Analysis

  • max time kernel
    1648s
  • max time network
    1140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-07-2024 14:07

General

  • Target

    lime.dll

  • Size

    7.8MB

  • MD5

    10c074a00debe4a97608e78cb36247ab

  • SHA1

    779125eb7faef7e549eff67eeb55c177a8dfbc70

  • SHA256

    2c1d1c6cc6fea441623d1cdc663656f171fa66d92809a157915c2ada06a121cf

  • SHA512

    86080ba0ad936148f46f3cc56c8b5c474c72b9089657e7bd21286a2a2114eb07f20870e0dd96318685024ab929d17a382529c383049b7bd056553c4565473485

  • SSDEEP

    98304:z0A/ndXX+HO+M16KrdFLJRzdfiHy4AyBS6iHIA198:z0wXX+Hc1nrtRgz

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

  • Chaos Ransomware 2 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 34 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\lime.dll,#1
    1⤵
      PID:3584
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9a067cc40,0x7ff9a067cc4c,0x7ff9a067cc58
        2⤵
          PID:3712
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1876,i,9445043948716550092,3622768390166367578,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1872 /prefetch:2
          2⤵
            PID:3120
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,9445043948716550092,3622768390166367578,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2376 /prefetch:3
            2⤵
              PID:5100
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,9445043948716550092,3622768390166367578,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2504 /prefetch:8
              2⤵
                PID:3400
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,9445043948716550092,3622768390166367578,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3192 /prefetch:1
                2⤵
                  PID:1808
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3328,i,9445043948716550092,3622768390166367578,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3444 /prefetch:1
                  2⤵
                    PID:4436
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3736,i,9445043948716550092,3622768390166367578,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3700 /prefetch:1
                    2⤵
                      PID:1628
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4844,i,9445043948716550092,3622768390166367578,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4856 /prefetch:8
                      2⤵
                        PID:4140
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4964,i,9445043948716550092,3622768390166367578,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4980 /prefetch:8
                        2⤵
                          PID:560
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4780,i,9445043948716550092,3622768390166367578,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5028 /prefetch:1
                          2⤵
                            PID:468
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5276,i,9445043948716550092,3622768390166367578,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5336 /prefetch:8
                            2⤵
                              PID:1912
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5340,i,9445043948716550092,3622768390166367578,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5388 /prefetch:8
                              2⤵
                                PID:1764
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5312,i,9445043948716550092,3622768390166367578,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=240 /prefetch:8
                                2⤵
                                  PID:4124
                                • C:\Users\Admin\Downloads\WareY666.exe
                                  "C:\Users\Admin\Downloads\WareY666.exe"
                                  2⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4296
                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                    "C:\Users\Admin\AppData\Roaming\svchost.exe"
                                    3⤵
                                    • Checks computer location settings
                                    • Drops startup file
                                    • Executes dropped EXE
                                    • Drops desktop.ini file(s)
                                    • Sets desktop wallpaper using registry
                                    • Modifies registry class
                                    • Suspicious behavior: AddClipboardFormatListener
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1516
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
                                      4⤵
                                        PID:3488
                                        • C:\Windows\system32\vssadmin.exe
                                          vssadmin delete shadows /all /quiet
                                          5⤵
                                          • Interacts with shadow copies
                                          PID:516
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic shadowcopy delete
                                          5⤵
                                            PID:3828
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
                                          4⤵
                                            PID:3308
                                            • C:\Windows\system32\bcdedit.exe
                                              bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                              5⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:4080
                                            • C:\Windows\system32\bcdedit.exe
                                              bcdedit /set {default} recoveryenabled no
                                              5⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:644
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
                                            4⤵
                                              PID:788
                                              • C:\Windows\system32\wbadmin.exe
                                                wbadmin delete catalog -quiet
                                                5⤵
                                                • Deletes backup catalog
                                                PID:116
                                            • C:\Windows\system32\NOTEPAD.EXE
                                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
                                              4⤵
                                              • Opens file in notepad (likely ransom note)
                                              PID:748
                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                                        1⤵
                                          PID:4556
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                          1⤵
                                            PID:3996
                                          • C:\Windows\system32\vssvc.exe
                                            C:\Windows\system32\vssvc.exe
                                            1⤵
                                              PID:3200
                                            • C:\Windows\system32\wbengine.exe
                                              "C:\Windows\system32\wbengine.exe"
                                              1⤵
                                                PID:1836
                                              • C:\Windows\System32\vdsldr.exe
                                                C:\Windows\System32\vdsldr.exe -Embedding
                                                1⤵
                                                  PID:228
                                                • C:\Windows\System32\vds.exe
                                                  C:\Windows\System32\vds.exe
                                                  1⤵
                                                  • Checks SCSI registry key(s)
                                                  PID:4856

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  ba19eab0c044686fefdaab7a18dec5a9

                                                  SHA1

                                                  fcabc4c6305702265760dec3068291f46250806e

                                                  SHA256

                                                  97053421b8462a6a0e23d56ed3ed1b7afbfb727d483c41c63c9e5e7a8ce0cde4

                                                  SHA512

                                                  c4e078a0479770480e694aceef4f27f3e043cd9334c05225868536c2d7093fc1ab0e23627151c974b40c62544460d6174234ffcfd088ea37b070faa42e6bf384

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                                                  Filesize

                                                  264KB

                                                  MD5

                                                  c72c635b9640cc1d5c33b9082dbf72f9

                                                  SHA1

                                                  68f0242fcc0a24781014bf1839fccf57bb1bb9f7

                                                  SHA256

                                                  dfeefaa9e8b921e73d6ba5b9b618780af7c234a9f41cc4bd3c324b6b94ced2e5

                                                  SHA512

                                                  a6d16291cdf64394bde228e75c5e7be56f06f00ba28fcc37d9a842757a6b2e19295b27576f07c8af62f3d5897ca62bbb4a11efdd02de1ae3c5c5a58f16545b1e

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  eb28b76d71168737c3342d6fcdacb1cd

                                                  SHA1

                                                  7a14768c105fe07da02aa6f583dedb62e1e92791

                                                  SHA256

                                                  f9cfef0a3a85b5709b74e5f1ce262b64dc10cab6f944e285e21e5e609e6652f8

                                                  SHA512

                                                  e8c5e356edb79ff52eaf59637b31f2646ab3c03abaf5296ba6aff3c81850704c20aee705ae5c153a89ecd5c00904008799dc92214c27e85e1db628d9f912014a

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                  Filesize

                                                  2B

                                                  MD5

                                                  d751713988987e9331980363e24189ce

                                                  SHA1

                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                  SHA256

                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                  SHA512

                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                  Filesize

                                                  354B

                                                  MD5

                                                  2d1fe9f970ca7bdf515fba57d71a3aa7

                                                  SHA1

                                                  f61aeaaf877b1201779182fe3520345279e0b16c

                                                  SHA256

                                                  552641b6a3a05b6e430beb58dc8421ad331e700c4d105d5e886ed8d49fe2db5b

                                                  SHA512

                                                  4489ff67fbc2f526ba3604574b69faa25384b1a2ce792af9a657ae77125809feaa5a47b6997215312b8f1eea8d5773ad91d832bdd45065d8644d6cae2eef56d8

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  3cee2c567ca34c1717ec095bc2103de7

                                                  SHA1

                                                  a23678732c4a88c0e87e8959738573b611ae8585

                                                  SHA256

                                                  e8e3e673022d33db8133f9c3caa4b268c99ada497f75286786bae22d1b31d9e4

                                                  SHA512

                                                  880a28c23afd26a9b9732770e8613c29dff133bc992f249cbfb63a5e46eb7924748d29bb7b78a8a2c8548213ee2220e3b87c9b2cde8a87a4ed691652f063248d

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  9KB

                                                  MD5

                                                  1b5460b44299cc8f891362b173579393

                                                  SHA1

                                                  0010c592154f9846df33ecedab72d1ae2375795b

                                                  SHA256

                                                  107a2d9e706978b3fa56c5410219b95a0f2351b1ace87e8779f8231a9c284b29

                                                  SHA512

                                                  52a502a0a1054d00947c9448ff8b89a23db6bac0124a9d4a0a2c86563f9470a38dd06395413a388f0ef067bd81d6ff780c50647141ae7be9b69fcdd1948fb382

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  738460da820e56cb4d188a9ad916c8eb

                                                  SHA1

                                                  db017cc5edfff16d3543b68f8c38e1926e774cf6

                                                  SHA256

                                                  c9467e7b7e56a3db7899af5ef4fa6c94acc0bb094c3d86ebd883b72c9dc50e2e

                                                  SHA512

                                                  86cd5580ac62701ddf899dbef392eecf00d8eb3b9e9e15bc673b61adfda6f9ac3864beb5ac520fccd3508a2f0a3852da67adde4e42fd7d6840a63428260bb088

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  9KB

                                                  MD5

                                                  a7dc60cd1eeb320fdb2467d067636376

                                                  SHA1

                                                  9a8a14ce387da7a3c09080cc631a773aa95eaf9a

                                                  SHA256

                                                  e8be2b1d7dc6faf6c6b203722ea9590c6d91eaf7fd22eb454d0c8905f5223730

                                                  SHA512

                                                  71c4d96fb1356bfcc5b79018bed9a406172a59306504b7a37b842daa06451ac2d9b63ee0e6f8e736edde9c6d6853c6a5e3b6594ec1df91d88004f38caa371a8c

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  7825226ed0f43cabf8ce286e850a0a66

                                                  SHA1

                                                  eb2172695808cc2e8f38e91c28c32ac77f8e34b4

                                                  SHA256

                                                  d990549b5a65ed5d9e686986bbc6a25fbc3f7a96604cc4f173ca587343e03cbb

                                                  SHA512

                                                  3ad46c0b9995f0aceea28b2b3b8d86b65e9cb80c583b4db642d83169272a08b796e1b2e24ace19a6acab4e5c2b9fef399e1899f3fe311b0916e733b920f2dbf4

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  10KB

                                                  MD5

                                                  0e4f69bb47d214d02b7f7ee0fc95bc4d

                                                  SHA1

                                                  6a207107478ff2ceb3f9e88957a90214dbb682f9

                                                  SHA256

                                                  a3b8312e0fd81757f324f6bd6e450803cc268565899f00339038dd282d479bec

                                                  SHA512

                                                  cfa743ded7931ab91ecc8ef1fea2c6bdae9e0b7125030168d5b3af142651fd16a2f9cd5ad615ad678f45a93fd82450ab53809d179cba0f367b71014517bb469f

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                  Filesize

                                                  15KB

                                                  MD5

                                                  40ecc6ce2cfdf6a670c178edce2b25bb

                                                  SHA1

                                                  a1d13269fc9e9205cd6c54172e13978902d439d7

                                                  SHA256

                                                  86d66fab37f0c08ca3193f97526153f939265c5f7d096e79becd727630be8106

                                                  SHA512

                                                  6532e7550952b8d37896faf990537bf33982fe607872a4da34a13ba30df26ff14da8d263755aa000cb3b658167148ab5e47c9837ff426b1fa4328751522b8711

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  182KB

                                                  MD5

                                                  b1f725739096e33697d85a2c77110d66

                                                  SHA1

                                                  6811f04640e6ceb29d17d47273746dc4c80b1b28

                                                  SHA256

                                                  6ee50b066e52ec8fe561aec0b6f42400693f09c2fc8a3b9005d2bb62857c4afd

                                                  SHA512

                                                  1f155cec83dbb22a78f8831a1e46bc182f51a44c4bc365292d5e2f599fe64a700fcccfd4c5d8856c2872775f3b2d500bc305f79ea1467547d371b2d8003869b5

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  181KB

                                                  MD5

                                                  370f47de015b6cc96cde71d87297d214

                                                  SHA1

                                                  4af1c9b94ee553cbb1f49fa46001d76f37689d2c

                                                  SHA256

                                                  a55aa03bd6d132c2168e28429726cafad35cd029e7172aec99b4e50566b6b59d

                                                  SHA512

                                                  27239277681106666ea4a7d3060889bee9d485f5ccd5f1e3ac452b7539cda5fe8d822c7319da1e6532759f23bfb0d84d7b374247da17dcb306a27894840ad719

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  182KB

                                                  MD5

                                                  ea28d2061b9a30e269493ea23029a5e1

                                                  SHA1

                                                  3b03907960592c40acac9952e2025a57a3390936

                                                  SHA256

                                                  f04b27c7162943949d550bbe1ff6d2db005ecdfd1dab2e818c870f1093f0de03

                                                  SHA512

                                                  26c97129fbb89a8a9fa707fa01f0f159018d77dd2b47ae81e56f909e6d126113795fc93d152d6f4e7ffa85f2dc31582cce465b74d629d994867f8e25b18f33cb

                                                • C:\Users\Admin\Desktop\BackupEnable.xlsm.627i

                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  0e765ac05c67a217712700ef0d0238c9

                                                  SHA1

                                                  a7a38441eb5bc103fa99151a0a903abb4758545b

                                                  SHA256

                                                  aafd1249b72a1aa95563fd5e009989c3c1937faede943ed11d5d935201564b09

                                                  SHA512

                                                  2892ffa9a903023463fb506818f2c27f33be3a560eecb1640f1b803af8e292d508fb6aa63e393b9230e5690ac68edc1466f4c8bad2e532aaed1ee861f492c3aa

                                                • C:\Users\Admin\Desktop\BlockRead.mp2v

                                                  Filesize

                                                  476KB

                                                  MD5

                                                  f3043ce224415e84db2087ba06f2ef37

                                                  SHA1

                                                  57ad810f2cd2876b5399a82744f34e033e0081d6

                                                  SHA256

                                                  cc1f3a5dd408b5d236dec394ec17228ac561e9b0e299e2024bb1584ecbd064ed

                                                  SHA512

                                                  5731477cc6787fb5aa592736dcb1afbcda0515fdddfb0af0f9d40b2d29f896a00bf8cc609f8699e677fd9faf33267e886f6be53562a53616e6163752b569f4ce

                                                • C:\Users\Admin\Desktop\ClearResolve.bat

                                                  Filesize

                                                  285KB

                                                  MD5

                                                  2931aa615e8a67356b6ef9ca1b5b0940

                                                  SHA1

                                                  ed0d64312a16da391f72244f8390bfbb60bc6235

                                                  SHA256

                                                  0de06d6626d52d6346582ebdf503ca765c1b06c16bdb386c1c5628e048f8fc7b

                                                  SHA512

                                                  fe40c2fa87200b37722b3d32e93719eccfcee877daeefe2e9a6744d2319b325e7c56d2d7e3fc52aeeee4621af399686f8cc61c2f0048b96daf89b6d4cfe7c2ad

                                                • C:\Users\Admin\Desktop\CloseConvertFrom.dotm

                                                  Filesize

                                                  247KB

                                                  MD5

                                                  c2faa4ee8646eb95475860beb7f1ef2f

                                                  SHA1

                                                  4badc115a0ac0bb289949ea9abd3672e65ed2930

                                                  SHA256

                                                  db3dedcb99432d28b6e8ba5ac9c56afd09e149daeae2c06de1694025d2b445d1

                                                  SHA512

                                                  9ca87dbf38e4d922b3b6cdab6b025aec8eedea82473b05ba3376151014798919a04cdaa844981b1b2ebc826d04d256b91b62db132c300391470a89f86c623e81

                                                • C:\Users\Admin\Desktop\EditDebug.docx.yz54

                                                  Filesize

                                                  23KB

                                                  MD5

                                                  393e0ef90989a752c830a8da996bb6d7

                                                  SHA1

                                                  856766b7aa3277a9ff8052678599ec637669c6af

                                                  SHA256

                                                  6a121a2b6f69bceb30a9ef074362137258cabfdc6aaf003274c81ee6b5c5b373

                                                  SHA512

                                                  0c7a42c283f40bcb50413d6598c33ad0ebe0ed5f6dc4934a2707d3ea73bdb58a21eec65042a0bcd1fca8e71bcf19e495242f14688d28f0db391bb008b70ecae2

                                                • C:\Users\Admin\Desktop\EnableDismount.aiff

                                                  Filesize

                                                  399KB

                                                  MD5

                                                  11b544a703b2742bb8677bd1e984d0fe

                                                  SHA1

                                                  0dc23da4aa3ab6f8ee52d101daabe71336e97341

                                                  SHA256

                                                  82ac1d918a7786a596953ec4a461f7bdf4fa838e5c8ef880d94facde5fe014eb

                                                  SHA512

                                                  f5abb210804174af02d830c0e766c577016328883d355234a4a55c1bee79d2ae04e8a107cb706a0ad181e41b9ec661d8c8d7a7fd6443627f2f97ca6c2784d48c

                                                • C:\Users\Admin\Desktop\FormatLimit.pptm.ogd5

                                                  Filesize

                                                  406KB

                                                  MD5

                                                  299f0987fb0b23b651ab65a6de6fef2e

                                                  SHA1

                                                  9d8c8e255f16e79a540c610cbc5b8e1b95824659

                                                  SHA256

                                                  83712efdca5a7b520ee0e502aa194553c14d5d6ee32d6909641362211827198c

                                                  SHA512

                                                  d98e08c22f1ca507bc78f2374e2895af8b3e8b8ee1fb5a518cbb81ab4440a7de981fb45455ee1427d5fc2e3a5d540dfb0642be166dde33d49f01d2166423761c

                                                • C:\Users\Admin\Desktop\ImportMeasure.vsd

                                                  Filesize

                                                  533KB

                                                  MD5

                                                  df6c5992f67f92c2c1d7680b84b13a99

                                                  SHA1

                                                  f2e2e620dc7a408177e7bf1e3bcd6f4e07d0cb35

                                                  SHA256

                                                  d37ed49fcbc63f76f62c9001b12821142e57ed71d1c41f6985ef49720a9cd3b9

                                                  SHA512

                                                  43e4b5059b5551fa5c60a7536dcd0b107d972db2e072d9cf3df1beeb77f12dc1e30c8e4020481d1313c0ce42ffe9ea76ab1141d51ca10b0b300b086d09c716f8

                                                • C:\Users\Admin\Desktop\LimitConfirm.tmp

                                                  Filesize

                                                  323KB

                                                  MD5

                                                  24dff3282dfc353b2222b42600e11661

                                                  SHA1

                                                  f667dfd1c726e41723febdc1b6127f4990cb376d

                                                  SHA256

                                                  4c7ecb07ceaa8d4b73d8688add11bb7a8f2867b1439268403bf2a4fd09501ab5

                                                  SHA512

                                                  319a982af23f63bb6805f5ba7eee399284db7ad30fa31c8e8265c31347f4a05a3b001c66081e29835f14c98d3da4d23d21c35109cc712e140052ca10a5171782

                                                • C:\Users\Admin\Desktop\LockMerge.xlsx.jn6r

                                                  Filesize

                                                  13KB

                                                  MD5

                                                  af5aa860e32156bcd8fe60ff289e9491

                                                  SHA1

                                                  197dc6f7c556d897bcb27cfbf23f97cc93fa7092

                                                  SHA256

                                                  12c054071baba3f22254099ed1061484d5794bc9b6537d0c0c34aa1e6743bf4c

                                                  SHA512

                                                  6e880238ab723309f7eba0610b5237db831f112a9b4c716d9b03121539f082f71f4fb87ecae502b96e2f81a2033be9463db1b472abee034b9fc67777b7cefdb5

                                                • C:\Users\Admin\Desktop\Microsoft Edge.lnk.spu3

                                                  Filesize

                                                  3KB

                                                  MD5

                                                  d18e6d6e66981a4feb4760056b7fca4b

                                                  SHA1

                                                  b67e7d21defdbdb1e4dfcf0100d8c0209fef7d2a

                                                  SHA256

                                                  62ee0668554e9cc3767e900004b816b6d86b1c64cadf26b4e26204758541f5c4

                                                  SHA512

                                                  f77dbbb5da8da099af077d4aa37e7fe44c03257dbda567a902b608b93ea6ff416dc38ad6e8ee5f44b8f72ac450f932b9757859dcb12765a1f4031fe7a207cbc7

                                                • C:\Users\Admin\Desktop\MoveSwitch.ini.2b9x

                                                  Filesize

                                                  787KB

                                                  MD5

                                                  a20ff74e25c319aac2d0964dd35fec8e

                                                  SHA1

                                                  d4045ddbaf87f7b0f3c80c448e9be66ed4834335

                                                  SHA256

                                                  5429e26d7ce42637573d4394f946164ca045d6f3eff5874bce6188527519f446

                                                  SHA512

                                                  5000a3b131d74f34a88821756edf0a854413e6401198be45f3cf081d05e52b8ce2a99f5f576ab1a6f8126a97e8ddda849ddf0382c74cfbb487a21095416e7fb7

                                                • C:\Users\Admin\Desktop\PublishUndo.fon

                                                  Filesize

                                                  342KB

                                                  MD5

                                                  e6669f9d0a6504dc03a9637e9ea851f5

                                                  SHA1

                                                  ba42d4a9e6c84995493b5ee8cfca5a65705c91d1

                                                  SHA256

                                                  5d88f16ed7563fa246d14ddcb5bc5bdf8266d023b42027aef01e4567eded5291

                                                  SHA512

                                                  fee7ded0b82c387ac58836fc3190de7e3263eeb006db89f4ee41b564d8db6d447f2ce2b73db1ffc4b2a4daf867d49a61819e3c344cf1d64377ce32e3e2bd67dc

                                                • C:\Users\Admin\Desktop\ReceiveGrant.cab.o0zp

                                                  Filesize

                                                  304KB

                                                  MD5

                                                  07997bf29f0c28aeee8849651ad81c0a

                                                  SHA1

                                                  e77d539769c1efb663493dd8f0d0c5a02c5562a9

                                                  SHA256

                                                  37912aed0cf08a166cf4d0a9be61625d233fe92cacc1c127aa29a3c4b9d13afb

                                                  SHA512

                                                  9dc858bd49d91e7d7d7ee7581be141d2185beb3386a36316963356891844611f5d52b09aa7fdb83905d993dc29fb0b2b33f9de9a86cffad68bf4c73b5ce28d47

                                                • C:\Users\Admin\Desktop\RepairStop.wav.q9ec

                                                  Filesize

                                                  609KB

                                                  MD5

                                                  c592ad99a9f4a4ffe47e89ec1a7e85ce

                                                  SHA1

                                                  0f812c5d8c27077dd0cce808e69035ed48c9968c

                                                  SHA256

                                                  532d12f36738ec0d5165e33ceb92477281e38aa8882e87e5e7eb3fe99f751d4b

                                                  SHA512

                                                  cfbf71bcb44236e3ee964ce6271ad4cb5945adf1697fc3f33fec176a00176303cfaad06192f70069f201477c864f0a58203598f15c525660a0a1f9700296001b

                                                • C:\Users\Admin\Desktop\SplitMerge.mpp

                                                  Filesize

                                                  571KB

                                                  MD5

                                                  8cc43b967fe79efe19741d96b9e24726

                                                  SHA1

                                                  96fc6ff1e49ae8c94c03fb7493af98b719075e72

                                                  SHA256

                                                  3c54df70954d6170ceaa2d0c264af50b410d6d80c889944dddf21ed132d0a92a

                                                  SHA512

                                                  41bbd68b92bcb75ad822db52543ee0b50bf8804c106216386fef531468f8df4c0008a39362286f276b214ddb0c0ee26b41ac2e3bb510b212c9976ddef9615ec4

                                                • C:\Users\Admin\Desktop\TraceConfirm.edrwx

                                                  Filesize

                                                  380KB

                                                  MD5

                                                  c39416dbbd6f596a968cf0cebeee07de

                                                  SHA1

                                                  1ef099b67680053aab59e9ea9ed7371e62440392

                                                  SHA256

                                                  41467378948d12a6352d9beaf76f2c5fe8c7645d431dbaa11b19eb60c3b2b712

                                                  SHA512

                                                  f304ea65d9d12ef7f00b91732eca91165a48ce15ff4708d1dd11e88f3081098ac0306b6d5eac8c541e44b74b07a7132d2ab2b8bf364b16c0b499f8105db289cc

                                                • C:\Users\Admin\Desktop\TraceGroup.xht

                                                  Filesize

                                                  437KB

                                                  MD5

                                                  91f180b4269ec21fd5402d2e402e9413

                                                  SHA1

                                                  4ddace2fae3b5e8250f165ea2ff7d9126dfa1421

                                                  SHA256

                                                  c6efd8d4f64f9185fec1e44ca0ddaf1c6564d3cf64fa13b1b921a5a17694dcc2

                                                  SHA512

                                                  b173759a797ab7c01eae7c45bd7a0cfc2ce1595c3b62c8ceca67b387fca7dacce8b0b9b3025f3cfe07b3b01839b756b68e79511e921ae447ca024e16abdce687

                                                • C:\Users\Admin\Desktop\TraceJoin.tif.nnht

                                                  Filesize

                                                  558KB

                                                  MD5

                                                  59d4e2be17fa380f874999c30d86acd9

                                                  SHA1

                                                  fad86d99440d500847d051bf4b2e4b7efacb0a00

                                                  SHA256

                                                  9a10e5c2a557f217346633c2b0573f09560ab22a417feba1a0151f1512f53fd5

                                                  SHA512

                                                  e1b26bc80372c0796803e0a7e362bf157716e2c8d0061742d37c893a41ec6f683850ea3c2d54f43f5efcbb8099090d987deebbe22b7ac7d796d40354affb999a

                                                • C:\Users\Admin\Desktop\UnblockCompare.eps

                                                  Filesize

                                                  361KB

                                                  MD5

                                                  f0595190800d87fc999cf0194f6db992

                                                  SHA1

                                                  8c978570f680121597a540fa2187c0f2bf653025

                                                  SHA256

                                                  de994eac6e1d1f41785ebf38401468cec2b9f3648b8ca59154a1d5c8da0547ec

                                                  SHA512

                                                  96d32650c7ec9e1c57d0ece7cf7cce9873fe2953a7c8c5af7638f0393e02ebafaa9354ec5b6c4bcc56b313108b3d2391bd9e48019bb727f9f485e7d7604a23de

                                                • C:\Users\Admin\Desktop\UnprotectEdit.TS

                                                  Filesize

                                                  552KB

                                                  MD5

                                                  c3aea7529d4e2723906a0267ecd1e2d9

                                                  SHA1

                                                  844410c4ed83b1d37d6fd766c6ad0ea203d4a097

                                                  SHA256

                                                  2e5813b839cef15efa16fb5336fbd979f7b21682876440009d7c45e29aaaed0e

                                                  SHA512

                                                  66df1ecc9b44125de50af30719d1330a4ba00152c37d5e5b8ae842a29aedec169de23be45fc968b22321c84fe41e5a964cf6f6485949b986d5218114a818366c

                                                • C:\Users\Admin\Desktop\UnpublishWrite.wps.5qmw

                                                  Filesize

                                                  355KB

                                                  MD5

                                                  5e313d4904435bd7eef80454d4d0f568

                                                  SHA1

                                                  fb7dbfb748447f5b27f925c998288774076dc260

                                                  SHA256

                                                  7198c5d68cd8922282ddb2796d8c4333d0abbd6933b8aa14eca899c632095e8f

                                                  SHA512

                                                  22de9248305c4a787cb6f039684aad589ca082b451ec218c280d1ca06a85935fe8466f48b6ff73f01b5d45068cd562917597c0d598dfed2cf4705d8a876928d4

                                                • C:\Users\Admin\Documents\read_it.txt

                                                  Filesize

                                                  300B

                                                  MD5

                                                  b82fa86880debe41392d18b4dd41621a

                                                  SHA1

                                                  421bd2faec03d7b3f770b093cafbf312f35d3905

                                                  SHA256

                                                  3e64fbd082f64b545bc146bd6352e722312928774ee6313de956a0e48b06ed5c

                                                  SHA512

                                                  7abbe18cdabf6103e419a53cb24d45006b6f33267cc4a9c5b90d3b1390d34263758751b1cf4df4f7ee6c846c2590ea815fe089f853538511a8ad06f3d13cbf7e

                                                • C:\Users\Admin\Downloads\WareY666.exe

                                                  Filesize

                                                  95KB

                                                  MD5

                                                  d44d6282848f874a0ebd46f60d285870

                                                  SHA1

                                                  028b8bff4165fe717ba96c748955f77d294039aa

                                                  SHA256

                                                  e401968fc258152cf64bd3d66842eb76037905cdb3e82ef09f06cc06f8995d12

                                                  SHA512

                                                  a1fb1c0dbde4c4cfbdecf039c71af903297b7d2eb178c89c677c4742129b053d13e8f8708e78e06b2b5de41928a174917f01a089ef61b54e0338804b2a903e8b

                                                • C:\Users\Public\Desktop\Acrobat Reader DC.lnk.fwzy

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  9d0aa7de1874442c264b43cc83eed650

                                                  SHA1

                                                  41afa0f129afb45931acdf7f3bf3b9595055116d

                                                  SHA256

                                                  370de32eb69a98c92516128bbfa6506f0a3f898677617ffd305e17d25504b535

                                                  SHA512

                                                  1787802777f2cede1980c2f7f9a91f72cce35e42c1efc1dc6dd53f08819cda900667b55bb58e60502c8f6e454ebe7cf9f8db0c568f4eb1a22cd130ec4cbb2919

                                                • C:\Users\Public\Desktop\Firefox.lnk.fhix

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  91fa39fddf3778524f0c6799d92af413

                                                  SHA1

                                                  502f1fa5461750a624ade9c50e85ed9bb4ea621a

                                                  SHA256

                                                  8085f369a463ef026bf808891fd4d784e2f0a41edd0638d9ff92b2fdca245aaf

                                                  SHA512

                                                  98fb3b7c9ff15bfe1d48d61d1fb26e6e5668a9506fcf29e3bd3477714f8d958740f7748a1f957fac3bd444d9ce4f4e1e9ced0c2ff46b3b02426121492fc53df5

                                                • C:\Users\Public\Desktop\Google Chrome.lnk.iq6p

                                                  Filesize

                                                  3KB

                                                  MD5

                                                  113f955f1955ace4c3398ce2c073aca3

                                                  SHA1

                                                  47ed1e41f04f6c5db8721b85e493d09095753622

                                                  SHA256

                                                  3b3d536ac0de0de94df070178b2e68893c7143c1999d657e2289ed5b09e0b72b

                                                  SHA512

                                                  1c447cedb6d08469a653b8caa4d83d344af2e182be05b400a71d9ddb42eabe4534923ff10467bf48f9639cf1f79f13a2736c1f6a6e5c231d229b438319acd30a

                                                • C:\Users\Public\Desktop\VLC media player.lnk.9uoj

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  45c49214ca3432c1ddcc91bcf7058d7b

                                                  SHA1

                                                  0463b780cc5043a6fe9e94b8923fcc221c662054

                                                  SHA256

                                                  b6c60c87e9d0a84c2377be6f6010dccf1706ba3c83e4ced269d96e3d8e1d720f

                                                  SHA512

                                                  77b002cdeb610e384a462aa743685dd07447a2f6efa58903bf9dd934a7aa1fb36a0d17923b1e71789b60abae7ffb9be805ff99c4058dbc5e202f836e37a2c54b

                                                • C:\Users\Public\Desktop\desktop.ini.07kl

                                                  Filesize

                                                  436B

                                                  MD5

                                                  5e459c818c88ff19fcb3711352935a0b

                                                  SHA1

                                                  a8087683d4928d6ead19f1201598a84f5794cec6

                                                  SHA256

                                                  b44fafdcb10a50d5846539e8499977394176299cc367cd8c8959e99e0374147e

                                                  SHA512

                                                  796aff027f7a0170ab2f56e48c929afe63517e8aed6d7de3a651ebd6d693dc1949d20835cf26a804a28b4abd207c9b1a57a72ce1b5944336a9bc1951188f95ff

                                                • memory/4296-294-0x00007FF99C683000-0x00007FF99C685000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/4296-293-0x0000000000D00000-0x0000000000D1E000-memory.dmp

                                                  Filesize

                                                  120KB