Overview

overview

10

Static

static

10

ransomware2.exe

windows7-x64

10

ransomware2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250211-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-02-2025 11:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ransomware2.exe

  • Size

    27KB

  • MD5

    a0feb977ec93ffe5939ff03e81f7eda7

  • SHA1

    4b02f7dc42e715bf54492cbfe0f0f5dccec1729e

  • SHA256

    da00e98797600787431cb3c4c5d2771b2c3f235848247f7ab8c98453bb16b654

  • SHA512

    10732bc014891dee37f84d3fb91da1c804151379cd1df54a8472199ebb05fae6ab018d35142c91a932027ff29af9ae3b9659ca64a9448207800958a92210f3f6

  • SSDEEP

    384:8tWZPzzxAm1vW5Z2pzh71+kuzxBSKr0nlMUOy5o91WB1Fd82vEl:B7zxAm6Shgku26nUho94vP828l

Score
10/10
chaosadwaredefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\decrypt.txt

Ransom Note
Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) - Write on our email with the payment proof and we will send you the tool - Email: [ur email] 2) - Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.) - Send the payment to [your btc address]

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 2 IoCs
  • Chaos family
    chaos
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 64 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ransomware2.exe
    "C:\Users\Admin\AppData\Local\Temp\ransomware2.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4376
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3056
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:3444
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2068
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3348
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:2940
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:752
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2996
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:1376
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\decrypt.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:1836
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDdGQ0FDMUQtQkM0Ri00MDI4LUEzNjktNTk0NTI1QTNFNTBFfSIgdXNlcmlkPSJ7QTIzNzY4NEEtRjhCQS00MkI5LUI5RjUtNDgwRUYyQkUxQjUwfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7M0ZFNzJBMzgtNzc3RS00NDVFLUEwNkUtNDdDRUQ2NTU3MUJEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODM0MTAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NTUzNjg2NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTE4NTEzNDI1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:1648
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4360
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4060
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:320
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:3524
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\MicrosoftEdge_X64_133.0.3065.59.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      1⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:4676
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\EDGEMITMP_BB199.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\EDGEMITMP_BB199.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2704
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\EDGEMITMP_BB199.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\EDGEMITMP_BB199.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\EDGEMITMP_BB199.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff74f6a6a68,0x7ff74f6a6a74,0x7ff74f6a6a80
          3⤵
          • Executes dropped EXE
          PID:4948
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\EDGEMITMP_BB199.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\EDGEMITMP_BB199.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:2944
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\EDGEMITMP_BB199.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\EDGEMITMP_BB199.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\EDGEMITMP_BB199.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff74f6a6a68,0x7ff74f6a6a74,0x7ff74f6a6a80
            4⤵
            • Executes dropped EXE
            PID:3152
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1812
          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff692ad6a68,0x7ff692ad6a74,0x7ff692ad6a80
            4⤵
            • Executes dropped EXE
            PID:3512
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:3564
          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff692ad6a68,0x7ff692ad6a74,0x7ff692ad6a80
            4⤵
            • Executes dropped EXE
            PID:2700
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4360
          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff692ad6a68,0x7ff692ad6a74,0x7ff692ad6a80
            4⤵
            • Executes dropped EXE
            PID:1392

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    Windows Management Instrumentation

    1
    T1047

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Active Setup

    1
    T1547.014

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Browser Extensions

    1
    T1176

    Event Triggered Execution

    1
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Privilege Escalation

    Boot or Logon Autostart Execution

    2
    T1547

    Active Setup

    1
    T1547.014

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Event Triggered Execution

    1
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Defense Evasion

    Direct Volume Access

    1
    T1006

    Indicator Removal

    3
    T1070

    File Deletion

    3
    T1070.004

    Modify Registry

    5
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    4
    T1012

    System Information Discovery

    3
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    System Network Configuration Discovery

    1
    T1016

    Internet Connection Discovery

    1
    T1016.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Inhibit System Recovery

    4
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E7A25667-7BB3-42A2-A4CB-57BC764BB0A0}\EDGEMITMP_BB199.tmp\setup.exe
      Filesize

      6.8MB

      MD5

      1b3e9c59f9c7a134ec630ada1eb76a39

      SHA1

      a7e831d392e99f3d37847dcc561dd2e017065439

      SHA256

      ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae

      SHA512

      c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e

      Download Submit

    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      Filesize

      3.9MB

      MD5

      ad5f7dc7ca3e67dce70c0a89c04519e0

      SHA1

      a10b03234627ca8f3f8034cd5637cda1b8246d83

      SHA256

      663fe0f4e090583e6aa5204b9a80b7a76f677259066e56a7345aebc6bc3e7d31

      SHA512

      ad5490e9865caa454c47ec2e96364b9c566b553e64801da60c295acd570017747be1aff6f22ca6c20c6eee6f6d05a058af72569fd6e656f66e48010978c7fd51

      Download Submit

    • C:\Program Files\msedge_installer.log
      Filesize

      72KB

      MD5

      6be1d7a6cf0cda9ae45d593b7a92b3a2

      SHA1

      88d4c090dd3a8290cc174355efebdd673cb282fb

      SHA256

      5ae21118d3f285ce208a6d2411a6b9f2ea0467cc46dc8cb5c7076f4a38c82924

      SHA512

      2455d7112214639b1a5a6c02b2a57987a6631f0c10205e3bedc7a49385b19a388b045d5f1f03e09daa0bc2451aba8ea3f4caecdc26c07a49639a1dc2aa979ce2

      Download Submit

    • C:\Program Files\msedge_installer.log
      Filesize

      98KB

      MD5

      d5a8acb95aa901881a3395b2c1502dd1

      SHA1

      eec92c422585f49651194ab0a60fbe1b4fe1126d

      SHA256

      713621d8d2b54ee7a1fe08dc1d0497837e3467a1394d6928ae66843bead44c9b

      SHA512

      b6c85e9905ea83388372b39743db5252da2dc0d1d361f36217b64184b3da63b096d8d378c4089e7528807528bbbd287259a127804fe69e93c38225719496bea9

      Download Submit

    • C:\Program Files\msedge_installer.log
      Filesize

      99KB

      MD5

      42898aba4bd876f937bb7bf528168d76

      SHA1

      73b063d927134b58cfd2617b0ee41d6ba143088d

      SHA256

      12fce26f0adce568c8bff8531608b85ce7c8652a97edb1918df4424fddc25bd2

      SHA512

      3abb9d00d3c076dee5e779ef95483a85a56835c022af8276a515177437bbcfcfa049722554be6f9012066bfebf407af9871c06a824bdd5808563579ad28dc51d

      Download Submit

    • C:\Program Files\msedge_installer.log
      Filesize

      101KB

      MD5

      63649a0c6b96136bfe725d4f4b4c5abe

      SHA1

      cf43a2746d29fcb3bac9a6f7039424c8ddb21a1d

      SHA256

      38ca2e245f45d7bdbe820cf3759b28f539dacc5c5bb166c786274e7e8d9cb005

      SHA512

      b3ca481e96e9e73329b13593df3b35658d68a63ee28d2a8043099fca1ec189f47f5a421020f1e2a7625a9dbfa015d8aeeab27889a1942241d1960a09af365f87

      Download Submit

    • C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\decrypt.txt
      Filesize

      588B

      MD5

      c7d974de3a522580c6ac4787958c6075

      SHA1

      262b1ec5da188a2c16f24532620a01551aa951e3

      SHA256

      f420643fbabef7cf8fb4d6ee192ef51589971d36c0c0091df10807551c32b16a

      SHA512

      14b73a95b0f105c86135bca8c9f608b7f42df6531ddf2b8e4b51864fcd5fe7b1a1e70dcbebec80789bc10d6e116d6610b0f6373e7f499e6a3d23c47be717d65f

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ransomware2.exe.log
      Filesize

      1KB

      MD5

      baf55b95da4a601229647f25dad12878

      SHA1

      abc16954ebfd213733c4493fc1910164d825cac8

      SHA256

      ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

      SHA512

      24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

      Download Submit

    • C:\Users\Admin\AppData\Roaming\svchost.exe
      Filesize

      27KB

      MD5

      a0feb977ec93ffe5939ff03e81f7eda7

      SHA1

      4b02f7dc42e715bf54492cbfe0f0f5dccec1729e

      SHA256

      da00e98797600787431cb3c4c5d2771b2c3f235848247f7ab8c98453bb16b654

      SHA512

      10732bc014891dee37f84d3fb91da1c804151379cd1df54a8472199ebb05fae6ab018d35142c91a932027ff29af9ae3b9659ca64a9448207800958a92210f3f6

      Download Submit

    • C:\Users\All Users\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
      Filesize

      422KB

      MD5

      801ccc2d68b8ff51420521f0bc50156f

      SHA1

      fb5ba714e3617f8a815a415b74b454073352e62e

      SHA256

      f7566d7716eaf67e4bc47f4f4a25047077111acc3a2b5e18a918a00197bf4af0

      SHA512

      dbc831b1b2d1e75d817ca1075e9d389b3270b295947f8b522e634e6d6a54eb0186779650e3470febdba54a07c8ec942926dcf73d2e0ea3d34179063ce85b8b9b

      Download Submit

    • C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
      Filesize

      1B

      MD5

      d1457b72c3fb323a2671125aef3eab5d

      SHA1

      5bab61eb53176449e25c2c82f172b82cb13ffb9d

      SHA256

      8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

      SHA512

      ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

      Download Submit

    • memory/640-0-0x00007FFB80893000-0x00007FFB80895000-memory.dmp

      Filesize

      8KB

      Download

    • memory/640-15-0x00007FFB80890000-0x00007FFB81351000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/640-2-0x00007FFB80890000-0x00007FFB81351000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/640-1-0x0000000000F20000-0x0000000000F2E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/4376-1200-0x00007FFB80890000-0x00007FFB81351000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4376-16-0x00007FFB80890000-0x00007FFB81351000-memory.dmp

      Filesize

      10.8MB

      Download