Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "5"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "6"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Documents"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000c265dd30d697da014c844433d697da0135b27534d697da0114000000	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000000000001000000ffffffff	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Hacker2425/Ransomware-Builder

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82abe46f8,0x7ff82abe4708,0x7ff82abe4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5724 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7228 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3951696116595239508,18165780237447003304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7352 /prefetch:1

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe

"C:\Users\Admin\Downloads\Ransomware-Builder-main\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff82abe46f8,0x7ff82abe4708,0x7ff82abe4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3972 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3972 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4540 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5740 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,9508839506898123924,3612514168036295046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	avatars.githubusercontent.com	udp
US	8.8.8.8:53	github.githubassets.com	udp
US	8.8.8.8:53	g.bing.com	udp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	github-cloud.s3.amazonaws.com	udp
US	185.199.108.133:443	avatars.githubusercontent.com	tcp
US	8.8.8.8:53	user-images.githubusercontent.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	19.177.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	154.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
NL	23.62.61.192:443	www.bing.com	tcp
US	8.8.8.8:53	192.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	collector.github.com	udp
US	8.8.8.8:53	api.github.com	udp
US	185.199.108.154:443	github.githubassets.com	tcp
US	140.82.112.22:443	collector.github.com	tcp
GB	20.26.156.210:443	api.github.com	tcp
N/A	224.0.0.251:5353		udp
NL	23.62.61.192:443	www.bing.com	tcp
US	8.8.8.8:53	22.112.82.140.in-addr.arpa	udp
US	8.8.8.8:53	210.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	205.47.74.20.in-addr.arpa	udp
US	8.8.8.8:53	codeload.github.com	udp
GB	20.26.156.216:443	codeload.github.com	tcp
US	8.8.8.8:53	216.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	241.150.49.20.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
NL	23.62.61.113:443	www.bing.com	tcp
US	8.8.8.8:53	113.61.62.23.in-addr.arpa	udp
NL	23.62.61.113:443	www.bing.com	udp
US	8.8.8.8:53	r.bing.com	udp
US	8.8.8.8:53	th.bing.com	udp
NL	23.62.61.114:443	th.bing.com	tcp
NL	23.62.61.114:443	th.bing.com	tcp
NL	23.62.61.72:443	th.bing.com	tcp
NL	23.62.61.72:443	th.bing.com	tcp
US	8.8.8.8:53	114.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	72.61.62.23.in-addr.arpa	udp
NL	23.62.61.114:443	th.bing.com	udp
US	8.8.8.8:53	login.microsoftonline.com	udp
NL	40.126.32.140:443	login.microsoftonline.com	tcp
NL	23.62.61.72:443	th.bing.com	udp
US	8.8.8.8:53	140.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	testfamilysafety.bing.com	udp
US	204.79.197.201:443	testfamilysafety.bing.com	tcp
US	8.8.8.8:53	201.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	20.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	services.bingapis.com	udp
US	13.107.5.80:443	services.bingapis.com	tcp
US	8.8.8.8:53	80.5.107.13.in-addr.arpa	udp
US	8.8.8.8:53	167.154.64.172.in-addr.arpa	udp
US	172.64.154.167:443	www2.bing.com	udp
US	8.8.8.8:53	104.193.132.51.in-addr.arpa	udp
US	8.8.8.8:53	any.run	udp
US	8.8.8.8:53	media.istockphoto.com	udp
US	8.8.8.8:53	thumbs.dreamstime.com	udp
US	8.8.8.8:53	www.troyhunt.com	udp
US	104.22.49.74:443	any.run	tcp
US	172.67.221.245:443	www.troyhunt.com	tcp
GB	18.172.89.105:443	media.istockphoto.com	tcp
US	151.101.1.91:443	thumbs.dreamstime.com	tcp
US	8.8.8.8:53	apps.identrust.com	udp
US	2.18.190.81:80	apps.identrust.com	tcp
US	2.18.190.81:80	apps.identrust.com	tcp
US	2.18.190.81:80	apps.identrust.com	tcp
US	8.8.8.8:53	c4.wallpaperflare.com	udp
US	104.21.235.45:443	c4.wallpaperflare.com	tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5	8b167567021ccb1a9fdf073fa9112ef0
SHA1	3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA256	26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512	726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

\??\pipe\LOCAL\crashpad_1448_EKOMAVJYANSDLZCS

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5	537815e7cc5c694912ac0308147852e4
SHA1	2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256	b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA512	63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b18e063d-facf-45b4-8d28-781d5a97e5e0.tmp

MD5	59c935be7f7203f6d670a280f78e8f10
SHA1	264766869c7e11521a9649931b8a65b9f28f368a
SHA256	74429253ec9d8c2a7c12beb6f882d55c98a0e92b360883e347e9c7fe65eb5801
SHA512	3960065ce7d921fbd61d01186a31961e6d9e0104fcb4854ba4582b695d29129aabcd838bc9a78127412ee3b175598aa0b42cc7d87506cd1afcec65e4b7ff4ae7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5	46295cac801e5d4857d09837238a6394
SHA1	44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256	0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512	8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5	206702161f94c5cd39fadd03f4014d98
SHA1	bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256	1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512	0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5	751d195cc5e1c59281aedfe820490473
SHA1	cd6eb888fd468df982418362ba34ebbe5e89442d
SHA256	cd4ab50de8bded73faa38e8eed61f0c9985e2ab77143329c8ea040eca062ce32
SHA512	a3d13789f40ce1ab63a654c8e88015d0301fe7f620dd0a712b95d6b3d433f4fbf3a4222b054357f6704cec026bdb63ec5316005ba7a7f8f6ada4a761ee67529d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5	9ef3b0b63ac2190d28b371442c67fcda
SHA1	ff9254df173056aba8123e03c43211bde043927e
SHA256	44912a50fde9dd7f502c8c4f5b98f3092cec89d0de779b743321571c1ee853ee
SHA512	104d970681a3958e1d8c90210c5850c9c00b8acb2f799a63962f30831898699f943c394685c20e63cba8aba36bd20b0a4106ffbcb1e9da0a10b02784dd0c01ca

C:\Users\Admin\Downloads\Ransomware-Builder-main.zip

MD5	2f859950b215f4eee1e00bbe39207212
SHA1	31593e690a1e02c5a19f24d65b2ab0022c136a0e
SHA256	4b19ad3ef396d68d4ad5457be25ca636d22e1bd848d3e4a5211b71da58f016b6
SHA512	4948afdce16b45abed05df9d093ce7286637beedf7fd5d1f1915638914ad1437321128b125653849c27161d1994acaa8a648207a326af922f7a4d59740d94d48

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5	6e8333d40988ee3c17b90aabe4bd69fc
SHA1	8669cf31d3560c0decfacc8048ff85b3c2ead6d6
SHA256	95effca5cd28651bdb12a91ef549eff41311a0c4d6e6559f5328431ee04adf17
SHA512	da050c8f274c280988088145c49181de9beabf7b01f04a12f231dbd4ed61b8e52c80d4b276d0b583a1b78031190c8af1c310afcdde21edb72c10f667885222e4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5	fa1e7e59b2d0927303606d53a33a65b4
SHA1	c9b651373584d6baa3a1a5431ea59e9ba8f8adc2
SHA256	26ab0cf4b022e41bdba9dfb782a94e68edb65c16d6265c2299c0f6110ef1cc25
SHA512	4d828a909024a0c49956aaf965b679e7fc76428cf649077e6c1c3f9e7e95ab10a6f22f44e483699bd314c806a698a93005c3f2482863a3aabecdd1863d0755eb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	3715b4c1409b7c546b66f3a7b67ed228
SHA1	7c89676ddb80cd7b113650b613ec1c11fd6d58e9
SHA256	f3cbbb7e7ec095d41529e686acb24b072b3bd815f7a1b04847c7f103221a46a6
SHA512	c8aba2d3484d053eebccb0f01b1a3438f867edfa5e80fc62e7d98492f161d289ef4f0cd009b4455e8c1e9a236a72b3e007bd415fdaae3e8b3166e523ebfd7c43

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57689d.TMP

MD5	79fe2a63b99714e7b7a350362bd90dad
SHA1	ad4c251de02077866c79ab87765c17be35e9a1eb
SHA256	a4ac54bd9bd4bc77cb4ef85c1dd1e6aad98f369994667f4c94b6fefce5906740
SHA512	8ec03ff75eeefe859a67f00e2f992af7e510ea63131c0b6a955f11ceb212aacc23796b970d126411df7d09e16108ab09c98c1d9d706640fa8b44be7025cd3b6b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5	401abb123c837cc099b6512c4b81cbf3
SHA1	074efbc51c638e5a343948033702b5fe2772bb53
SHA256	3e759a6e3dee3210ab581989d5bec23425118daa5e91b3ab18079569445af05c
SHA512	34ab5d40997ebc9575ecb7df6dcada7a3d0df59486d013bfd79647ba4e5a9e1a2ed48177199b3c2939421a7bdf378ccb51910c28185e36627d34bec31bd3e816

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5	773fb4b4aee1fc711996decf4d943b6d
SHA1	5a0ff39895150d79afc75d6bb870eaf2a7411555
SHA256	bf2541e5f818c85e94f249780776e0d5b6a4aafffc8ce5e97dc82070bebe30b9
SHA512	7c55dc4ab11ace2db228705f5f4115ec5d3f42c80cbc9e31049bdbf657eb4e966335ef8899534bf449bf62aaf1a4bac9f52e92264323f0fbaab4de82c88aeee6

memory/5220-326-0x0000000000A90000-0x0000000000B1E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

MD5	838a7b32aefb618130392bc7d006aa2e
SHA1	5159e0f18c9e68f0e75e2239875aa994847b8290
SHA256	ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA512	9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

MD5	66ad8976e11078536071392e27ad5d71
SHA1	65cdae99b3e3592add3d686012999400b559185c
SHA256	de50c4556c9f11e4bf24154a7a2f53223c2247dbdf8e04b44faf9a6374123a2d
SHA512	7babb8982b2cc84cdee3b21f23343a84ed0953a37e3d6ebb8dca5e5358f4613c4678268f8e0073bda50fcee230203e253bfcad05626624e64d7bc9131cba0d1d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

MD5	9c3d0e28383d8a2fe54164097b61824e
SHA1	d4fd750bc4aac0ad3f4e08ad10492288d6fbe29b
SHA256	4fb44bddaf09e2f4de6efadd0718d0c8e7801a9efaac1dddd9a846d7161d7d20
SHA512	370a7a16c569b87953107f10b4a8866cfb6d03e51d2aab694cef3dd88f452bd307c26ecda0804f7171b8c8e77f523c2da66417c12468785f9b45233ab457138b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

MD5	97922f3d801f2337db034f2a2080f525
SHA1	c05f549bbb92efffda63ae7f638ab21c80854bdd
SHA256	97e5f1e95330dfc075f50d5ca075449f443c6008f4efe4f082a5ff6710eca77e
SHA512	bdae2b2b44b1b2bea8fbe39c8b1cb52df493f04b4d573012e6aa2a64f69538a2a51e150377e1d3a17d458cf1477634ada4feec1f830e56c9c0b33b9cec254cba

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

MD5	cb2686d76e738c9000ed2b0f7e8ba4c5
SHA1	a6a6c6c55c4901a10af63c264593d7fa721442ba
SHA256	08d6f46dda0cb38a941cf45afdb00892cc7853bfd0e889d7b3b8e9cd8d3bce2d
SHA512	8d4738e70d8c3821a3abfc17d10ab7865a044830691ab08d3cbee25211da949cd8de4b9ae82586d703c57139e0d046422ec4adedb0a86a983897d221885d0d37

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13360075288299504

MD5	0fc5a5860e283286608049fb7687f002
SHA1	b25fb38582f243960c6345451c93ecc44ff8c59c
SHA256	6882114d25428618e1a666e0db8d8ab74939494d854a619c4878cee0f32a3993
SHA512	7fdfbebf1d8d3369e4be12364f761f27d560992a479d616d9e7d28419f7fcbb70a7787128034430c9084f154e022dae548def0cbedec4e76f8b19f51f284beb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

MD5	f50f89a0a91564d0b8a211f8921aa7de
SHA1	112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256	b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512	bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

MD5	2b5495384aa20ae22b84f656abda4e8a
SHA1	84ab7ed1367df0dd79de6c2a9b6f8cff5191ddd3
SHA256	0acbbd7b827febee06e42b407791328f624527633acaf53489d71b3ea6c2662b
SHA512	cb163d77b225c79863990d28ebe9a03d9a7ff14afe98ee5b786d2a8a249ac6a2aec372d974a99736c9021a0ca7f045ebd8f96fa991d7cb8f57969a1e0e8a3c3d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5	f94d22d07203312925029e1cfc76e613
SHA1	0667666b6d06178e24d81dd7dcdf50752777a38d
SHA256	b0a7fab98afdd397718aca9c9b2936cbf04cea4701140e2bb7946bcc2d84281b
SHA512	a84db6a61af0a92102a6513f57aaa527d9e9c57fa86cf5dacb9755c1cd9a5c8a6f8b92555e4af5b2dfd26092a81d8efd8fd7c04d67e3659c02d448c99c09d8a7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

MD5	99a899cb20e3a1a7d0212afc490a6539
SHA1	fc53365e8f0c14b2fca977f57a51462186af89a1
SHA256	c9c5c68b1582fe70d5fa568053749a6183516b490f98d8b7bae548d488952d4b
SHA512	f1636e100227910adb7585760f2f565e33c40545354984578889093b76d0c3f766e5cfe32e8f94d475a055c6095fff531181072175dfd79234f3e1346d9efb2e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

MD5	630c4f850264b83567cd658d6397ffce
SHA1	c280c7d27f23e1e8ed1baec9e0b6a8594da94aa0
SHA256	be4d36e18863c60bd8add66b345d34dc529dac8248f4978166a43d7eee84c759
SHA512	6fc0917f55a0c30abea3e0618d746b218ac85f43aa229f37749ef9d384c15be2b7c56842eda1edb0ef589a6f3361fb49e27b11cd06779b33028bb66f3209baa7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

MD5	afc9457f3046d4d883556803e37ed71c
SHA1	e8527cdb589fec70b15761442ff52e2990d0c6b3
SHA256	59fab305a4e713edd9548085bea68114d3bcf01bf4dcd36c1162fc0decc072ed
SHA512	234c6a21dc1c6f0564c6fa3215ba2032e96cd982744433bf2df862069a19c67b8ba3bb998a505d9f5de0162616876c76a5d825b99eb85a3f6fbb9d0065f2712f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

MD5	a1514599cc0690a8ff4cbb351b37bfaf
SHA1	47568a5356f4d0b829fb5c43531ef118fe03e751
SHA256	ea69ba8d5821b705b9e77c4e30ca6b9cf4be452f1bb1b522b9c7933c3839a250
SHA512	06e9ad388de60437c6d82866b5e52a7534f3a0e8e667c0fe40348ad381039922f5aac529686c86f25d1ca02ecb8f217082c939d8583565f53f76900a3266a8ab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5	b5aa67e5b2b2eeaf40fbde021b38b89a
SHA1	7522a3f94b64ee5abf9c04634bcd5a24230b0abc
SHA256	1668f0aab0951ba38e951538e119c9d28d9ee7c23e3c5ab80a077a0bf5f1e881
SHA512	e791106244326c8d3887541d574515735e93724ca853e6920bce157b828036e1c95bb3d84a6bbf4bbce61b651082243889a3192109d6af45c12ba42d7e8c3008

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

MD5	818d9bb895907f8dc21ce79ccd363137
SHA1	4052ba275fb0a528c5a2de2fe6e421778c2d3f6b
SHA256	8c7c882128ecb620a99287c15e67e9241b541ffd8ef923546c79c5ac79840afe
SHA512	9dcf54cee997398719633ad813e8ae142537986ebfeb3b64e6f677ccf8efce8fae741c1d0705be660af6fd5d2fa73fb69054ca6bf6ac615ca1e6a39903904f1c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

MD5	58687280dc45a4594e6c20851767aa91
SHA1	5314eae1fdf7088166fed85b7c6be574d120230c
SHA256	2e6547938350cc7657c942bd7501e04e6f147784d8fbbb64459b065333a05566
SHA512	58f87f2b99369dde1792137c70c6200e58da164351a0c343daae6248c0f98b2a198b7c7a266dc3cdf614c41bc2dd906bbc5504d993e9575b91a998aa4d51c353

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

MD5	1c560ef866190e93e4b59e7b3b375d7b
SHA1	f44182d00141a3c65eae64ccb82d5387c3b01325
SHA256	da4ca11b8cc103aec62c9977b19cb0df6f813889293fe69681f04f927ddd8a3b
SHA512	8d3d9913d1641fbf03cf00ba9b4f064706f0e667c2414314b620c7e715e22fd39b64af0344ada6411d2456459ba3683249883c05f13b2ee279e0e96251f20042

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

MD5	b8c7648a94c6bb3823c9f0df3217e82b
SHA1	dcde5d894c5167b4a144028f6cfe15a9d6e0c4cb
SHA256	1f96a1519551775ee71d0b151f05c01585eb3677f3d2ded648a2099e236cf656
SHA512	ca5e9efe3fa03ab931a81a2c093bd2317ac87e8341d59bf740ae20f2a954374986d971bd5662e475492c20bce5fac9fc1499dcb3634d2faa761c5afb4ec6c868

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

MD5	e85e071b23e3c1556ec208d11d34b5c9
SHA1	effc77dcafa69afe72d222fa37ed96759b532413
SHA256	d11c17611c5bf8eb8d6308989a02c63ca799a0768025e3188698b89277977d02
SHA512	379d17740b046c8b914c6eaac5d276a0f9d831315ff3884f30039e7d48b16da0e17743182e0ca1bf3e3a223d61e3775c63ba0adf0030569a5db3e3cfaec96019

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

MD5	3211c3ca199674fca328693c1ceae6c0
SHA1	fa24ee30a02cf0b9a1f5b2228770e842375228d0
SHA256	ec461a99e9bd136757648947c98f484fbf2b47c597ba78b2d9511dc0e54d2719
SHA512	fdac214cb94d92f2d08ba2a2e2d99d246e4309bbcc03c00f73a205d644acb6e1045d5e350b2257da51fa097d31f2cbd8d42e9a7d6d8c4ba5c4e914c67c3584f1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

MD5	c211fb4ca9d4ec463e76980aba311ba6
SHA1	11795a7a1fc6a9a5094c2238a00effb9629b1278
SHA256	ac104ba6b6162b5217134749ad6285783b5c7f9fd148660aab1a8ee63deafcb1
SHA512	6f84ee9f767ace90daf91ed133027aa116eb10d566a57678701910b65ce0c0c9e079e918745259ec8b4e720c499221e39a72ce76f49388f5a92c4ed47daa5fd5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

MD5	7d29d89ba0fd76449906e57adaf5dd42
SHA1	b80cf589be54816070a5a252aba1e09824bf82c5
SHA256	f0875f575d237cd27d82e7719d2c45099b66ef2fbf01cc05d7c2c03cd2bd5543
SHA512	e6b8e8623b8e2a1743bb457ae1c7e552add181a893cbc613cc87fa36c23a88157c5d8692f8dd2ca39b50806a49a244b639630f988997fad5cde8ab42ebad2ef4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

MD5	b7634dd8039f8441bc031f49d1f25d23
SHA1	f62733832a2847c87c8cc720f05b806f743e5e81
SHA256	8b66888e1b8df0069a972997100bd1cebd10f054f666ce53e416921dc19c5310
SHA512	e748a026bdcc142e435eb8848a239250a23dc51b7485926fd65d28aaba1def6412fd4745a66ae6571d95bd4ade54cc6add104731a6a6938d1908ee4899744df1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

MD5	6bc4851424575eaf03ebe2efee6073ab
SHA1	2d014fe2feb929d03a46322645a94556ca5c9e96
SHA256	abaded8e235fdf329521806af30a1cc7701eaca3fe2efccb9da760ec6d8e5e4e
SHA512	af3b7d93fa2243475d74d4bd7f918ce2706bf6eca28029b9e49869f5f793e483efaafdfab1fed6306d5fc77a5ed3b27097b27448cd04560bed4df6fa3268ccf9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002

MD5	fc97b88a7ce0b008366cd0260b0321dc
SHA1	4eae02aecb04fa15f0bb62036151fa016e64f7a9
SHA256	6388415a307a208b0a43b817ccd9e5fcdda9b6939ecd20ef4c0eda1aa3a0e49e
SHA512	889a0db0eb5ad4de4279b620783964bfda8edc6b137059d1ec1da9282716fe930f8c4ebfadea7cd5247a997f8d4d2990f7b972a17106de491365e3c2d2138175

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

MD5	af6ad58a05ab17dcfb3d1aa00cae0ff6
SHA1	a372b5434e25052a893de849eefb245538535a87
SHA256	50d168298bb438ac106adc21fa9c8b8cf2a25034386ea1a415661c6b03fa2689
SHA512	689a261fac294887d8e1ff2531f943dc8f2d9f45a41905465e4bcdaa73d08ac1e89a5a9c86097b88bbb37e6a5a1837226239984ad30df554f5f8035f736602d5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

MD5	80b2dc5689152f3a91b50d472dfa8ee4
SHA1	d3e0b1b87da69ee8764007f79ae8f74f8194bfdf
SHA256	bb1e2289c12ce403ffc8ce25425bb8e7571d6c3f19ebbdb6543633a9a6f1a907
SHA512	8138001293bc76bef040ad2e83804e8e1b82959bda814bec75d2cf5ef04e03edfeae2d8443743694d46697c4a27de34dccc26664f2d51d316d60ed793e07e2b9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

MD5	d11c99a3309a75c8fe6ae15b2553131b
SHA1	4e2e831bd9f0d143a8ae508aa69f7c04962fcfed
SHA256	57785a2a1d25f1c77bdedfe30e8f44d9bd43090e83e21128768096df0cf27609
SHA512	c983a7ae6b581374f8e9cff040a3581340acb6e3cb7fcf40853972c884b987e164ca4b8ba652329c5d6c680b21d572e2a9e9c36b74510924addad34f04d64ec2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

MD5	8df5975fb3cfca8bddef26c2ac1ec139
SHA1	1e6b8f1700c37f9f323ecc88131a4ec6c0a7baa2
SHA256	737fc675971ea3015381d05d46fd5b6e5bee4b9deb2c2ae87f161bdcde5a84ef
SHA512	6153e8c54c029d8a8cd7b3a57041c33d907ab3b97d44c8772d5d5a3ad1484f2b2079d4d487c3f8ce939ef9d3e7439394da86bf96f4c699d28b1f32ec11c0dfd9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

MD5	bb1be7307c8872c8a3edc3785fc2f1c2
SHA1	e4d1bda7941d1fece4c76fed74037adb37526481
SHA256	5d8d1a13f489e3defb4a8e0458c8f6916cbaf0ad4aacde2c10e6cd63d0840d63
SHA512	d867dd225a10d6b63d71129688f24410dfe3e80af906c83a0fbcef3115391fb7a0669feb2fa9ef28c2767b959e668980c8c95002dbe71019dc329e88e0f65426

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

MD5	7c72b263aeb55117b7d621ffe1db285b
SHA1	893862d10e9b5b7a5081ed3388a37e1bf0014afc
SHA256	202cfed21e0d2e493aa1be2ce7c0cdab9484974ade35cbaa434410bd002aee7b
SHA512	c6829009fff619e903303923faab285cb16e6aaab0bfff2cc96451118a4cd4fc1cf23c85ed3656ce3b2715a850c0b3aa7d1dd49e2185fa4268c929e3fb06f854

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

MD5	73595cc546005f14b9b03cca71eb6acc
SHA1	71b4e190122e0ac65ef32549fba7260fd6f35837
SHA256	8dd5a16d9b462f3c26c5bc7c0524ea6063497e19d4c605fc396d97a64cc4f32b
SHA512	39d3aa6c50be4e1fbabf6598c9da2e4355d7d28d8173aa932f4ce347269629fce8382042016e17e380689dd9bfcb4f7b6df871d9a3d355e3f0b04e58bc1ef346

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

MD5	231b8c7d084ede40d69ab9bd53ad2b57
SHA1	6a24b51f1320cb1179fb34849dec812485006460
SHA256	0dd28b138731a79ec3f24e50115b84f30b3e3cee66064eefe38c81f0c3a0c5d0
SHA512	9e6a53e0e17d3b9e973ab85aaa3062e3281c120bad930a8ff6eab5767ef6c77c862f30a4e392dbb7b0f326ad1e3e449fd18e358608cbf434d8311a613cbe034c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13360075288132504

MD5	55ff0319c5fcfefe25afaaf48c07596f
SHA1	10cc80d291a0496d0d3e362fc46b749c56018ea2
SHA256	43f18c9af68118d1516eee4a7c5dc1f257dc3b641bbb742ad752b0171ceb0488
SHA512	bf96317bdd27ca34b3db15a1f40f70c58df80ba3a33f09ca08e71eee8358bb69aab250128fdb01671c627642555f77db631c1f2a2cbe0285b363829c60555a06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

MD5	291e2991bf76a34e7a515a03f5d2b583
SHA1	6f56d440ed988447d8ac7642c4f5e42c0f75717f
SHA256	601dbe38972175e4a0c315605683b7422e178abc1f1960dde4dc95bfdd68b717
SHA512	30ef328563adba1ecf921fe3a948d6fb6528d2696046a996f32eb86131224405c3bc1b86d9179134e3c5a0bd1630c4dedf8923e24bc4f57f240a88fc992acdbe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

MD5	2b432fef211c69c745aca86de4f8e4ab
SHA1	4b92da8d4c0188cf2409500adcd2200444a82fcc
SHA256	42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de
SHA512	948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG

MD5	dc07fee115f2cb7654f3344ae1255468
SHA1	c482c93db39d2a3c38bd86b0b71b7b11cf08f505
SHA256	a861bcce4af7306bb56defc457654cdfa17db080058858f1ad7d79bd7eac3682
SHA512	8dda31a4f8676b8b5a045179de5b967457b694172a19840d127af1359366b673b40c23396e5c04e81f9f9f1d2ab7ae65405f21299373032137ea2710cf2e6a18

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002

MD5	22bf0e81636b1b45051b138f48b3d148
SHA1	56755d203579ab356e5620ce7e85519ad69d614a
SHA256	e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97
SHA512	a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

MD5	9e02552124890dc7e040ce55841d75a4
SHA1	f4179e9e3c00378fa4ad61c94527602c70aa0ad9
SHA256	7b6e4ce73ddd8b5e7a7c4a94374ac2815d0048a5296879d7659a92ee0b425c77
SHA512	3e10237b1bff73f3bb031f108b8de18f1b3c3396d63dfee8eb2401ce650392b9417143a9ef5234831d8386fc12e232b583dd45eada3f2828b3a0a818123dd5cd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5	6752a1d65b201c13b62ea44016eb221f
SHA1	58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256	0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512	9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

MD5	aac57f6f587f163486628b8860aa3637
SHA1	b1b51e14672caae2361f0e2c54b72d1107cfce54
SHA256	0cda72f2d9b6f196897f58d5de1fe1b43424ce55701eac625e591a0fd4ce7486
SHA512	0622796aab85764434e30cbe78b4e80e129443744dd13bc376f7a124ed04863c86bb1dcd5222bb1814f6599accbd45c9ee2b983da6c461b68670ae59141a6c1a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

MD5	c3c0eb5e044497577bec91b5970f6d30
SHA1	d833f81cf21f68d43ba64a6c28892945adc317a6
SHA256	eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
SHA512	83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

MD5	3490805f00d3a3e0e91bd165c7bbb40e
SHA1	b8da3e4394bba3c0171cf8cf53d3667946356b9a
SHA256	5592dd532714a81e43ba56f98961f852f09ed2fc9eb8396f6593b6dfe50fe46e
SHA512	3fcf83d58e9c65c8fc65e73a60eb32aca371d41c52674402980114927503670f967b06342c704e1d399338b8c01faa250eebb599bd274f7849bc25f60bdb367e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5	3ef331326b04501eb0fed058df25168e
SHA1	8461973eeb8fcae5f61a045cca17c2960c9fbf90
SHA256	aa5754fd0508ba226628f111eeafdba78546bcc9459438fa84b6dc049d23cf26
SHA512	42e461d671db30018ba26c2f3079c44bc169881d55e1dc003d5e1ecf2382be9444805506512a17420f40997ad60e3690d1c8e23bd8eecb1d3326cd6ae792ac5e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

MD5	b76a36f694fd69b229872393bd33b65c
SHA1	710ebf0e68bb65f2faa4356abe17f3d164e8b943
SHA256	1942ea4d2f0b066d0bbf102d25490e01e3843a204b2cc3cf2b721a7f7ddb9712
SHA512	8e4172f38b9b32658717de15c38f5b0c4dfcdbeb73424e6ba4f08981c868fdc240eb5776452f0a71395df2d0bc441f3f88ffaead5860fa672d992a94fb868a26

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5	0028a1a5c441a3cd5a60c34da771564f
SHA1	e15d27a8322b435564ebcd36467b997d0fa8ef32
SHA256	8dc36283781a25af9e2ae76d255ae311b2715396f710ff0e9850b0e64525759d
SHA512	e26efd2be3114e733acdc00fb54150790872b10c88a7c4d3a19a16383bf58897ad89f14b3255a984f836666b98bafc099d8988532d03acda0dee7a7a7da3f40e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5	a9c3e2cd15b20efd781992e6bceb1810
SHA1	bd7aa31caf8ec366a2eda70895eaf391ffc258e3
SHA256	52e0c18e249fb1ac651804966b04f5bd2a100ad59d754a22f2ddcd7332ab1785
SHA512	577d714a7fd2d6a7ff07b034a7a1cfa120d3f5c32f14d2e2e3a1d9f92301771ee60a0098c83f2290d90cd478876dce42784cca767a0a0d4138b542f4033d51cf

Malware Analysis Report

2024-08-06 16:07

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Sample ID	240513-n61c8sdf5x
Target	https://github.com/Hacker2425/Ransomware-Builder
Tags	chaos ransomware