analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Chaos Ransomware Builder v4.exe

Full analysis: https://app.any.run/tasks/4523c0cf-7a0a-4625-b176-1aae4ff2f50a
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Analysis date: January 14, 2022, 21:35:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

8B855E56E41A6E10D28522A20C1E0341

SHA1:

17EA75272CFE3749C6727388FD444D2C970F9D01

SHA256:

F2665F89BA53ABD3DEB81988C0D5194992214053E77FC89B98B64A31A7504D77

SSDEEP:

3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i21:9aiWm162qJEsNiym16ryAiym168m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Starts Visual C# compiler

      • Chaos Ransomware Builder v4.exe (PID: 3172)
    • Drops executable file immediately after starts

      • csc.exe (PID: 3328)
      • Ransomware1.exe (PID: 1784)
      • Ransomware1.exe (PID: 1760)
    • Application was dropped or rewritten from another process

      • Ransomware1.exe (PID: 1784)
      • svchost.exe (PID: 1996)
      • Decrypter.exe (PID: 3716)
      • Decrypter.exe (PID: 3088)
      • svchost.exe (PID: 356)
      • Ransomware1.exe (PID: 1760)
      • Decrypter.exe (PID: 2828)
      • Decrypter.exe (PID: 868)
    • Writes to a start menu file

      • svchost.exe (PID: 1996)
      • svchost.exe (PID: 356)
    • Steals credentials from Web Browsers

      • svchost.exe (PID: 1996)
      • Decrypter.exe (PID: 3088)
      • Decrypter.exe (PID: 868)
    • Actions looks like stealing of personal data

      • svchost.exe (PID: 1996)
      • Decrypter.exe (PID: 3088)
      • Decrypter.exe (PID: 868)
    • Renames files like Ransomware

      • svchost.exe (PID: 1996)
      • svchost.exe (PID: 356)
    • Deletes shadow copies

      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 1148)
      • cmd.exe (PID: 3300)
      • cmd.exe (PID: 3276)
    • Runs injected code in another process

      • wbadmin.exe (PID: 3476)
    • Application was injected by another process

      • svchost.exe (PID: 4076)
      • svchost.exe (PID: 548)
      • wmiprvse.exe (PID: 4056)
      • svchost.exe (PID: 924)
      • SearchIndexer.exe (PID: 2796)
    • Starts BCDEDIT.EXE to disable recovery

      • cmd.exe (PID: 2880)
      • cmd.exe (PID: 580)
    • Loads the Task Scheduler COM API

      • wbengine.exe (PID: 1400)
  • SUSPICIOUS

    • Reads the computer name

      • Chaos Ransomware Builder v4.exe (PID: 3172)
      • Ransomware1.exe (PID: 1784)
      • svchost.exe (PID: 1996)
      • Decrypter.exe (PID: 3088)
      • WMIC.exe (PID: 2972)
      • wmiprvse.exe (PID: 4056)
      • Ransomware1.exe (PID: 1760)
      • svchost.exe (PID: 356)
      • WMIC.exe (PID: 3684)
      • Decrypter.exe (PID: 868)
    • Checks supported languages

      • Chaos Ransomware Builder v4.exe (PID: 3172)
      • cvtres.exe (PID: 1256)
      • csc.exe (PID: 3328)
      • Ransomware1.exe (PID: 1784)
      • svchost.exe (PID: 1996)
      • Decrypter.exe (PID: 3088)
      • cmd.exe (PID: 3720)
      • wmiprvse.exe (PID: 4056)
      • WMIC.exe (PID: 2972)
      • cmd.exe (PID: 1148)
      • cmd.exe (PID: 2880)
      • Ransomware1.exe (PID: 1760)
      • svchost.exe (PID: 356)
      • cmd.exe (PID: 3300)
      • cmd.exe (PID: 580)
      • WMIC.exe (PID: 3684)
      • cmd.exe (PID: 3276)
      • Decrypter.exe (PID: 868)
    • Executable content was dropped or overwritten

      • Chaos Ransomware Builder v4.exe (PID: 3172)
      • csc.exe (PID: 3328)
      • Ransomware1.exe (PID: 1784)
      • Ransomware1.exe (PID: 1760)
    • Drops a file that was compiled in debug mode

      • Chaos Ransomware Builder v4.exe (PID: 3172)
    • Drops a file with a compile date too recent

      • csc.exe (PID: 3328)
      • Ransomware1.exe (PID: 1784)
      • Ransomware1.exe (PID: 1760)
    • Creates executable files which already exist in Windows

      • Ransomware1.exe (PID: 1784)
      • Ransomware1.exe (PID: 1760)
    • Creates files in the user directory

      • Ransomware1.exe (PID: 1784)
      • svchost.exe (PID: 1996)
      • Ransomware1.exe (PID: 1760)
      • svchost.exe (PID: 356)
    • Starts itself from another location

      • Ransomware1.exe (PID: 1784)
      • Ransomware1.exe (PID: 1760)
    • Writes to a desktop.ini file (may be used to cloak folders)

      • svchost.exe (PID: 1996)
    • Creates files in the program directory

      • SearchIndexer.exe (PID: 2796)
    • Reads the cookies of Mozilla Firefox

      • Decrypter.exe (PID: 3088)
      • Decrypter.exe (PID: 868)
    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 1996)
      • svchost.exe (PID: 356)
    • Executed as Windows Service

      • vssvc.exe (PID: 2172)
      • wbengine.exe (PID: 1400)
      • vds.exe (PID: 2920)
    • Executed via COM

      • vdsldr.exe (PID: 2260)
    • Creates files in the Windows directory

      • wbadmin.exe (PID: 3476)
  • INFO

    • Manual execution by user

      • Ransomware1.exe (PID: 1784)
      • Decrypter.exe (PID: 3716)
      • Decrypter.exe (PID: 3088)
      • Ransomware1.exe (PID: 1760)
      • Decrypter.exe (PID: 2828)
      • Decrypter.exe (PID: 868)
    • Dropped object may contain Bitcoin addresses

      • Decrypter.exe (PID: 3088)
      • Decrypter.exe (PID: 868)
    • Checks supported languages

      • vssadmin.exe (PID: 804)
      • vssvc.exe (PID: 2172)
      • svchost.exe (PID: 4076)
      • bcdedit.exe (PID: 2200)
      • bcdedit.exe (PID: 1288)
      • wbengine.exe (PID: 1400)
      • vds.exe (PID: 2920)
      • vdsldr.exe (PID: 2260)
      • wbadmin.exe (PID: 3476)
      • vssadmin.exe (PID: 2696)
      • bcdedit.exe (PID: 2688)
      • bcdedit.exe (PID: 1068)
      • wbadmin.exe (PID: 2040)
      • NOTEPAD.EXE (PID: 3636)
    • Reads the computer name

      • vssadmin.exe (PID: 804)
      • vssvc.exe (PID: 2172)
      • svchost.exe (PID: 4076)
      • wbengine.exe (PID: 1400)
      • wbadmin.exe (PID: 3476)
      • vdsldr.exe (PID: 2260)
      • vds.exe (PID: 2920)
      • vssadmin.exe (PID: 2696)
      • wbadmin.exe (PID: 2040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:08:04 09:08:22+02:00
PEType: PE32
LinkerVersion: 11
CodeSize: 439808
InitializedDataSize: 123392
UninitializedDataSize: -
EntryPoint: 0x6d5ae
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.0.0.0
ProductVersionNumber: 3.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription: Chaos Ransomware v4
FileVersion: 3.0.0.0
InternalName: Chaos Ransomware Builder v4.exe
LegalCopyright: Copyright © 2021
OriginalFileName: Chaos Ransomware Builder v4.exe
ProductName: Chaos Ransomware Builder v4
ProductVersion: 3.0.0.0
AssemblyVersion: 3.0.0.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 04-Aug-2021 07:08:22
Debug artifacts:
  • c:\Users\User\Desktop\builder\CustomWindowsForm\obj\Debug\Chaos Ransomware Builder v4.pdb
FileDescription: Chaos Ransomware v4
FileVersion: 3.0.0.0
InternalName: Chaos Ransomware Builder v4.exe
LegalCopyright: Copyright © 2021
OriginalFilename: Chaos Ransomware Builder v4.exe
ProductName: Chaos Ransomware Builder v4
ProductVersion: 3.0.0.0
Assembly Version: 3.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 04-Aug-2021 07:08:22
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x0006B5B4
0x0006B600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
4.75892
.rsrc
0x0006E000
0x0001DF58
0x0001E000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.60752
.reloc
0x0008C000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.43134
3319
UNKNOWN
UNKNOWN
RT_MANIFEST
2
7.96514
18331
UNKNOWN
UNKNOWN
RT_ICON
3
3.21367
67624
UNKNOWN
UNKNOWN
RT_ICON
4
3.4715
16936
UNKNOWN
UNKNOWN
RT_ICON
5
3.61336
9640
UNKNOWN
UNKNOWN
RT_ICON
6
3.89701
4264
UNKNOWN
UNKNOWN
RT_ICON
7
4.44409
1128
UNKNOWN
UNKNOWN
RT_ICON
32512
2.8494
90
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
105
Monitored processes
38
Malicious processes
11
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start inject inject inject inject inject drop and start chaos ransomware builder v4.exe no specs chaos ransomware builder v4.exe csc.exe cvtres.exe no specs ransomware1.exe svchost.exe decrypter.exe no specs decrypter.exe cmd.exe no specs vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs cmd.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs wbadmin.exe no specs svchost.exe svchost.exe searchindexer.exe svchost.exe wmiprvse.exe wbengine.exe no specs vdsldr.exe no specs vds.exe no specs ransomware1.exe svchost.exe cmd.exe no specs vssadmin.exe no specs wmic.exe no specs cmd.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs wbadmin.exe no specs notepad.exe no specs decrypter.exe no specs decrypter.exe

Process information

PID
CMD
Path
Indicators
Parent process
3268"C:\Users\admin\Desktop\Chaos Ransomware Builder v4.exe" C:\Users\admin\Desktop\Chaos Ransomware Builder v4.exeExplorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
Chaos Ransomware v4
Exit code:
3221226540
Version:
3.0.0.0
3172"C:\Users\admin\Desktop\Chaos Ransomware Builder v4.exe" C:\Users\admin\Desktop\Chaos Ransomware Builder v4.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Description:
Chaos Ransomware v4
Exit code:
0
Version:
3.0.0.0
3328"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ybgzzu5n.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Chaos Ransomware Builder v4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
1256C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES42FE.tmp" "c:\Users\admin\Desktop\CSCBB96916CC0BE493BAFD05C786FF37CB9.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.execsc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft� Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
12.00.51209.34209 built by: FX452RTMGDR
1784"C:\Users\admin\Desktop\Ransomware1.exe" C:\Users\admin\Desktop\Ransomware1.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
1
Version:
0.0.0.0
1996"C:\Users\admin\AppData\Roaming\svchost.exe" C:\Users\admin\AppData\Roaming\svchost.exe
Ransomware1.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
4294967295
Version:
0.0.0.0
3716"C:\Users\admin\Desktop\decryptmyfiles-decrypter\Decrypter.exe" C:\Users\admin\Desktop\decryptmyfiles-decrypter\Decrypter.exeExplorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
Chaos ransomware decrypter
Exit code:
3221226540
Version:
1.0.0.0
3088"C:\Users\admin\Desktop\decryptmyfiles-decrypter\Decrypter.exe" C:\Users\admin\Desktop\decryptmyfiles-decrypter\Decrypter.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Description:
Chaos ransomware decrypter
Exit code:
0
Version:
1.0.0.0
3720"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy deleteC:\Windows\System32\cmd.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
804vssadmin delete shadows /all /quiet C:\Windows\system32\vssadmin.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft� Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
28 192
Read events
28 075
Write events
114
Delete events
3

Modification events

(PID) Process:(548) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
5254006FB319
(PID) Process:(3172) Chaos Ransomware Builder v4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3172) Chaos Ransomware Builder v4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3172) Chaos Ransomware Builder v4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3172) Chaos Ransomware Builder v4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3172) Chaos Ransomware Builder v4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU
Operation:writeName:4
Value:
4300680061006F0073002000520061006E0073006F006D00770061007200650020004200750069006C006400650072002000760034002E006500780065000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000
(PID) Process:(3172) Chaos Ransomware Builder v4.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
0202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(3172) Chaos Ransomware Builder v4.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
01000000020000000D0000000C000000000000000B00000007000000060000000A0000000900000008000000030000000500000004000000FFFFFFFF
(PID) Process:(3172) Chaos Ransomware Builder v4.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3172) Chaos Ransomware Builder v4.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-2
Value:
Access the computers and devices that are on your network.
Executable files
4
Suspicious files
76
Text files
1 462
Unknown types
193

Dropped files

PID
Process
Filename
Type
1256cvtres.exeC:\Users\admin\AppData\Local\Temp\RES42FE.tmpo
MD5:8AD34D2F771E36D9885CE0C3A49B8753
SHA256:E0FA38FADC75EA356364DB1D443B8797FABCCDA89EB82EF01F0A02045D22903E
924svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:49F06E2A3BB08560603B73290C1CD2DF
SHA256:2A330AA0C294D1ACD431DE14F419ADC2BAB911ED93C92464CFCD6869D9884427
3172Chaos Ransomware Builder v4.exeC:\Users\admin\Desktop\decryptmyfiles-decrypter\publicKey.chaosxml
MD5:B7104A60D655B88319CD9E75ABA507A1
SHA256:6DF41888EDCD46CFF2EC6A7B5386C18CD2238BF1435CF4B185DDB90156DE878E
1996svchost.exeC:\Users\admin\Desktop\autoenglish.rtftext
MD5:A8F17F0E8DA05B68E8A90ABB427F426E
SHA256:4A39E34B8E472BA5BD6555B54DAFE6C8C0134D48383697AA9D1477836A3988F5
1996svchost.exeC:\Users\admin\Desktop\basereally.rtf.enc1text
MD5:A55F07451F4A72A14BA6338A3298E10F
SHA256:C61381D0B28BF27A131DCEDE0C9A0345273091BD9EE596C41CB85E1C61A3AA6A
1996svchost.exeC:\Users\admin\Desktop\currentfactors.jpg.enc1text
MD5:EEFC1D1573D384B06E9212176B135652
SHA256:D12660E12634B470B752372C80D1D74F8451BC79C851B43493CA327F7777442D
3328csc.exeC:\Users\admin\AppData\Local\Temp\ybgzzu5n.outtext
MD5:37D8F04579A94675BF8860133C4669B5
SHA256:51D68F22B20C28EA615CC19A4CF1B9968F831632264B5B7A5E1698138B575E35
3172Chaos Ransomware Builder v4.exeC:\Users\admin\AppData\Local\Temp\ybgzzu5n.cmdlinetext
MD5:5607185211CAB7AECB7BFA27D195FB0A
SHA256:5C99317EB53F5325FDF107A26E7092E881DE24FC656BDC5CF30AEF55A9773BAD
3328csc.exeC:\Users\admin\Desktop\CSCBB96916CC0BE493BAFD05C786FF37CB9.TMPres
MD5:81818E147287ECB7E0C450FFA1AEAAD7
SHA256:424A1CE592BA8F8DFA91333A75A727278AE6ACC4F8AAC6B7BD32F41495FB7AED
3328csc.exeC:\Users\admin\Desktop\Ransomware1.exeexecutable
MD5:F14D5DD02894790863A5A6B33270B3E5
SHA256:8F259F6D1777A810AD2429B4DD0DB47770012DD2177E4295A6473080B745D9C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info