chaos | hxxps://github[.]com/Hacker2425/Ransomware-Builder

Resubmissions

18/03/2024, 13:35

240318-qvwa9ahh84 10

18/03/2024, 13:32

240318-qs3mjsae5v 10

Analysis

max time kernel
95s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Hacker2425/Ransomware-Builder

Score

10^/10

chaos ransomware

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/5616-204-0x0000000000F80000-0x000000000100E000-memory.dmp	family_chaos

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
1812	msedge.exe
1812	msedge.exe
4876	identity_helper.exe
4876	identity_helper.exe
812	msedge.exe
812	msedge.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe
5616	Chaos Ransomware Builder v4.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5616	Chaos Ransomware Builder v4.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3156	1812	msedge.exe	89
PID 1812 wrote to memory of 3156	1812	msedge.exe	89
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 1996	1812	msedge.exe	90
PID 1812 wrote to memory of 4408	1812	msedge.exe	91
PID 1812 wrote to memory of 4408	1812	msedge.exe	91
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92
PID 1812 wrote to memory of 4000	1812	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Hacker2425/Ransomware-Builder
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb21046f8,0x7ffcb2104708,0x7ffcb2104718
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1664 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8890396605721382679,14781374561327370860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:5388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5140

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware-Builder-main.zip\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware-Builder-main.zip\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cd1b4b3a1bc50df4cf197a997552d877

SHA1
3e3ac34e9fa6f077034ecc3f32a9bd94edea4ee5

SHA256
7e9de3141c1c1fbcf64361a91dd268caece59aa2ed8ef03b1362c781136cd87d

SHA512
c50fb69073d04f3d3e98cae81be313f2c603b7a63c9b22bb212f8e317c3dc15ccb6bd7e025c07f10253ad71a1e81ba90ae1888a624ab2d6db97c961602c4ea94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
cc4d73e34e4e3f8e986a319af7c94bb6

SHA1
b0340d1365533d7e2e943bcc91afd9563af194e8

SHA256
0b4ad4ab83c5cd2828bd8c66c76d18b77b8b6157409a6cbf1704bd793d3b4e29

SHA512
6ee164ae203e27226a00cb5790b8f66726589c191ccdc6c8e7d612fb47b8aecbcb346dfdb40b488f837b46d090b113f88379bb877191258ada8c07c04d285f9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aad0de95395fd2fde250a4e2b0dc643f

SHA1
1903681329b374f31dcbda7ee7f73db20758b39b

SHA256
3588a330fc28b60fc6c053f07a2ae55fc2644945fe953694402ee714e408bbc7

SHA512
808b5fe59b5b51beb2a8a46509675153e67f6318ab10c7efc5d653204caa28fe79c8a8d08950a12b85ca7b97fcdfb6f4c2bbf5e472c263745587d6a50c157e1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5ce57d970130c506ae21800984de01d4

SHA1
11848a716097ee96dcb0aa37beccb789cba018e7

SHA256
5e467ac24d9c2efbd3d92f62fb5b4ad9b5f7841ac8834d492a62fa6793cb7d47

SHA512
eeae5dc91c0e2d6cdcf491273f0f227db51a468140b0c66b3cca6c4ea7b2e1ba1f355039b3e34c3b91c6af73eff40fe1e65f02584f91ec66265db818bdd7d38f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4cdbc5da1aeed35ed3d451aae6ba8ffc

SHA1
26f2111acba4cbba275f237ea5c519c502b4245b

SHA256
5b7745e053414c827388c52083867d854f0916f6d050b2d98820c8d47206a9d0

SHA512
aaf92f21ef93cde9af9fcc483cd9602471cc99a03e504319d9dd8c773b4012790830f77b91f80bcd2dc2e0c46c08a336de267a9d3cae4d6471b688ff361f389a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cfd13f1b05c0239ba900c53a2d17bd8c

SHA1
d8acf7b238ec410b28353f19185e8d161a85880a

SHA256
e02920dcc84fd6ca4c368953c213880f1074580deaf1602a15e2feb8b5d79dd2

SHA512
3136a1b44581f28d703bd0d04690c88f463c931ccd813111da8818d2361eca9839b51fee4286ede3d82afa65fd297cf1b3a4ba0fbee94fe5e0f281474ca3f0ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c0a0.TMP

Filesize
707B

MD5
dac9ce43fd5ec12a49caa07a653d767f

SHA1
0335bc6cdd4e64ea63564c6afc41effe9afc7981

SHA256
08083b8be2fc3f5acedde73ef4352257938dce72a0eb4f1867f042314abcdc83

SHA512
cb5599048b7ec31500804e2983bc1875215cb2127fb2c3a6723d9a01643df0360139d42fb60845e3ddc6d73c9bc3690690450adccf0ce6cc6c3304a7e82476b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a437fa5928eacee78e894e7138168d92

SHA1
5554966bd0d09c79b7efac81282c87c7da1c38f1

SHA256
e39039c06d3dfed7ee8d36ba8c4c79f5ac35cd5c97341d18950a31ca95d2ec93

SHA512
67cbfd85ce615703e31fad441dbc6198e4d978a4ae7bde25bfe75f43ac2404451af242f9ba2d546098fc1288f8cadb93f4efad838e15d6fdd99ee8e019a92df8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9e6a4bbe1d270bf9e712d178023a9440

SHA1
33249fdbb954ec512383bcd0bd74e87dd5cb1f8e

SHA256
741b8d7e0208b33cdc1f0caaeecc16cb0d5be3d09205d380167ac8d06cee790f

SHA512
3668d490dd87dd82d261c3a320199dd7b6eb407eb6e5cc0002e197eda1fa7f7bb60a56ed7d28173af00c60e313b896b0b0b3276085c7d91c8be15ec7c480dc0a

Download Submit
C:\Users\Admin\Downloads\Ransomware-Builder-main.zip

Filesize
131KB

MD5
2f859950b215f4eee1e00bbe39207212

SHA1
31593e690a1e02c5a19f24d65b2ab0022c136a0e

SHA256
4b19ad3ef396d68d4ad5457be25ca636d22e1bd848d3e4a5211b71da58f016b6

SHA512
4948afdce16b45abed05df9d093ce7286637beedf7fd5d1f1915638914ad1437321128b125653849c27161d1994acaa8a648207a326af922f7a4d59740d94d48

Download Submit
memory/5616-241-0x00007FFC9DA50000-0x00007FFC9E511000-memory.dmp

Filesize
10.8MB

Download
memory/5616-212-0x000000001BCA0000-0x000000001BCB0000-memory.dmp

Filesize
64KB

Download
memory/5616-213-0x000000001BCA0000-0x000000001BCB0000-memory.dmp

Filesize
64KB

Download
memory/5616-211-0x000000001BCA0000-0x000000001BCB0000-memory.dmp

Filesize
64KB

Download
memory/5616-204-0x0000000000F80000-0x000000000100E000-memory.dmp

Filesize
568KB

Download
memory/5616-242-0x000000001BCA0000-0x000000001BCB0000-memory.dmp

Filesize
64KB

Download
memory/5616-245-0x000000001BCA0000-0x000000001BCB0000-memory.dmp

Filesize
64KB

Download
memory/5616-246-0x000000001BCA0000-0x000000001BCB0000-memory.dmp

Filesize
64KB

Download
memory/5616-210-0x00007FFC9DA50000-0x00007FFC9E511000-memory.dmp

Filesize
10.8MB

Download
memory/5616-278-0x000000001BCA0000-0x000000001BCB0000-memory.dmp

Filesize
64KB

Download
memory/5616-280-0x00007FFC9DA50000-0x00007FFC9E511000-memory.dmp

Filesize
10.8MB

Download