPWInst.exe

Executes dropped EXE 2 IoCs

pid	Process
2848	MSVCHOST.exe
2808	RDPWInst.exe

Loads dropped DLL 6 IoCs

pid	Process
1980	BLTools.exe
1980	BLTools.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2716	cmd.exe
3008	Process not Found

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com
6	0.tcp.sa.ngrok.io
8	0.tcp.sa.ngrok.io
12	raw.githubusercontent.com
13	raw.githubusercontent.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	RDPWInst.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	RDPWInst.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	RDPWInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDPWInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BLTools.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSVCHOST.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe
2848	MSVCHOST.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3008	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	MSVCHOST.exe
Token: SeDebugPrivilege	2848	MSVCHOST.exe
Token: SeDebugPrivilege	2808	RDPWInst.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2944	1980	BLTools.exe	32
PID 1980 wrote to memory of 2944	1980	BLTools.exe	32
PID 1980 wrote to memory of 2944	1980	BLTools.exe	32
PID 1980 wrote to memory of 2944	1980	BLTools.exe	32
PID 1980 wrote to memory of 2848	1980	BLTools.exe	34
PID 1980 wrote to memory of 2848	1980	BLTools.exe	34
PID 1980 wrote to memory of 2848	1980	BLTools.exe	34
PID 1980 wrote to memory of 2848	1980	BLTools.exe	34
PID 2848 wrote to memory of 1844	2848	MSVCHOST.exe	35
PID 2848 wrote to memory of 1844	2848	MSVCHOST.exe	35
PID 2848 wrote to memory of 1844	2848	MSVCHOST.exe	35
PID 2848 wrote to memory of 1844	2848	MSVCHOST.exe	35
PID 2848 wrote to memory of 1160	2848	MSVCHOST.exe	37
PID 2848 wrote to memory of 1160	2848	MSVCHOST.exe	37
PID 2848 wrote to memory of 1160	2848	MSVCHOST.exe	37
PID 2848 wrote to memory of 1160	2848	MSVCHOST.exe	37
PID 1160 wrote to memory of 2732	1160	vbc.exe	39
PID 1160 wrote to memory of 2732	1160	vbc.exe	39
PID 1160 wrote to memory of 2732	1160	vbc.exe	39
PID 1160 wrote to memory of 2732	1160	vbc.exe	39
PID 2848 wrote to memory of 2080	2848	MSVCHOST.exe	40
PID 2848 wrote to memory of 2080	2848	MSVCHOST.exe	40
PID 2848 wrote to memory of 2080	2848	MSVCHOST.exe	40
PID 2848 wrote to memory of 2080	2848	MSVCHOST.exe	40
PID 2080 wrote to memory of 2384	2080	vbc.exe	42
PID 2080 wrote to memory of 2384	2080	vbc.exe	42
PID 2080 wrote to memory of 2384	2080	vbc.exe	42
PID 2080 wrote to memory of 2384	2080	vbc.exe	42
PID 2848 wrote to memory of 1104	2848	MSVCHOST.exe	43
PID 2848 wrote to memory of 1104	2848	MSVCHOST.exe	43
PID 2848 wrote to memory of 1104	2848	MSVCHOST.exe	43
PID 2848 wrote to memory of 1104	2848	MSVCHOST.exe	43
PID 1104 wrote to memory of 1096	1104	vbc.exe	45
PID 1104 wrote to memory of 1096	1104	vbc.exe	45
PID 1104 wrote to memory of 1096	1104	vbc.exe	45
PID 1104 wrote to memory of 1096	1104	vbc.exe	45
PID 2848 wrote to memory of 2716	2848	MSVCHOST.exe	46
PID 2848 wrote to memory of 2716	2848	MSVCHOST.exe	46
PID 2848 wrote to memory of 2716	2848	MSVCHOST.exe	46
PID 2848 wrote to memory of 2716	2848	MSVCHOST.exe	46
PID 2716 wrote to memory of 2808	2716	cmd.exe	48
PID 2716 wrote to memory of 2808	2716	cmd.exe	48
PID 2716 wrote to memory of 2808	2716	cmd.exe	48
PID 2716 wrote to memory of 2808	2716	cmd.exe	48
PID 2716 wrote to memory of 2808	2716	cmd.exe	48
PID 2716 wrote to memory of 2808	2716	cmd.exe	48
PID 2716 wrote to memory of 2808	2716	cmd.exe	48
PID 2808 wrote to memory of 2240	2808	RDPWInst.exe	51
PID 2808 wrote to memory of 2240	2808	RDPWInst.exe	51
PID 2808 wrote to memory of 2240	2808	RDPWInst.exe	51
PID 2808 wrote to memory of 2240	2808	RDPWInst.exe	51

C:\Users\Admin\AppData\Local\Temp\BLTools.exe
"C:\Users\Admin\AppData\Local\Temp\BLTools.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\Microsoftt\MSVCHOST.exe'"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2944
- C:\Users\Admin\AppData\Roaming\Microsoftt\MSVCHOST.exe
  "C:\Users\Admin\AppData\Roaming\Microsoftt\MSVCHOST.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cxtqtzm2\cxtqtzm2.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1844
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zwhrxova\zwhrxova.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES49BE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc49BD.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2732
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k3h5kcvq\k3h5kcvq.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A5A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4A59.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2384
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fxrnzw3s\fxrnzw3s.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B05.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B04.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1096
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C RDPWInst.exe -i -o
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe
      RDPWInst.exe -i -o
      4⤵
      Server Software Component: Terminal Services DLL
      Executes dropped EXE
      Modifies WinLogon
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabE0EF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES49BE.tmp

Filesize
5KB

MD5
e8b9ccaa2b555945634c5dd5d0510355

SHA1
a23c77004e9ebc260edf8fa38b3d2f462883d582

SHA256
1d928ab1b8c43832a38e3e3a4435ab44badbace6021a49ecedd7022e21b70864

SHA512
8c2cba16c3a2b683890339285757220dcb6ade473685718a5183c822d34b00bced608e537d771e5ce7d5890176fea5d8bdf70aaf4f1c9f11fd326a1ff0ccc4b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4A5A.tmp

Filesize
5KB

MD5
aa66527e04c54a437538fd3913cb8e8c

SHA1
d6538e17754572cd33a2a44438dc87a5ae0a0460

SHA256
2024bba9ddb69be96be71e21073f683640386e195b78b4cf415bec111e39ee3d

SHA512
4480daf9889555005d426eb3b43165c6a5cdcc920f42f7c8a8f459db44721e649e057e04d54cfff5f4eb4d5ad8783d889353abda55855cb532571c36baa9a55c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4B05.tmp

Filesize
5KB

MD5
c969dc9be46a1ec5228ce3d54bbd9493

SHA1
f7e0347ade406e6a6fbd478b58f0c0aec589b34b

SHA256
5712f9c3f46923066de8a65b6cb731f712cd0095f74cdd6537439f8f6a3eafbc

SHA512
f1c1c7bf60503590159c562cc9749effb09a826d1e85c03f268c4273bafba5907692eb5ec02d796748d41bd7ec9a50b6877edc138a47aed110293674a2556704

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE15F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cxtqtzm2\cxtqtzm2.0.vb

Filesize
240B

MD5
187bb594a40a2092383d64c298d26205

SHA1
f98804deb9c56efa375d33418a98414d71687b4f

SHA256
af6ac9ba29612e01d3b037ef5c4ce0f0a77d533e13e2f32f1a6e69a6dc3b69ec

SHA512
6a6ce71088cf52c6e3e2c4042031a69bb8426d73b733ece50d7a451a7fe8bece9721102feba773d0d1bc85145271bdc9b3cf119ea705642a4f5852c68cb4949e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cxtqtzm2\cxtqtzm2.cmdline

Filesize
293B

MD5
0fec4f1a2afcdb4f070942554ecca4ad

SHA1
f4a8cb504f10c2fb227c8458a3a5d586e16f8987

SHA256
103870a10117637c2dd3df24585e038ce38eb5e23ab845c33e9402eec04dd599

SHA512
242d99e16aeaea23a759154316ae8916e5a581a177b7bb0fc169c8a3c3fdd7adb77416a6190c41e7c7a9d3a337af36d83319b9cab6b94e7fab63857b849c8a05

Download Submit
C:\Users\Admin\AppData\Local\Temp\fxrnzw3s\fxrnzw3s.0.vb

Filesize
247B

MD5
3557b02518a27af87fe7bd9b6472a26f

SHA1
61aaa188a4f71f24336f0d1c6c448fdf0dfbf6fa

SHA256
5486d01688a9b9fc27b3fe8e56b7e4cefd99261d1a187d96abd2d728fcdcc782

SHA512
83876b87f480245019176533c5a8bd50feed7021904bb463f635eae84530186da26d9319721c334926795c72ded7f7279fae7b01fec6677ade9683f1b26265a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\fxrnzw3s\fxrnzw3s.cmdline

Filesize
306B

MD5
79ffba55dbe838edb98462a52cd30631

SHA1
308f792d9c877b4679d427c470c4b3b95853ab7b

SHA256
b4fa65474d2c4e40d9b9835c870adaddaf65f7ce3ceb7ae7571a7276d04b49ea

SHA512
4d489e66ecf1ee51a5256df1404ee03b206422f080948f882666fe83f39a4c00ead875b36631cad4ea8c46b4933d3dfef87f8f50ee378a087130c3e757d908ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\k3h5kcvq\k3h5kcvq.0.vb

Filesize
243B

MD5
00e826d6a7feea373e9cc7ad49be15c0

SHA1
a1e8658684020c46e4f34db85502ea157448e74a

SHA256
f391bff8c4c2a82f617c83e422a24ec3b90caae1e4e13d48e59d1ab9673ceccc

SHA512
1969df895f6c3b89f9e7fa1b1088393d46f4d44a1cc88618f5e071a761ad5b1300015434a2c8a50d326e76b11546c4f27d99e96b66e606a6fa59cae50f900a5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\k3h5kcvq\k3h5kcvq.cmdline

Filesize
299B

MD5
04267864c1b04999a49b5b2cb42e71be

SHA1
e61b01f164114ca86a2e613b26813e3ef188c9a7

SHA256
6a8cc6500ffa7521e59833e5982f50dc3eb25d40a8d1ce97fd18d4f8709c7ee9

SHA512
55fc0837a7048709f807eb2d3ad9582d4793e779a3c466110b95e834e96c59f3ea3054bb3d6b03af38440c1eadb6fbd582c3c91d63ec5b909b88435e68508818

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc49BD.tmp

Filesize
4KB

MD5
afe48426876eedacfdba91eb5176ecf8

SHA1
9da744cfff5427e51c2e7d091408539e03d80a05

SHA256
387dee5276fe1bb1c2c247e24436b03af42c504b6c4c48ed74ddaeae63c7cd6e

SHA512
f22abfb811911e8fdf4cb4df9d980beb9350e3be987debd4989b4a9afb0b0c45966600f013f2822adf26328335a6e39fe2326063aae8c24df5a3fcc9fcc9c926

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc4A59.tmp

Filesize
4KB

MD5
a3487b776d060a4552667931e5382936

SHA1
fe13f9c7c180fac565d5f4ce2c88b1fb8b8023ed

SHA256
d12f09ec4b6d340bfbc6ab928f127a1482e3fd6a4eff6ec090875cdfad642f45

SHA512
e06e4ea67baf67314ae42e23c9737c675f07528c9c66a0ddfc42084be4a0f086c97f10c75015c7f93bdf229e0790136844af227562107627de5b2af00d69985e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc4B04.tmp

Filesize
4KB

MD5
eb7a3f68ceac4a230a060cd5056dcc5a

SHA1
b84047c053b4e1ace70fb47df7d6ffba8551370e

SHA256
d7150437b76b84dc43c2919a4b52015c07e12771269ea8ff1c386499acd8042e

SHA512
91339d546e1bce6bb0730c77041932e1e37a006484fd7a3fd2c8de4784df41bfa0b573559159d2f9aa0aec83ffcf7c909b7ad31b5242e983bdaf2edeb1ed8cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\zwhrxova\zwhrxova.0.vb

Filesize
244B

MD5
a502dd1cdc3eec2118388ac57373b0c2

SHA1
a3cbd17720b978c4747effda0f5c5925569ea09e

SHA256
52600699de94ba82df6a885a8720b99ba4df41a670cba489eb521884824f78e8

SHA512
16420dfe4ee0353d06805c8bd7747e9cb6d77ef269f26eb242d92016f255d5eccb14125d64be45c859f4b4ecbce80a332b7bdc303a081d020a103400c794ca8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zwhrxova\zwhrxova.cmdline

Filesize
301B

MD5
879dcd9f8eadb930fe3e4d76d0f66187

SHA1
c86d3ea152b41598657ff5b0f5605a1eef191d89

SHA256
132450efceb83c760b36fc3634e04e3b03586689d75d8c5b8352bee4d0deacbe

SHA512
44d7ec5c894bfbb657bce23e9dd81e66bb376551cc98e2a15f190a79d04740eb12573b42403ad93a942279071c527a15e259fbc758537bee5cc27ba683112c6d

Download Submit
C:\Users\Admin\AppData\Roaming\Lime\ICO\GoogleChrome.ico

Filesize
6B

MD5
ed5a964e00f4a03ab201efe358667914

SHA1
d5d5370bbe3e3ce247c6f0825a9e16db2b8cd5c5

SHA256
025fc246f13759c192cbbae2a68f2b59b6478f21b31a05d77483a87e417906dd

SHA512
7f3b68419e0914cec2d853dcd8bbb45bf9ed77bdde4c9d6f2ea786b2ba99f3e49560512fbb26dd3f0189b595c0c108d32eb43f9a6f13bbc35b8c16b1561bd070

Download Submit
C:\Users\Admin\AppData\Roaming\Lime\ICO\InternetExplorer.ico

Filesize
4KB

MD5
2d14fe9fa6d3f40a6ecef5d5446a763a

SHA1
f312cd8312a41c5aed3bb609be3f7e9a1bc4f0f5

SHA256
03549b1b39e9b471c0c95a9dc673fd0c5be53ccfe81cf7811580aa59f2ed4fbb

SHA512
562f34d14216f50a7641afd2d927ee2ee0512389b097112d111a88709241f9e777d79e7f1a3ef5dd172d6efbb68d65f0161e13020baeb74ff4c16b060e4111df

Download Submit
C:\Users\Admin\AppData\Roaming\Lime\ICO\WindowsExplorer.ico

Filesize
4KB

MD5
ee136b4101d0e996d462c2c5de0beb95

SHA1
65cfa6ea0637548488e869ed8ac02c87906c0a5b

SHA256
d8b40d56ccc920590d12e1bb90c39e608e7176b97a0c4ad5acd36019e619b3d5

SHA512
faaf7f3dfcef2e2bef2cea7b99f793d1d8e114846412fd5522daed5eb58eb453c2b87a34ce76da4da9880d0d09ab6cc227a32d02fbd90d6aba25a8f04a6dbc82

Download Submit
C:\Users\Admin\AppData\Roaming\Lime\ICO\WindowsMediaPlayer.ico

Filesize
4KB

MD5
b2d35307c54450031b14fe5d694504d1

SHA1
17162851491fc499354ff1ec3dfa9912a07fb2c5

SHA256
a8543223e7c0cf878d52102af6dd4df94a6089da16caec76ab7dd98ec9297012

SHA512
02003d491e8f3d98cec43f815f9cc48036594a67052372bdfd47686e5cd3f38769b2ec43d06b560ebe43ef11813916ee006d633c84662b76bddc645d8c009886

Download Submit
\Program Files\RDP Wrapper\rdpwrap.dll

Filesize
114KB

MD5
461ade40b800ae80a40985594e1ac236

SHA1
b3892eef846c044a2b0785d54a432b3e93a968c8

SHA256
798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

SHA512
421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

Download Submit
\Users\Admin\AppData\Local\Temp\RDPWInst.exe

Filesize
1.4MB

MD5
3288c284561055044c489567fd630ac2

SHA1
11ffeabbe42159e1365aa82463d8690c845ce7b7

SHA256
ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753

SHA512
c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02

Download Submit
\Users\Admin\AppData\Roaming\Microsoftt\IconLib.dll

Filesize
59KB

MD5
45ecaf5e82da876240f9be946923406c

SHA1
0e79bfe8ecc9b0a22430d1c13c423fbf0ac2a61d

SHA256
087a0c5f789e964a2fbcb781015d3fc9d1757358bc63bb4e0b863b4dffdb6e4f

SHA512
6fd4a25051414b2d70569a82dff5522606bfc34d3eaeea54d2d924bc9c92e479c7fda178208026308a1bf9c90bee9dbcaf8716d85c2ab7f383b43b0734329bc8

Download Submit
\Users\Admin\AppData\Roaming\Microsoftt\MSVCHOST.exe

Filesize
29KB

MD5
3a946215b3e2a3d8de77764e999a0eb0

SHA1
af6a6d609a095abc66c753f02b0cb1bc739e6362

SHA256
9f790fcb2105613d714b4adcb34572d0bba62d2f6dbf72b22bb054779695b05e

SHA512
f769b23b1b69eda41caa4021f0eb189ffb832ab65e90f527893af63cd9e893be61522e3ffaca9d76ba09d3fb0638622b212e097e884d747a32a0ccbbdc8deb4f

Download Submit
memory/1980-1-0x0000000000A50000-0x0000000000A5C000-memory.dmp

Filesize
48KB

Download
memory/1980-0-0x000000007411E000-0x000000007411F000-memory.dmp

Filesize
4KB

Download
memory/1980-13-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/2808-150-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/2848-15-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/2848-14-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/2848-12-0x0000000000F70000-0x0000000000F7C000-memory.dmp

Filesize
48KB

Download
memory/2848-84-0x0000000000670000-0x000000000067C000-memory.dmp

Filesize
48KB

Download
memory/2848-88-0x0000000008F00000-0x00000000090E0000-memory.dmp

Filesize
1.9MB

Download
memory/2848-18-0x00000000007A0000-0x00000000007BE000-memory.dmp

Filesize
120KB

Download
memory/2848-16-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/2848-19-0x00000000007C0000-0x00000000007E4000-memory.dmp

Filesize
144KB

Download
memory/2848-25-0x0000000000F00000-0x0000000000F16000-memory.dmp

Filesize
88KB

Download
memory/2848-17-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download