a1a40f906bfa0649e655908076cfbe325175bde8c71926b02448443fac7d40af

Analysis

max time kernel
150s
max time network
162s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CANdelaPersistors20 (1).exe
Size 107.8MB
Sample260922-kcyqrssbjf
SHA256 a1a40f906bfa0649e655908076cfbe325175bde8c71926b02448443fac7d40af
MD5 a470024cab70d6a39e9e735ddeb42827
SHA1 fe6d4fd1a32df56a02f03f281a46fb34dd38165a
SHA512 d13a0de94c6909b8864d8d8cffb0460f86b44e650c35d477814efc93eb8731c29cc0e275984e8ec73817038ff25bbc79690b117ec419bd19f650aeddfb381397
SSDEEP 3145728:ahMUnkP6DsH4Ociz5tuvVOPc/EW3UCNs6OyictQ6TmBG3I:uMS1DsY/KuvIgjUvfctQ6T2G3I
TLSH
T14B4833C398DCAE7CCEAA397E43A27B5D8ED1242F107A6C76E598CDC0125453297F4B24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/files/0x000d00000001c55c-47.dat	SmartAssembly

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.2.1_12.0.1_12.5.99999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.2.1_8.2.1_8.5.99999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\13.0.1_13.0.1_15.0.99999\CANdelaConvert.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.5.1_8.5.1_9.0.99999\CANdelaConvert.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Docs\CANdelaStudioSmall.jpg	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\3.0.16_3.0.16_4.0.140\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.5.1_8.5.1_9.0.99999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\9.1.1_9.1.1_12.0.99999\CANdelaConvert.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\17.0.1_17.0.1_18.0.99999\DaMe.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\4.0.1_4.0.1_5.0.999\Logging.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.0.1_5.0.1_5.5.999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\9.0.1_9.0.1_9.1.99999\VeLogging.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.0.1_7.0.1_7.1.99999\Requirements.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.2.1_8.2.1_8.5.99999\Requirements.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.1.1_7.1.1_7.5.99999\CANdelaSharedUtil.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\9.0.1_9.0.1_9.1.99999\DaMe.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\18.0.1_18.0.1_20.0.99999\VeLogging.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\12.5.1_12.5.1_13.0.99999\CANdelaConvert.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\6.0.1_6.0.1_6.5.999\DaMe.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.1.1_7.1.1_7.5.99999\DaMe.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\9.1.1_9.1.1_12.0.99999\DaMe.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.2.1_8.2.1_8.5.99999\expatw.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\6.5.1_6.5.1_7.0.999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.1.1_7.1.1_7.5.99999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\3.0.16_3.0.16_4.0.140\expatw.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.5.1_5.5.1_6.0.999\Logging.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.5.1_5.5.1_6.0.999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\9.0.1_9.0.1_9.1.99999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.5.1_8.5.1_9.0.99999\Requirements.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\18.0.1_18.0.1_20.0.99999\CANdelaConvert.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\3.0.16_3.0.16_4.0.140\CANdelaConvert.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.0.1_5.0.1_5.5.999\expatw.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.5.1_8.5.1_9.0.99999\expatw.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\12.5.1_12.5.1_13.0.99999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\4.0.1_4.0.1_5.0.999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.0.1_7.0.1_7.1.99999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.0.1_8.0.1_8.2.99999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\17.0.1_17.0.1_18.0.99999\CANdelaConvert.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\13.0.1_13.0.1_15.0.99999\DaMe.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\1.1.0_2.0.5_3.0.16\expatw.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\13.0.1_13.0.1_15.0.99999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\12.5.1_12.5.1_13.0.99999\VeLogging.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\4.0.1_4.0.1_5.0.999\Dame.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.0.1_5.0.1_5.5.999\DaMe.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.5.1_8.5.1_9.0.99999\VeLogging.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\6.5.1_6.5.1_7.0.999\CANdelaSharedUtil.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\9.0.1_9.0.1_9.1.99999\Requirements.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.5.1_8.5.1_9.0.99999\DaMe.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.2.1_12.0.1_12.5.99999\Requirements.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.5.1_5.5.1_6.0.999\DaMe.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.1.1_7.1.1_7.5.99999\expatw.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.5.1_5.5.1_6.0.999\CANdelaConvert.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\4.0.1_4.0.1_5.0.999\expatw.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Docs\ReleaseNotes.htm	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\17.0.1_17.0.1_18.0.99999\VeLogging.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\1.1.0_2.0.5_3.0.16\Buffers.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\6.5.1_6.5.1_7.0.999\expatw.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\7.5.1_7.5.1_8.0.99999\expatw.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\15.0.1_15.0.1_16.0.99999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\18.0.1_18.0.1_20.0.99999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\6.0.1_6.0.1_6.5.999\Persistor.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\8.2.1_8.2.1_8.5.99999\CANdelaSharedUtil.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\15.0.1_15.0.1_16.0.99999\DaMe.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\6.0.1_6.0.1_6.5.999\CANdelaConvert.exe	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5a2145.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a2145.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D1AB5818-B0E4-454A-972E-D45DBB94A0D0}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEFD8AF7DDEEEFB3B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3068.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a2149.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0E66DD2B11937EDC.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF03DC2D88E340E52A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF062E357D0E16122B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2812_136736123\manifest.json	msedge.exe

Executes dropped EXE 8 IoCs

pid	Process
3224	setup.exe
2616	MSIChainer.exe
4464	vcredist_x86.exe
6000	vcredist_x86.exe
5956	vc_redist.x86.exe
5416	vc_redist.x86.exe
1408	VC_redist.x86.exe
4940	UpdatePersistorsInstalledLocalToApplication.exe

Loads dropped DLL 2 IoCs

pid	Process
6000	vcredist_x86.exe
5416	vc_redist.x86.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CANdelaPersistors20 (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIChainer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatePersistorsInstalledLocalToApplication.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4320	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c1fdf03c8ae10a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380120c1fdf00000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410120c1fdf0000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e320c1fdf000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e620c1fdf000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345394551541843"	msedge.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{9DF9A9DA-97AC-4710-B3C8-ABDBAA58E64E}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SetupCS\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8185BA1D4E0BA45479E24DD5BB490A0D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\PackageCode = "352D8160DCEFDA94DB2F4DC25D3EB262"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList\PackageName = "CANdelaPersistors20.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\Version = "335544420"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AEAC170454295914DAC861E3912ADD36	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\SetupCS\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AEAC170454295914DAC861E3912ADD36\8185BA1D4E0BA45479E24DD5BB490A0D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8185BA1D4E0BA45479E24DD5BB490A0D\FeatureCANdelaPersistors	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\ProductName = "Vector CANdelaPersistors 20"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8185BA1D4E0BA45479E24DD5BB490A0D\Assignment = "1"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4876	msiexec.exe
4876	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2144	vssvc.exe
Token: SeRestorePrivilege	2144	vssvc.exe
Token: SeAuditPrivilege	2144	vssvc.exe
Token: SeBackupPrivilege	1112	srtasks.exe
Token: SeRestorePrivilege	1112	srtasks.exe
Token: SeSecurityPrivilege	1112	srtasks.exe
Token: SeTakeOwnershipPrivilege	1112	srtasks.exe
Token: SeBackupPrivilege	1112	srtasks.exe
Token: SeRestorePrivilege	1112	srtasks.exe
Token: SeSecurityPrivilege	1112	srtasks.exe
Token: SeTakeOwnershipPrivilege	1112	srtasks.exe
Token: SeShutdownPrivilege	2616	MSIChainer.exe
Token: SeIncreaseQuotaPrivilege	2616	MSIChainer.exe
Token: SeSecurityPrivilege	4876	msiexec.exe
Token: SeCreateTokenPrivilege	2616	MSIChainer.exe
Token: SeAssignPrimaryTokenPrivilege	2616	MSIChainer.exe
Token: SeLockMemoryPrivilege	2616	MSIChainer.exe
Token: SeIncreaseQuotaPrivilege	2616	MSIChainer.exe
Token: SeMachineAccountPrivilege	2616	MSIChainer.exe
Token: SeTcbPrivilege	2616	MSIChainer.exe
Token: SeSecurityPrivilege	2616	MSIChainer.exe
Token: SeTakeOwnershipPrivilege	2616	MSIChainer.exe
Token: SeLoadDriverPrivilege	2616	MSIChainer.exe
Token: SeSystemProfilePrivilege	2616	MSIChainer.exe
Token: SeSystemtimePrivilege	2616	MSIChainer.exe
Token: SeProfSingleProcessPrivilege	2616	MSIChainer.exe
Token: SeIncBasePriorityPrivilege	2616	MSIChainer.exe
Token: SeCreatePagefilePrivilege	2616	MSIChainer.exe
Token: SeCreatePermanentPrivilege	2616	MSIChainer.exe
Token: SeBackupPrivilege	2616	MSIChainer.exe
Token: SeRestorePrivilege	2616	MSIChainer.exe
Token: SeShutdownPrivilege	2616	MSIChainer.exe
Token: SeDebugPrivilege	2616	MSIChainer.exe
Token: SeAuditPrivilege	2616	MSIChainer.exe
Token: SeSystemEnvironmentPrivilege	2616	MSIChainer.exe
Token: SeChangeNotifyPrivilege	2616	MSIChainer.exe
Token: SeRemoteShutdownPrivilege	2616	MSIChainer.exe
Token: SeUndockPrivilege	2616	MSIChainer.exe
Token: SeSyncAgentPrivilege	2616	MSIChainer.exe
Token: SeEnableDelegationPrivilege	2616	MSIChainer.exe
Token: SeManageVolumePrivilege	2616	MSIChainer.exe
Token: SeImpersonatePrivilege	2616	MSIChainer.exe
Token: SeCreateGlobalPrivilege	2616	MSIChainer.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2812	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4876	msiexec.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 3224	3400	CANdelaPersistors20 (1).exe	89
PID 3224 wrote to memory of 2616	3224	setup.exe	90
PID 2616 wrote to memory of 4464	2616	MSIChainer.exe	91
PID 4464 wrote to memory of 6000	4464	vcredist_x86.exe	92
PID 2616 wrote to memory of 5956	2616	MSIChainer.exe	101
PID 5956 wrote to memory of 5416	5956	vc_redist.x86.exe	102
PID 5416 wrote to memory of 1408	5416	vc_redist.x86.exe	103
PID 2616 wrote to memory of 2812	2616	MSIChainer.exe	107
PID 3400 wrote to memory of 4940	3400	CANdelaPersistors20 (1).exe	108
PID 2812 wrote to memory of 4268	2812	msedge.exe	110
PID 2812 wrote to memory of 4320	2812	msedge.exe	111
PID 2812 wrote to memory of 2140	2812	msedge.exe	112
PID 2812 wrote to memory of 2140	2812	msedge.exe	112
PID 2812 wrote to memory of 5632	2812	msedge.exe	113
PID 2812 wrote to memory of 2140	2812	msedge.exe	112
PID 2812 wrote to memory of 5632	2812	msedge.exe	113
PID 2812 wrote to memory of 1408	2812	msedge.exe	114
PID 2812 wrote to memory of 1408	2812	msedge.exe	114
PID 2812 wrote to memory of 1408	2812	msedge.exe	114
PID 2812 wrote to memory of 1124	2812	msedge.exe	115
PID 2812 wrote to memory of 1124	2812	msedge.exe	115
PID 2812 wrote to memory of 1124	2812	msedge.exe	115
PID 2812 wrote to memory of 1316	2812	msedge.exe	117
PID 2812 wrote to memory of 1316	2812	msedge.exe	117
PID 2812 wrote to memory of 1316	2812	msedge.exe	117
PID 2812 wrote to memory of 1864	2812	msedge.exe	118
PID 2812 wrote to memory of 1864	2812	msedge.exe	118
PID 2812 wrote to memory of 1864	2812	msedge.exe	118
PID 2812 wrote to memory of 1984	2812	msedge.exe	120
PID 2812 wrote to memory of 3000	2812	msedge.exe	121
PID 2812 wrote to memory of 1984	2812	msedge.exe	120
PID 2812 wrote to memory of 5688	2812	msedge.exe	122
PID 2812 wrote to memory of 3000	2812	msedge.exe	121
PID 2812 wrote to memory of 5688	2812	msedge.exe	122
PID 2812 wrote to memory of 1360	2812	msedge.exe	124
PID 2812 wrote to memory of 5568	2812	msedge.exe	125
PID 2812 wrote to memory of 5568	2812	msedge.exe	125
PID 2812 wrote to memory of 5660	2812	msedge.exe	126
PID 2812 wrote to memory of 5660	2812	msedge.exe	126
PID 2812 wrote to memory of 3816	2812	msedge.exe	130
PID 2812 wrote to memory of 5648	2812	msedge.exe	131
PID 2812 wrote to memory of 4136	2812	msedge.exe	132
PID 2812 wrote to memory of 5568	2812	msedge.exe	133
PID 2812 wrote to memory of 5568	2812	msedge.exe	133
PID 2812 wrote to memory of 3660	2812	msedge.exe	137
PID 2812 wrote to memory of 3660	2812	msedge.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\CANdelaPersistors20 (1).exe
"C:\Users\Admin\AppData\Local\Temp\CANdelaPersistors20 (1).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Users\Admin\AppData\Local\Temp\SetupCS\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\SetupCS\setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Users\Admin\AppData\Local\Temp\SetupCS\MSIChainer.exe
    C:\Users\Admin\AppData\Local\Temp\SetupCS\MSIChainer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\SetupCS\Prerequisites\vc12_cpp_redist_x86\vcredist_x86.exe
      "C:\Users\Admin\AppData\Local\Temp\SetupCS\Prerequisites\vc12_cpp_redist_x86\vcredist_x86.exe" /install /quiet /norestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\SetupCS\Prerequisites\vc12_cpp_redist_x86\vcredist_x86.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SetupCS\Prerequisites\vc12_cpp_redist_x86\vcredist_x86.exe" /install /quiet /norestart -burn.unelevated BurnPipe.{F46442D7-7A6C-4D3C-A75B-0CD8848EA654} {5A02FF89-819E-4BB8-B411-A588D0047C96} 4464
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\SetupCS\Prerequisites\vc14_cpp_redist_x86\vc_redist.x86.exe
      "C:\Users\Admin\AppData\Local\Temp\SetupCS\Prerequisites\vc14_cpp_redist_x86\vc_redist.x86.exe" /install /quiet /norestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5956
    - - C:\Windows\Temp\{4BEDFF39-EFCC-44AD-8070-CBD9658B9F2D}\.cr\vc_redist.x86.exe
        
        "C:\Windows\Temp\{4BEDFF39-EFCC-44AD-8070-CBD9658B9F2D}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\SetupCS\Prerequisites\vc14_cpp_redist_x86\vc_redist.x86.exe" -burn.filehandle.attached=760 -burn.filehandle.self=764 /install /quiet /norestart
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5416
      - C:\Windows\Temp\{81FA587E-028D-43F3-86D3-EC0DA64035E2}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{81FA587E-028D-43F3-86D3-EC0DA64035E2}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{B2EB0392-4ED6-4370-857F-5B53D7276137} {8C26ADC1-A356-471B-B64E-C77742BC2663} 5416
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Docs\ReleaseNotes.htm
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x350,0x7ff82d02c188,0x7ff82d02c194,0x7ff82d02c1a0
        5⤵
        
        PID:4268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,12212860930352971891,761867201544686540,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,17428996785875743240,3961305068404599555,262144 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
        5⤵
        
        PID:2140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,9525185678860242247,8415617097275099284,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:13
        5⤵
        
        PID:5632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,11370195593305123966,2466236511256981980,2097152 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
        5⤵
        
        PID:1408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,13976623709842635665,5274020161957614304,2097152 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
        5⤵
        
        PID:1124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,13424196216086913867,17023380355510149331,2097152 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
        5⤵
        
        PID:1316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,12623940481578846394,3542574623505759672,2097152 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:9
        5⤵
        
        PID:1864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,11876052194455447607,7671440729416546206,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
        5⤵
        
        PID:1984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,6557235225359557126,3925907061272590508,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
        5⤵
        
        PID:3000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,6349573152752592951,16789356393227204547,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
        5⤵
        
        PID:5688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,1022115956729575059,6292681344648106520,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
        5⤵
        
        PID:1856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,1022115956729575059,6292681344648106520,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
        5⤵
        
        PID:1360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,4030137326192238608,5120033093278576295,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
        5⤵
        
        PID:5568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,6892874698634022762,13684960814675159475,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
        5⤵
        
        PID:5660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,10750492124833696686,11168783336191871314,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
        5⤵
        
        PID:3816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,9792816690921344584,14211112716222028389,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
        5⤵
        
        PID:5648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,1578974961302653316,1859535777580682191,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
        5⤵
        
        PID:4136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,7049695999607339095,10466868342299967882,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
        5⤵
        
        PID:5568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,17816666451150431904,13445258170943326614,524288 --field-trial-handle=2232,i,9549215282661701215,314155520545139747,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
        5⤵
        
        PID:3660
- C:\Users\Admin\AppData\Local\Temp\SetupCS\UpdatePersistorsInstalledLocalToApplication.exe
  "C:\Users\Admin\AppData\Local\Temp\SetupCS\UpdatePersistorsInstalledLocalToApplication.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
1⤵
PID:4228

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a2148.rbs

Path C:\Config.Msi\e5a2148.rbs
Size 37KB
SHA256 ee1b5cb5712a35d9affdc0a579c13914f927f298f64675823b1adfdf71eae8b3
MD5 7497fed611f5fd98af6fe2e83b143ad3
SHA1 31b9a2138d571c08c7d6b8af028aee229ee2496e
SHA512 a3e7e958fff0cfa9ee26753fe722937482e7d9fddbc9c4f6b220905bb52650c98e01c0b700a08b0c83e4b09aef48be7dc400886c8d042edc606f8e30247ddffa
SSDEEP 768:TvLlL8LlLjLlLjLlLYLlLgLlL9LlL5LlLLLlLhLlLALlLTLlLVLlL6LlLALlLfs+:jxYx/xvxExUxhx1x3xtxcxfxpx+xcxY+
TLSH
T1EE033E838E52D3FCFE5790A677926C61138ADFC927700532B16D631B69C0909BB782B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

expatw.dll

Path C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Bin\5.5.1_5.5.1_6.0.999\expatw.dll
Size 108KB
SHA256 2eb4054a039e52b360012bac51d91dd7ebf3cc52a4e6817e7967369809b8d5ad
MD5 64ea4ede62429692ed5d6afb0a3bd17f
SHA1 c292db93e68472eeb58a56f743ddc2e9d54e8e70
SHA512 51cee0e05a3b3ec0a7c7796664d5046cc0e49adc3c3cecd96a8df799973824b6608610e247e8072c3b2a144a768feabb1dcdb3d7089bcb9ed0ecbb7b22f72924
SSDEEP 1536:1owViW8je6l+2mx0lSDWwNc0xbK8Nq3KAyrFSjbZy:1o8iR7+7RWD0x+8I3diFSjbZy
TLSH
T1D9B30720BC83D02AE2D70136A1B80BA2597D9F6107EF55EFAE10B5BD8E339C27935715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReleaseNotes.htm

Path C:\Program Files (x86)\Common Files\Vector CANdelaPersistors 20\Docs\ReleaseNotes.htm
Size 14KB
SHA256 8680aeea2021d27f0e44e18aa7bcfa6218be63dd18fe236a43463052d279c3fd
MD5 7e5560304ea000bebc9993ad89fdde5a
SHA1 454d4c81cc475c5c66686f2ce18268cc56e77928
SHA512 90d3f907cee20625c059d99822a4ecb821cb7b00e9f9b0520bae13b3c92812ab845fd7b51da475e1b3b400e561c37706bcaf496805cdd8d77729eae94eb3d3e6
SSDEEP 192:FB1QVjh3p+yXOvoar4mf7umwuioiAiPMsVbpkM7RxvYVmoj:pejh5+y0r4mSmwT9VpbpkM7RxgVmoj
TLSH
T1BC52637940672E6A19F292FBF3136701AF28C8DB6E410376713FC21B3B94914996BB1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 816d0cc8a0d52b84b9678a0fdfb337006621a133d6af8efc5926ef351f3d311c
MD5 de09d431c6aed11dc059634bacaaff52
SHA1 58ae0c37d81bc44b8e47e2d5737b9a7365db83f8
SHA512 2295918d1d3b90a73935c3c83e3403a7cba881b7bc7f156de72d2006312a40c4091700e15dafd259f7f8522fd102dd0f2a28744c9b045bc3e143ffe9d767e88a
TLSH
T19651070596AC8076F39B037296F2DD8737F07D81BDA33F7225D8DDB4AA41B614891A70
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aa1a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5aa1a0.TMP
Size 2KB
SHA256 1b129c45b9748ae8afa68cecdfd7091696afe9bf0a2d9814f6ca93d4e7155137
MD5 977ae2e17f37dfcf2362e4bb210081de
SHA1 c02513d6dbe2871ff90bf2df4ed45d9204473d75
SHA512 9faef5c066d3d1805dc31f2dc1919a9169be6dac64c9beedf541b44c19e83c3ed70aeea4203553c7fbb18fbacfb76eeaca8ff9344778a728f678cc4cefdf248e
TLSH
T144512A0596AC8076F39A033186F2DD8737F07D817DB33F7221D8CDB4AA41B610881A70
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bdd5d51a48f424eefc27d3f5f71e94c2314262b1f6078c70891ebba4c5493599
MD5 e9610c0eacb55337f2c2306dfb226469
SHA1 9fc214e964530c1f4bb866db56d4f7623c0a6adc
SHA512 6d6238d9c2b0fd759a4360e3f822e6a28b9919d948d169571bfbeddde7a5273cbbc389eb530060098f8ab806ea731ed503a70d61ee92a7dbb1796ecb37e6246d
TLSH
T1BE51C0F7C3E8856ECA0156F0AA146E1BCE1D0914832C7D5AC8E4EF1B93E3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3d0e1ea18c8ac801d06d558cf3cbb81abd72795dd120365fdbcd54b53f5959ab
MD5 b5b7a1ac8e1604cbb197aa6731677f7a
SHA1 2c31683ae452992139be059bc984ee47a4888fbc
SHA512 9ac98f692766071d31e21c29697d7bb76671cbcd631525e434cee614c54be796f4d01f81a9482c0420382bcc17277a956135c60292073055645245759de78406
SSDEEP 192:sxRCR9CG/f2sCiZh9hzoA8p4c/g6+WNIYooP+GMEIgDGXJ:sxRCiG/f2sCkh9cp/5IsCo6
TLSH
T1E642B759AD28A93B8CCBD219BB657F53D6F9503360D51E48AAFC8A1C04EB6DD120381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a61d8df8b7acd097d0006000e164c06b40735957cfd8904aaf7a35e9e89edcdd
MD5 da8cd2d38e5caa6df901bf4d81940572
SHA1 799c0e35ab41ae3ce4a1f5356853e7fb17cfccc4
SHA512 78103b5c6f46e70fd1a8d485c16fe86e57d517aa0bd9a93435fe7a6ef0a3a39b089b56c4ea99f02e3715ad6b447bb4b3f8f5c476f13e076788d6d0aa3cbb6bfa
SSDEEP 192:sxRCR9CG/f2skiZh9hzoA8p4c/g6+WNIYojP+GMEIgDkXJ:sxRCiG/f2skkh9cp/5IfCo0
TLSH
T17432C859AE28A93B4CCBD219BB657F53D6F95033A0D51F48AAFC861C04EB6DD120381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d50d77a327f49e42e06c2552e32f7ba8ecdb769a5f762984b79c5ea67d31d62d
MD5 2633494709902ecf02a384c0c72ecb34
SHA1 5a1592c4c93df266bd86f5720f9ee2e1d33f45f0
SHA512 070326003c290b3dbc14ab4e6c1144787553e2dcfa21b3af3843668e910bad8af4b9ab9e32a3b2af3bf167b60263f38dcc122a0331c4353596660a3758a4c68b
SSDEEP 768:p/wWkO7pLuLbOnWg/Xf1p8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9/cH3IbroY7j4:p/wWkOEbOnWg/Xf1pu1ja6/cXIoY7j4
TLSH
T1D4D2DB7B740CCA7F4F804ADDDC197E9F6DA802CB9698CD8047FA985C02C67EA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6cc57946df76dad18fe4d679c3405e753e3074d2b6542467ae64f886ade0dd65
MD5 b92ba67c53ab05d2e225f06555537518
SHA1 87a9aa6294e456636b1bb9e9e15205dc1a62fce2
SHA512 05b4440934c28677805860b13ea3594870e74558774fa7c381f6ab36d702ec42d0d970d92bec019460f5dba9eed7d0c1e249b7b2eca752f01a6f0f15a459de23
SSDEEP 96:Kc0gKZ6SYrSP7lx1gR5kzjjgK71j9g/zjUdXJaKa4KZ:i3n4pZ
TLSH
T191911121317F6252397D340CA1E1B6AE429932623139EA2B37BB04A54E37E065DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe132498-09df-458a-a6a4-330ac5bed640.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe132498-09df-458a-a6a4-330ac5bed640.tmp
Size 11KB
SHA256 2c793c77da162c04d35f31478a535de5ee7d78399532ccdd1e3842735e7a0451
MD5 d6ef82de764d42ffd8e5c12d55c58781
SHA1 f3b2e62803fb69091c0adb978ea73a84c5f039de
SHA512 700c2ff2b2f1495c9cc4e248b18dec365b5c00d42a2b91743ca6a89390770457dd4e0ee6a1e98acc582cd57b3cad865c52c38cc581374bb59cbfccaec0b43842
SSDEEP 192:sxRhR9CG/f2s9iZh9hzoA8p4c/g6+WNIYojP+GMEIgVXJ:sxRhiG/f2s9kh9cp/5IfCor
TLSH
T16732B859AE28A93B4CCBD219BB657F53D6F95033A0D51E48EAFC861C04EB6DD120381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ea570fb-ff94-4e61-889c-b8f00fcd6232.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3ea570fb-ff94-4e61-889c-b8f00fcd6232.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 fd4618218c51c7661bb2f5bd51f00fc1e856386e2416c1e5da326485107fd9b0
MD5 86e0f8a8b600729e91162f63837a310a
SHA1 2639bb3bc7a9052d1b5973ddc97a8aa11d7f5284
SHA512 f571d69fb3eea332954e744e97e7aa206b25e72d434fb1b4db3bc10ef1e04dc405f5ceeaf43bbdf4300ea2f2e93bd3f91e878030b83210e0edd980b7f827ed74
SSDEEP 768:YFQ83pwg0509IOjMQK/9OA9at01j0iq00+IailMguxS:783c5rYCHq00NayMgES
TLSH
T19A038DB2E8A1CE77ACE6A7C5B70577869EF01163C5CD99C0CAD95E0D00876DE170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f5232a8a15ccfb574b7dc3ecfb0e9d84920c7e34f8a32f6687b291259474293b
MD5 34ee081f1a61452e1fda8168500e76e9
SHA1 c8e910f23b69320148c483986855395d87ef8f9d
SHA512 5aad7016fd67dc4824fd29214751a8a812dc33c513e54c627b7d07cfedac755698d62448bd0664834aa445d5b07ed0f7024b35724e8d4d3f5985124c3d2f9944
SSDEEP 768:RF3P5/cOjMQr/9OA9at01j0iq00+IailMguxS:RF3P5UtCHq00NayMgES
TLSH
T1B7F2AEB1EDB1CD73ACE6A285B70663865FF42163C5CD5A40C5E96F0E044769E2707C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 0afd0e47c9276c25b0dd5c9d68314279cc0156e7143862b313a91f3168c001c7
MD5 21f6c3eb6088ed86b29a404b4dcae979
SHA1 65548eddcd5755929de472b3017ea66913e7d93e
SHA512 1ee9574086abbc6b16d42bca3a75fdb8973be555045425b83494b51a6440b62fc836a0df69d2ce1c41d23157c277e2b982f91784045792c283cc4d30476a18d1
SSDEEP 768:X/UxvxjgC+H3Y5SOjM4/9OA9at01j0iq00+Ia2ASHxRz:KZj3+H3YgBCHq00NarSTz
TLSH
T19203B031ECA19D739CF7B384730A63979EF44663C5CA6AA049ED2E0E05876AD1307C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0e5d81d57a2082a5a076e5d095ac9c034ea31c91286a7ec8b90c24ab2d7d73dc
MD5 a78d88828601f60448cf88a3d9e5286e
SHA1 ef51143582f987bb2320113e1ee0208b8d079625
SHA512 e4c0649ea18b05d3534000160d37b482a766ba4979451052d8759aca71dcd54efc09b21652d0b19d3c5834f758297744cda3844069677371615a15df9e3a1529
SSDEEP 768:bF3i50cOjMQr/9OA9at01j0iq00+IailMguxS:bF3i53tCHq00NayMgES
TLSH
T10DF2AEB0ADA1CD739CEAB285B60663865FF42167C5CD5A40C5E96F0E044B69E2707C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CANdelaPersistors20.msi

Path C:\Users\Admin\AppData\Local\Temp\SetupCS\CANdelaPersistors20.msi
Size 38.4MB
SHA256 84b3fbc064e11e91db0f01fe4b754cb010460aac39a0a5ab70a7290697ea3888
MD5 75f6b1e1d0dbcf0fc34da6545abe584e
SHA1 0fffc0e76df7d14a70a94444b8fa94f58d2cb513
SHA512 2759c633b2744ff284942d689d199eea6954c440a8fe1c395f133690567eb7e2b9413fce080fa1dfcd58b78cea67985036836d797e8d1e5b3d8b8b60fb04fae6
SSDEEP 786432:LPgBbJVuIEj+kcZbGwRzofl3Q7VuNgs5CB9UMDjO3/:LoBlVua9EJQ7VuNgvB9v
TLSH
T1B6973383EDA2EB3EE85ED1BE48572B2E81418D3D4F506C2361B7B054A1F4769A9F430D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIChainer.INI

Path C:\Users\Admin\AppData\Local\Temp\SetupCS\MSIChainer.INI
Size 1KB
SHA256 ebf590c8cb9a351a42e354456e1312363468de7483d79f7130c3d41efb01f509
MD5 1d664cbdcc586e2e536ae0f0075f5d2a
SHA1 b7dc25ececad5cf43e3d1ca6746fb0b49be60734
SHA512 8dd5a88e83640ebcb8d29c97f964d5bdc8daa7de23c55cb10372f71d075efda69d56b1a64d0aa12c78b3917e81ed2ae7f5d77e90bc96ac2c013679b1c2026d0c
TLSH
T1DB110E0B8109707635F126F66E914F20B391E28BD153421470D708C8F307CEA93AEA3E
MD5 SHA1 SHA512 TLSH

Submit Download

MSIChainer.exe

Path C:\Users\Admin\AppData\Local\Temp\SetupCS\MSIChainer.exe
Size 168KB
SHA256 7c9eac57ec52aaf47e50a4d99670364c38791a2cdaa3ffbefee65ab8d5688365
MD5 81bdb1550cbd6aa55d25a858096dff1a
SHA1 94fe5de83ed7510aa606d6359e96d37cfb8f030c
SHA512 cdc796cf9665518c1fcaa8d6be56554bc122b0c554e1a068985008fba2235d90a94afd71d7cb28a37fc8c26844541ae12d93ec3bb30ab4e5caedcd38b1937ca2
SSDEEP 3072:AFcBCXoLaebmt1uO3KzfbvF6UhopxY6whps6FbEKY9OTEmcSLhxnf+Ud:AqBCXoLagmt1J0fbhra0TEmdrf+Ud
TLSH
T1E6F3070033F84657E6FFAAF9A87112914BF57D476A39E7CD1D8650EE18B2B80C960363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\Users\Admin\AppData\Local\Temp\SetupCS\Prerequisites\vc12_cpp_redist_x86\vcredist_x86.exe
Size 6.2MB
SHA256 a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048
MD5 0fc525b6b7b96a87523daa7a0013c69d
SHA1 df7f0a73bfa077e483e51bfb97f5e2eceedfb6a3
SHA512 729251371ed208898430040fe48cabd286a5671bd7f472a30e9021b68f73b2d49d85a0879920232426b139520f7e21321ba92646985216bf2f733c64e014a71d
SSDEEP 98304:hQEKzHx15bWUuBrNatjJh2eNUrzKRL/RaIswn7aBOC5qZxVqFb2iExMc7FvxwGvf:WRDnuBotjJh2emr8L/YIsG7MOgqHG64
TLSH
T13566233296642033D6F10873F469E2217E3E721C2F1188BAD294DC5D3EA95DAA7F7352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x86.exe

Path C:\Users\Admin\AppData\Local\Temp\SetupCS\Prerequisites\vc14_cpp_redist_x86\vc_redist.x86.exe
Size 13.1MB
SHA256 b7ae307237f869e09f7413691a2cd1944357b5cee28049c0a0d3430b47bb3edc
MD5 d3b594464f2312cde31af3f2aa516f9e
SHA1 15fe8e70c3c5582b70df173cd9b580331677735a
SHA512 ccb19250b90eb629c35a897aba6d0ab16402305d9ec16b97b902fc810cde5d215cf8149a273cc8f8cae5a4b0665b116c085fe3b01a3ab3860c44f20ca95d6e83
SSDEEP 393216:7/H+lptVYmfr7yBG/4tWp4uXK63Ntq+qS:7/upttD7yBG/cy4Aq+qS
TLSH
T164D63333B498843AD7F30533E964FA246E3DA128130089BBE6DCEC5E5B7415227FB656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdatePersistorsInstalledLocalToApplication.exe

Path C:\Users\Admin\AppData\Local\Temp\SetupCS\UpdatePersistorsInstalledLocalToApplication.exe
Size 46KB
SHA256 33eafdc63adad8ca65da1787cb92a472e3ec27ec50826061caad30ae0024bdb3
MD5 70438249103b0e89f1535ef1396affe7
SHA1 2b0478d480037c896b0356d144ec17be38d6a6ca
SHA512 7dc1a6be6d1dec294719d5c46b2b2c643955f93c6a988636b37dc2e5915c571c61c644d42b06878b3491c282847642c437943e79ec61c0821e8e60a4a187358d
SSDEEP 768:e+q93oETTfvzc4LnmzxHW85PPzYcHe+m:1qBn0z5PO+
TLSH
T18E2396ADADFC8277D5B5E5B98FE886A3B460D06B34109D3A69874246073390278C7E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\SetupCS\setup.exe
Size 190KB
SHA256 43ea877eb1d694dd481c131a97c4ef817a43d0674efc656b9d65ec80fd3ba48d
MD5 7c9ecb5c0f52ee75c97033aac0f8c811
SHA1 13bc05aa2212906eabb9bba0538c0d203d575cbc
SHA512 54e8d875d9b5290965e2ec525349e3111d9f048c155fe811cfc2d840b8fdb6cfe6f199c182a187f52549e80435bd1a9b9b3d8db59c9c8e55a70d33671161c477
SSDEEP 3072:+Jkiir+E4CC5FrPxzHImYRNxbfMIJ5vFJLx/3lQ122rs:+tRE4CC39U5RN5fzJ5NDVQ4+s
TLSH
T1FD148C257281C033E5A725318DF5C7BA5A39B8131B75A8CF6BC40ABE4F256D2D73231A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vector CANdelaPersistors.txt

Path C:\Users\Admin\AppData\Local\Temp\Vector CANdelaPersistors\Install\Vector CANdelaPersistors.txt
Size 2KB
SHA256 24b0dca0dde459934913b6d8d8cb9db08076e31c6b074aba36a28d187da2c20a
MD5 ef58f1bd6d3ba91edc33b68e5c881bdf
SHA1 2bc7d102d06ce5ff8a87078ac095e39f6730d32d
SHA512 f1bad6ca6baa2277b6118ec2249f4970733ed5ad1c2cbbcec48a1ac25ec610229d219d2c3ac67dd75f954bc07b83e65588e0110f12a8f5cc3e1bc54ab36eba03
TLSH
T19B41B3552EF90454F3F72B8BAAF380571A73FDE76C74DE0C2284831D05B6A089968366
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2812_1956352520\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x86.exe

Path C:\Windows\Temp\{4BEDFF39-EFCC-44AD-8070-CBD9658B9F2D}\.cr\vc_redist.x86.exe
Size 634KB
SHA256 c78b97480214fd42f989eb3b2da72e325e1f6855adb7d4660deeca6ca63d5025
MD5 0082d66b4bd5a3f6254dd749fe372cb6
SHA1 9c06222e24276ba02a05767eed04cacdf00e54cf
SHA512 727d329dba144ad58996f16de6c1272899fba6a4fa0fbfa7b14454d84ec250e0efe709a46249bcf486f61907aa08fd1c13aa447c7e773030dbff96c08f859f6a
SSDEEP 12288:cnMwHskY7gjcjhVIEhqgM7bWvcsi6aV67IyNMyJGP9/ztLlAZHYoyU:qMysZgjS1hqgSC/iz2fNtJGlbhlAZ4y
TLSH
T18FD49E3291614036E6F206B3B968E2307D7CE21827148DAEE3D8ED1D7EA849177F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{81FA587E-028D-43F3-86D3-EC0DA64035E2}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2616-60-0x0000000073680000-0x0000000073E3C000-memory.dmp

Download

memory/2616-289-0x0000000073680000-0x0000000073E3C000-memory.dmp

Download

memory/2616-59-0x0000000073692000-0x0000000073693000-memory.dmp

Download

memory/2616-57-0x0000000073680000-0x0000000073E3C000-memory.dmp

Download

memory/2616-56-0x0000000007870000-0x000000000790A000-memory.dmp

Download

memory/2616-55-0x0000000005470000-0x000000000547A000-memory.dmp

Download

memory/2616-54-0x0000000073680000-0x0000000073E3C000-memory.dmp

Download

memory/2616-53-0x0000000005520000-0x00000000055B2000-memory.dmp

Download

memory/2616-52-0x0000000005AE0000-0x000000000609A000-memory.dmp

Download

memory/2616-50-0x0000000000920000-0x000000000094E000-memory.dmp

Download

memory/2616-49-0x0000000073692000-0x0000000073693000-memory.dmp

Download

memory/4940-302-0x0000000000940000-0x0000000000952000-memory.dmp

Download