Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

24/03/2025, 04:03

250324-emqv1swvez 10

24/03/2025, 04:00

250324-ekn9eawvaw 6

Analysis

  • max time kernel
    899s
  • max time network
    900s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250314-en
  • resource tags

    arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    24/03/2025, 04:03

General

  • Target

    https://github.com/NYAN-x-CAT/Lime-RAT/releases/download/v0.1.9.2/Compiled.zip

Malware Config

Extracted

Family

limerat

Attributes
  • aes_key

    3314

  • antivm

    true

  • c2_url

    https://pastebin.com/raw/DDTVwwbu

  • delay

    3

  • download_payload

    false

  • install

    true

  • install_name

    Eulen.exe

  • main_folder

    Temp

  • pin_spread

    true

  • sub_folder

    \

  • usb_spread

    true

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Limerat family
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/NYAN-x-CAT/Lime-RAT/releases/download/v0.1.9.2/Compiled.zip
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5884
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb15adcf8,0x7ffdb15add04,0x7ffdb15add10
      2⤵
        PID:5876
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1892,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=1884 /prefetch:2
        2⤵
          PID:760
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2180,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2216 /prefetch:11
          2⤵
            PID:3076
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2336,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2480 /prefetch:13
            2⤵
              PID:3424
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3208,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3236 /prefetch:1
              2⤵
                PID:3456
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3228,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3264 /prefetch:1
                2⤵
                  PID:4668
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4180,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4228 /prefetch:9
                  2⤵
                    PID:756
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5344,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5296 /prefetch:14
                    2⤵
                      PID:5716
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4700,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5172 /prefetch:14
                      2⤵
                      • NTFS ADS
                      PID:3444
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5372,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5148 /prefetch:14
                      2⤵
                        PID:1912
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5376,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5732 /prefetch:14
                        2⤵
                          PID:912
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4780,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5700 /prefetch:14
                          2⤵
                            PID:932
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3232,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5552 /prefetch:10
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3924
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5136,i,5457025666144868701,10134687978023954103,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3312 /prefetch:14
                            2⤵
                              PID:3572
                          • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                            1⤵
                              PID:3600
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                              1⤵
                                PID:4772
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                1⤵
                                  PID:5444
                                • C:\Windows\system32\OpenWith.exe
                                  C:\Windows\system32\OpenWith.exe -Embedding
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2872
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe.config"
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    • Checks processor information in registry
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5304
                                • C:\Windows\system32\OpenWith.exe
                                  C:\Windows\system32\OpenWith.exe -Embedding
                                  1⤵
                                  • Drops file in Program Files directory
                                  • Modifies registry class
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1068
                                • C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe
                                  "C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe"
                                  1⤵
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:5044
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule name="LimeRAT" dir=in action=allow program="C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe" enable=yes
                                    2⤵
                                      PID:1028
                                      • C:\Windows\system32\netsh.exe
                                        netsh advfirewall firewall add rule name="LimeRAT" dir=in action=allow program="C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe" enable=yes
                                        3⤵
                                        • Modifies Windows Firewall
                                        • Event Triggered Execution: Netsh Helper DLL
                                        PID:4004
                                    • C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe
                                      "C:\Users\Admin\Downloads\Compiled\Compiled\LimeRAT.exe"
                                      2⤵
                                      • Modifies registry class
                                      • Suspicious behavior: GetForegroundWindowSpam
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2340
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe "C:\Users\Admin\Downloads\Compiled\Compiled\Misc\Stub\Stub.il" /out="C:\Users\Admin\Downloads\Compiled\Compiled\Misc\Stub\Stub.exe"
                                        3⤵
                                          PID:4728
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe "C:\Users\Admin\Downloads\Compiled\Compiled\Misc\Stub\Stub.il" /out="C:\Users\Admin\Downloads\Compiled\Compiled\Misc\Stub\Stub.exe"
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4864
                                    • C:\Windows\system32\AUDIODG.EXE
                                      C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C8
                                      1⤵
                                        PID:3228
                                      • C:\Users\Admin\Downloads\New-Client.exe
                                        "C:\Users\Admin\Downloads\New-Client.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:3408
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\Eulen.exe'"
                                          2⤵
                                          • System Location Discovery: System Language Discovery
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:5948
                                        • C:\Users\Admin\AppData\Local\Temp\Eulen.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Eulen.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:3588
                                      • C:\Users\Admin\Downloads\New-Client.exe
                                        "C:\Users\Admin\Downloads\New-Client.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:4020

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                        Filesize

                                        649B

                                        MD5

                                        70f37ff50c8901a32f5c724f3a06d07e

                                        SHA1

                                        cdc3fa0f73f06fb4d578ec604cc7c95e51cfb1ca

                                        SHA256

                                        099e35b23959269d3b0e225bb016786873dba3f54e81aa65c910f1c2663a30cb

                                        SHA512

                                        029f26484b11328bbe0421d0b9023e58d438c799da08e28846e0b9811d226fba15dd80f33a272cf912268fd8c92c355e794864ae6268479d57f672fdb159de58

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2aa017a1-a306-4112-bc0a-0a465f7aac3a.tmp

                                        Filesize

                                        2B

                                        MD5

                                        d751713988987e9331980363e24189ce

                                        SHA1

                                        97d170e1550eee4afc0af065b78cda302a97674c

                                        SHA256

                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                        SHA512

                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        2KB

                                        MD5

                                        4798fc16f272b81103fa20955c667d97

                                        SHA1

                                        2fa2056417d66ad7bdc78b5f5296713879b5bffa

                                        SHA256

                                        44a837f797260b5e01228276b9cb189ac5c0a551597da834f9824a7142a144cd

                                        SHA512

                                        ba52f5cc0506f9ce436e44bbf4f8ee4951119392bed2caa95a7dcefe59ed3815f0f0fe1c7faa687fa45e5f7bee0b1c44f7e0b98c2cbdfe6c095e588894e675ba

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        2KB

                                        MD5

                                        fb76cc1fb2d83410d0cc8b97a90de278

                                        SHA1

                                        72a3fd2a795d04ef7bce031a3caf70f5fd37ea47

                                        SHA256

                                        4ca4802cd1a4736d9917dfe5b52534f1528286c1a22e0cf02d3db8c19585b714

                                        SHA512

                                        a3f99417191f593a2883e460f4e4898de638c62b7f5581502e5d4a429ec9863e58fef18b7bbb174dae46f23a0c583d78bf4aa26c3ec7d263d18b5163a180da5f

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        2KB

                                        MD5

                                        e692fd78163acf0dd6cec5bd39f50eab

                                        SHA1

                                        9fa25f13111166eefcaf231579f4dd3e4a1b76c8

                                        SHA256

                                        3f7cee87cee710545abeb693eca5d12118ec59a7f92125e86d9b204c8182d7dd

                                        SHA512

                                        0e5ea15a547bbe5ce502f2f4208b2a4e13fb8a362b241c6054d3e9f5c7b3404539af533bb479cfd7231de631cd79708979ac4b880a43990fbb5274de091b0b64

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        523B

                                        MD5

                                        0dbed948a02c584b3d6ab1b86b1fa24c

                                        SHA1

                                        15756ce7ee20f27d9a24f645970645f3ff1b9cfa

                                        SHA256

                                        be0fd57e5e210cc9519e3bcb35817bfc9a280bde52eaba18915f9955f03e21e3

                                        SHA512

                                        cd260db5a062b9e14b19a790d16fefab0ae68d803d8469b6f5b3ffeed3f31d2ee732f0875398134392cfd38003917ff9e9052dbbf03c585718b7507c8835ce17

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        10KB

                                        MD5

                                        a40a5cb2a7a6de2562fa3b659a0b9180

                                        SHA1

                                        54a8971a28b3534dc963b18faf04b96c390620e3

                                        SHA256

                                        7edec49afa4a62f062efa510b11ddfc144d377d36725aa41e952522536cdcf56

                                        SHA512

                                        540716491ac030dcda3960749ebfe86d05589c76544198dcb26a1fc2392792cbf369cd2ae041fce296b42c6436c27a6442f44fd685921778fb0fa5f8c0305bb3

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                        Filesize

                                        15KB

                                        MD5

                                        0c4ee74392bcb9c2651fb89da5d6ea38

                                        SHA1

                                        3b0c059f0763113bc1f02ff5dcbc7ab421b9bb30

                                        SHA256

                                        271186f51c93e49b8e397d63570f77ed64355ad873c825457f56c4be696da869

                                        SHA512

                                        0c69717b1882b08f112a904faf5b582497a6ba83dceeb00e15c8522c1557dc55e25ee27713984c27e49a24c9d84606c6cb4edd41168ee16587e07a3402257080

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                        Filesize

                                        72B

                                        MD5

                                        848df3de79064e96a55e9d2306a1e483

                                        SHA1

                                        68b2adf31add077a933385fbd389a8bc6206c29a

                                        SHA256

                                        479bbbf222e95ad378b260cfd03f8320c9e91d72ed8e92809256e925c4a3fb79

                                        SHA512

                                        f5481245ff6239524f0eb545829a663e4b4e7260f434cf280949868ec6ae3544d5ec30b143668eb17854cfecac67e69dc38ac005a1e3f59db95b4f34cfee61b5

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c217.TMP

                                        Filesize

                                        48B

                                        MD5

                                        7cc4a384dfbef6805f89c91bdc5209db

                                        SHA1

                                        2a49929e4b412ef0bc134030dba7b5de2977004a

                                        SHA256

                                        304f70551892eb6ab2cb2fb67c3084ecee539f3747a2fcdc0fde2d1db9d846b5

                                        SHA512

                                        9de11bc0264dbc878ed9b5836049b7fd2ebb57862da2e832fa81f1d37d2a861fa3cea67532c437a0f4e992ccb534af8de43ac9d5e04bc164085240a122d23353

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        81KB

                                        MD5

                                        7ef75ab7fdd37539d7b38127a4c6c30a

                                        SHA1

                                        81085eb75a2a8f454e731b5402688e4646f0dca5

                                        SHA256

                                        d134afa9709b45782a06cc6859ff7a9da8199482a9c19a02535d24644ad067d5

                                        SHA512

                                        f77063be9541d29907077f4f51eca0380dab7d9804e59611ee4a552368108c12cc91a89792490e6cee336849118d99a5a811575760ecca9ca5e004749a1ee23b

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        80KB

                                        MD5

                                        e2e54a79be168abeee771c6153efe3b8

                                        SHA1

                                        68186c4ed522f40257b11d0b078901ba29842790

                                        SHA256

                                        b247f1410b95e0846d4d29dbf4866c80eff16ce7fc8dd6b529c367c75d92cf48

                                        SHA512

                                        6ec04abe12e2a14550e827e8848739f8553103b6db4a57df14ac7c19aca5a25ce1112439e571dc70640a59d8a7bca2a86d35ce995830832dadf15802dda2ff65

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        81KB

                                        MD5

                                        ed585ee73268aea75818759047cfc336

                                        SHA1

                                        1ee3685b0c894ae331c8113aeaf9b0ba40da2028

                                        SHA256

                                        735108d33d92d63db65f8fad8150c9fe34af67270d88c05c8b6ab0d802cf93e7

                                        SHA512

                                        d80324690883185a901328ad182ad52fe3f490b83038e4218437c86c248baf2ce225262d6fea7755e6ce90298e001b163bfbf8a989d9d6ccafaeeecb4a68121e

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        81KB

                                        MD5

                                        5b62492244a3250818bcb8771a77e173

                                        SHA1

                                        3c5b46514ccf80e88229778f75da85892ebe5c1c

                                        SHA256

                                        7809e3a407c6ba1eb175c7a907f3d06e481c1caaaaf6d53840d55a587673c7ae

                                        SHA512

                                        078b6de72e5a8da8644c26d29a1960dad37c1ab2475a03303246730ffafb6801438d767043fc9c9507644fca98daea609cf3a5676f274140595f9b2a9aeedb51

                                      • C:\Users\Admin\AppData\Local\Lime_RAT\LimeRAT.exe_Url_svvmbk54fumvnksdeatxsj5e4flh5yeg\0.1.9.0\user.config

                                        Filesize

                                        306B

                                        MD5

                                        9a990d0ce47fd366948757bf4c78dfbb

                                        SHA1

                                        4aed5c56a8af149e4ea193ea60f83ecb0bfa41a6

                                        SHA256

                                        fc5d08acbf02dc086a8fa4b7703541f17a729b2774de9fdea107c07973617a42

                                        SHA512

                                        5a841689c7b49b349e64c679f96f6ab968addc38917bfec6399285e3c303e03392b00c6cf70ad2a94540c2e3cf41555d08d342ce3392372e9d9f1a69b1fc7786

                                      • C:\Users\Admin\AppData\Local\Lime_RAT\LimeRAT.exe_Url_svvmbk54fumvnksdeatxsj5e4flh5yeg\0.1.9.0\user.config

                                        Filesize

                                        1020B

                                        MD5

                                        f4692f2aae3348c1173d4d4223325fdb

                                        SHA1

                                        fcc2744869d33f467706633a761dc865bb1d7820

                                        SHA256

                                        f1234fb933ffe12bf776c89114081b027c652bf8a4f6b2b66d54c517f5eba0c8

                                        SHA512

                                        5e95684fc386e2525e301e89bc59033109d936864c85d48a6fa59aa1f6b2b18cca6b6cc3dfbd0d66f5f16c7a64626f26041792113486b48ab423978d21ea04ad

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\LimeRAT.exe.log

                                        Filesize

                                        2KB

                                        MD5

                                        6aac7e99708ca30e1e6f3b5c0be0a9b0

                                        SHA1

                                        b7def50c4f65eeb7aecd8b87bc9310c04b055615

                                        SHA256

                                        6ab9d6ecdfb4fadfc5ea114c6109d00bfdf2c2e57e8b8c46a4e569747ac2182f

                                        SHA512

                                        ad16af099207a9a7f13882e59b89106024d64f273dd7df51558c9b61cfa7f6b720dd320e825f0368d44f7e9c476b75b83bb1e8bd526a42d7d32017c8169402fb

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New-Client.exe.log

                                        Filesize

                                        709B

                                        MD5

                                        cee382b44a0a258c801e5df212da62dd

                                        SHA1

                                        85bbc4b6608782987db1a61729e62ec4a7e69371

                                        SHA256

                                        0bd749db0dc336f89c80dc04a6522df03c13bd3ca7ec1b5a54ab01413b6ad6c1

                                        SHA512

                                        41cd658e569f09ab15c46cc716c576f6ef4862fba47547b09a8576ffd05009465973643c0a5a25d0801adc7be6ba6d3ef7d1e62d0b8a1f0823dfe80c17930dd8

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

                                        Filesize

                                        28KB

                                        MD5

                                        91630de96afaab78fd4c1a3011b9345b

                                        SHA1

                                        012978d8a6cbbbfefb14140a51ad9632ecdb2993

                                        SHA256

                                        f0ebab369467500c558f8eaced1c4db773148124269f14a39403f0fb95290e2a

                                        SHA512

                                        a7b1b95867f7d81b78d33fecec8c572b11a5163a78e3531db72635ae15401ea3293d4eb9255204454e45e56260116c9863268834829e713bf4565c0e0042ae4c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

                                        Filesize

                                        28KB

                                        MD5

                                        35591e628915713d4385dfca0921ed39

                                        SHA1

                                        85c60c2f5465fa6166cc040ca6e6a0e9cc3c7c31

                                        SHA256

                                        7ebd3609f49437840f2abd8ce5bf03a8347900ac1cbff157eec32d5602dc8aa3

                                        SHA512

                                        9e54d2de604f2a9321031bd1b3b24f133d10b4d2e09fc0fc5f84e7f5ac9026dd574af19d09cf60abf560ff888e58f6edee0b98407b3f08f7ef4c84341ed62854

                                      • C:\Users\Admin\Downloads\Compiled.zip.crdownload

                                        Filesize

                                        5.1MB

                                        MD5

                                        5aee9b1a15d337d2b4aefe840cc90dd1

                                        SHA1

                                        11a430b1ad789fef66effaa6a3f79139be0dc66b

                                        SHA256

                                        06500a1a2f152b59ceeb662d7bd5bb07175bf45a9c2528b2f6de58394ada4bc5

                                        SHA512

                                        fa344212957dfb65f194fb220814688d748439d7ea921ad33d8c6fe6cf5b6fe04e263ff686efae17556f4a1db47069e295deedc486b8088b4d0af23fb63742c9

                                      • C:\Users\Admin\Downloads\Compiled.zip:Zone.Identifier

                                        Filesize

                                        26B

                                        MD5

                                        fbccf14d504b7b2dbcb5a5bda75bd93b

                                        SHA1

                                        d59fc84cdd5217c6cf74785703655f78da6b582b

                                        SHA256

                                        eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                        SHA512

                                        aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                      • C:\Users\Admin\Downloads\Compiled\Compiled\MISC\PORTS.dat

                                        Filesize

                                        6B

                                        MD5

                                        05ef5741f06c59dc5a0badcd711bb1d8

                                        SHA1

                                        64cae4add164b296e215661f678264315bfb3cfe

                                        SHA256

                                        5003b0292f6a7070e163c9a676fde208ea4a5e9fe9692141fe7f870d0cc47ef8

                                        SHA512

                                        365a342a5f09496a354284041bf81f55f073eb53dcacf575d70f29e19ad5faabf0807299e490d7d6de25cb8bb68fede041d214c3c0b9b61ec76fa028fef69fbf

                                      • C:\Users\Admin\Downloads\Compiled\Compiled\Misc\GeoIP.dat

                                        Filesize

                                        1.2MB

                                        MD5

                                        8ef41798df108ce9bd41382c9721b1c9

                                        SHA1

                                        1e6227635a12039f4d380531b032bf773f0e6de0

                                        SHA256

                                        bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

                                        SHA512

                                        4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

                                      • C:\Users\Admin\Downloads\Compiled\Compiled\Misc\Stub\Stub.exe

                                        Filesize

                                        26KB

                                        MD5

                                        ab4a190f9bedb408e459ed6430131129

                                        SHA1

                                        863931a40f6b1a2dc550e406f34d19ef5289a734

                                        SHA256

                                        ce8a36d92991096fee1fe01c517d3ee8efcfcf76da589ef74215edcd231c6a81

                                        SHA512

                                        a4f2e58d365c8de3081b5dd16a3508e3daa896eae62db013fccc1b6d9cf184032238c6fb74552a60b55a893ac3e56d1ca59f367dcdce376416090af5b27c91fb

                                      • C:\Users\Admin\Downloads\New-Client.exe

                                        Filesize

                                        28KB

                                        MD5

                                        dbd23f575813c0405e4898e120dac209

                                        SHA1

                                        a5886f7e1ac19500d3233efd54b4c38641d5c617

                                        SHA256

                                        e825ec0892f5cae9842a9cc247929227231a02baa0350bd6b61556377cc92e46

                                        SHA512

                                        8fdc7262a3c7447ce4c6a1ab8eaf5e1d5ae3fd0d1b32673008a3e0b87bb2e37bcec0541671629dea642a5207ab2498e27ad3180e2658bcfb8710817538dd4c56

                                      • memory/2340-235-0x00000239FFF90000-0x00000239FFFEA000-memory.dmp

                                        Filesize

                                        360KB

                                      • memory/2340-221-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-203-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-204-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-209-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-210-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-211-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-212-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-213-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-214-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-219-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-248-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-292-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-231-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-232-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-233-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-234-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-280-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-278-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-240-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-241-0x000002399D8E0000-0x000002399DA9F000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-276-0x000002399A760000-0x000002399A913000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2340-249-0x000002399D8E0000-0x000002399DA9F000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/3408-252-0x0000000000F60000-0x0000000000F6C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/3408-253-0x0000000005900000-0x000000000599C000-memory.dmp

                                        Filesize

                                        624KB

                                      • memory/3408-254-0x0000000005860000-0x00000000058C6000-memory.dmp

                                        Filesize

                                        408KB

                                      • memory/3408-257-0x0000000006550000-0x0000000006AF6000-memory.dmp

                                        Filesize

                                        5.6MB

                                      • memory/5044-145-0x0000024C7B310000-0x0000024C7B3BA000-memory.dmp

                                        Filesize

                                        680KB

                                      • memory/5044-196-0x0000024C7A370000-0x0000024C7A523000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/5044-135-0x0000024C7A200000-0x0000024C7A22C000-memory.dmp

                                        Filesize

                                        176KB

                                      • memory/5044-160-0x0000024C7B070000-0x0000024C7B092000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/5044-163-0x0000024C7A370000-0x0000024C7A523000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/5044-191-0x0000024C7A370000-0x0000024C7A523000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/5044-192-0x0000024C7A370000-0x0000024C7A523000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/5044-134-0x0000024C77560000-0x0000024C77C7C000-memory.dmp

                                        Filesize

                                        7.1MB