7289a9bf6251e784586d3144b12554ce6cf259786070f726c9bfa2773c488047

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cpolar.msi
Size 10.4MB
Sample261102-dds4cass4l
SHA256 7289a9bf6251e784586d3144b12554ce6cf259786070f726c9bfa2773c488047
MD5 ac616a995b239c36ee6008116177d9ef
SHA1 f353c6529b6b964157509f760a15b3eb67b0fca6
SHA512 dde1454bc462d9e8a17f2e589083729ef16efd677813e7c67eb1d6bd6141d326b14a806fa88254165ef47ab98d0485fe46bcd36fc797a4c8b2563c1310416cf3
SSDEEP 196608:gJdzckJ+jdlPK/vU4wHynzppANBjswr2twy+ywtcrRxQo1k5r8q1zLR8DkoZlzB:Ccoqd5K/vUBG+YwrWwiwarRx31kF8IaH
TLSH
T1E1B6337124435F33F8BA747C71D799B96C652D5C0A0C2A7621B87F0798B8A2789E3DC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
100	3656	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
1284	Cpolar守护者.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1366171493\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1246162746\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1246162746\nav_config.json	msedge.exe
File created	C:\Program Files\埃博拉酱\Cpolar守护者\Cpolar守护服务.exe	msiexec.exe
File created	C:\Program Files\埃博拉酱\Cpolar守护者\Cpolar守护者.exe	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_436946718\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1366171493\manifest.json	msedge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58caa0.msi	msiexec.exe
File created	C:\Windows\Installer\e58ca9e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ca9e.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EC56AB9A-1B4E-4E8F-9EFB-6AEB3B9FA8C1}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICBE6.tmp	msiexec.exe
File created	C:\Windows\Installer\{EC56AB9A-1B4E-4E8F-9EFB-6AEB3B9FA8C1}\Icon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{EC56AB9A-1B4E-4E8F-9EFB-6AEB3B9FA8C1}\Icon.exe	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1180	msiexec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3656	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e01e56c99d3b8eb00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e01e56c90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e01e56c9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae01e56c9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de01e56c9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\MSTTSLocesES.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{A79020BC-1F7E-4D20-AC2A-51D73012DDD5}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\AI041040"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 a 000a e 000b i 000c o 000d u 000e t 000f d 0010 p 0011 b 0012 k 0013 g 0014 ch 0015 jj 0016 f 0017 s 0018 x 0019 m 001a n 001b nj 001c l 001d ll 001e r 001f rr 0020 j 0021 w 0022 th 0023"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\r1041sr.lxa"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9BA65CEE4B1F8E4E9BFA6BEB3F98A1C	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Mark"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - es-ES Embedded DNN v11.1"	SearchApp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9BA65CEE4B1F8E4E9BFA6BEB3F98A1C\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "11.0"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - it-IT Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\tn1040.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9BA65CEE4B1F8E4E9BFA6BEB3F98A1C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Vous avez sélectionné %1 comme voix par défaut."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Italian (Italy)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{14E74C62-DC97-43B0-8F2F-581496A65D60}"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9BA65CEE4B1F8E4E9BFA6BEB3F98A1C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR fr-FR Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Paul - French (France)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\de-DE\\VoiceActivation_de-DE.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "È stata selezionata la voce predefinita %1."	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9BA65CEE4B1F8E4E9BFA6BEB3F98A1C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A9BA65CEE4B1F8E4E9BFA6BEB3F98A1C\SourceList\PackageName = "Cpolar.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR es-ES Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\es-ES\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR it-IT Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\r1040sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "DebugPlugin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SpeechUXPlugin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Discrete;Continuous"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1033"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\AI041041"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "309C 309C 30A1 30A1 30A2 30A2 30A3 30A3 30A4 30A4 30A5 30A5 30A6 30A6 30A7 30A7 30A8 30A8 30A9 30A9 30AA 30AA 30AB 30AB 30AC 30AC 30AD 30AD 30AE 30AE 30AF 30AF 30B0 30B0 30B1 30B1 30B2 30B2 30B3 30B3 30B4 30B4 30B5 30B5 30B6 30B6 30B7 30B7 30B8 30B8 30B9 30B9 30BA 30BA 30BB 30BB 30BC 30BC 30BD 30BD 30BE 30BE 30BF 30BF 30C0 30C0 30C1 30C1 30C2 30C2 30C3 30C3 30C4 30C4 30C5 30C5 30C6 30C6 30C7 30C7 30C8 30C8 30C9 30C9 30CA 30CA 30CB 30CB 30CC 30CC 30CD 30CD 30CE 30CE 30CF 30CF 30D0 30D0 30D1 30D1 30D2 30D2 30D3 30D3 30D4 30D4 30D5 30D5 30D6 30D6 30D7 30D7 30D8 30D8 30D9 30D9 30DA 30DA 30DB 30DB 30DC 30DC 30DD 30DD 30DE 30DE 30DF 30DF 30E0 30E0 30E1 30E1 30E2 30E2 30E3 30E3 30E4 30E4 30E5 30E5 30E6 30E6 30E7 30E7 30E8 30E8 30E9 30E9 30EA 30EA 30EB 30EB 30EC 30EC 30ED 30ED 30EE 30EE 30EF 30EF 30F0 30F0 30F1 30F1 30F2 30F2 30F3 30F3 30F4 30F4 30F5 30F5 30F6 30F6 30F7 30F7 30F8 30F8 30F9 30F9 30FA 30FA 30FB 30FB 30FC 30FC 30FD 30FD 30FE 30FE 0021 0021 0027 0027 002B 002B 002E 002E 003F 003F 005F 005F 007C 007C"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Mark"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Laura"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\it-IT\\VoiceActivation_HW_it-IT.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_HW_ja-JP.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Female"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\L3082"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\VoiceActivation_fr-FR.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Cosimo - Italian (Italy)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\AI041033"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\r1036sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Hortense - French (France)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "40A;C0A"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; computer=NativeSupported; address=NativeSupported; currency=NativeSupported; message=NativeSupported; url=NativeSupported; alphanumeric=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{0CFAE939-931E-4305-8D05-8C76C254EB34}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Haruka"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "I 0069 Y 0079 IX 0268 YX 0289 UU 026F U 0075 IH 026A YH 028F UH 028A E 0065 EU 00F8 EX 0258 OX 0275 OU 0264 O 006F AX 0259 EH 025B OE 0153 ER 025C UR 025E AH 028C AO 0254 AE 00E6 AEX 0250 A 0061 AOE 0276 AA 0251 Q 0252 EI 006503610069 AU 00610361028A OI 025403610069 AI 006103610069 IYX 006903610259 UYX 007903610259 EHX 025B03610259 UWX 007503610259 OWX 006F03610259 AOX 025403610259 EN 00650303 AN 00610303 ON 006F0303 OEN 01530303 P 0070 B 0062 M 006D BB 0299 PH 0278 BH 03B2 MF 0271 F 0066 V 0076 VA 028B TH 03B8 DH 00F0 T 0074 D 0064 N 006E RR 0072 DX 027E S 0073 Z 007A LSH 026C LH 026E RA 0279 L 006C SH 0283 ZH 0292 TR 0288 DR 0256 NR 0273 DXR 027D SR 0282 ZR 0290 R 027B LR 026D CT 0063 JD 025F NJ 0272 C 00E7 CJ 029D J 006A LJ 028E W 0077 K 006B G 0067 NG 014B X 0078 GH 0263 GA 0270 GL 029F QT 0071 QD 0262 QN 0274 QQ 0280 QH 03C7 RH 0281 HH 0127 HG 0295 GT 0294 H 0068 WJ 0265 PF 007003610066 TS 007403610073 CH 007403610283 JH 006403610292 JJ 006A0361006A DZ 00640361007A CC 007403610255 JC 006403610291 TSR 007403610282 WH 028D ESH 029C EZH 02A2 ET 02A1 SC 0255 ZC 0291 LT 027A SHX 0267 HZ 0266 PCK 0298 TCK 01C0 NCK 0021 CCK 01C2 LCK 01C1 BIM 0253 DIM 0257 QIM 029B GIM 0260 JIM 0284 S1 02C8 S2 02CC . 002E _\| 007C _\|\| 2016 lng 02D0 hlg 02D1 xsh 02D8 _^ 203F _! 0001 _& 0002 _, 0003 _s 0004 _. 2198 _? 2197 T5 030B T4 0301 T3 0304 T2 0300 T1 030F T- 2193 T+ 2191 vls 030A vcd 032C bvd 0324 cvd 0330 asp 02B0 mrd 0339 lrd 031C adv 031F ret 0331 cen 0308 mcn 033D syl 0329 nsy 032F rho 02DE lla 033C lab 02B7 pal 02B2 vel 02E0 phr 02E4 vph 0334 rai 031D low 031E atr 0318 rtr 0319 den 032A api 033A lam 033B nas 0303 nsr 207F lar 02E1 nar 031A ejc 02BC + 0361 bva 02B1 G2 0261 rte 0320 vsl 0325 NCK3 0297 NCK2 01C3 LCK2 0296 TCK2 0287 JC2 02A5 CC2 02A8 LG 026B DZ2 02A3 TS2 02A6 JH2 02A4 CH2 02A7 SHC 0286 rhz 02B4 QOM 02A0 xst 0306 T= 2192 ERR 025D AXR 025A ZHJ 0293"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Sie haben %1 als Standardstimme ausgewählt."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\lsr3082.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Locale Handler"	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
388	msiexec.exe
388	msiexec.exe
868	powershell.exe
868	powershell.exe
868	powershell.exe
5684	msedge.exe
5684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1180	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1180	msiexec.exe
Token: SeSecurityPrivilege	388	msiexec.exe
Token: SeCreateTokenPrivilege	1180	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1180	msiexec.exe
Token: SeLockMemoryPrivilege	1180	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1180	msiexec.exe
Token: SeMachineAccountPrivilege	1180	msiexec.exe
Token: SeTcbPrivilege	1180	msiexec.exe
Token: SeSecurityPrivilege	1180	msiexec.exe
Token: SeTakeOwnershipPrivilege	1180	msiexec.exe
Token: SeLoadDriverPrivilege	1180	msiexec.exe
Token: SeSystemProfilePrivilege	1180	msiexec.exe
Token: SeSystemtimePrivilege	1180	msiexec.exe
Token: SeProfSingleProcessPrivilege	1180	msiexec.exe
Token: SeIncBasePriorityPrivilege	1180	msiexec.exe
Token: SeCreatePagefilePrivilege	1180	msiexec.exe
Token: SeCreatePermanentPrivilege	1180	msiexec.exe
Token: SeBackupPrivilege	1180	msiexec.exe
Token: SeRestorePrivilege	1180	msiexec.exe
Token: SeShutdownPrivilege	1180	msiexec.exe
Token: SeDebugPrivilege	1180	msiexec.exe
Token: SeAuditPrivilege	1180	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1180	msiexec.exe
Token: SeChangeNotifyPrivilege	1180	msiexec.exe
Token: SeRemoteShutdownPrivilege	1180	msiexec.exe
Token: SeUndockPrivilege	1180	msiexec.exe
Token: SeSyncAgentPrivilege	1180	msiexec.exe
Token: SeEnableDelegationPrivilege	1180	msiexec.exe
Token: SeManageVolumePrivilege	1180	msiexec.exe
Token: SeImpersonatePrivilege	1180	msiexec.exe
Token: SeCreateGlobalPrivilege	1180	msiexec.exe
Token: SeBackupPrivilege	4620	vssvc.exe
Token: SeRestorePrivilege	4620	vssvc.exe
Token: SeAuditPrivilege	4620	vssvc.exe
Token: SeBackupPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeBackupPrivilege	3304	srtasks.exe
Token: SeRestorePrivilege	3304	srtasks.exe
Token: SeSecurityPrivilege	3304	srtasks.exe
Token: SeTakeOwnershipPrivilege	3304	srtasks.exe
Token: SeBackupPrivilege	3304	srtasks.exe
Token: SeRestorePrivilege	3304	srtasks.exe
Token: SeSecurityPrivilege	3304	srtasks.exe
Token: SeTakeOwnershipPrivilege	3304	srtasks.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
1180	msiexec.exe
1180	msiexec.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5432	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 3304	388	msiexec.exe	96
PID 388 wrote to memory of 868	388	msiexec.exe	98
PID 868 wrote to memory of 1284	868	powershell.exe	102
PID 1284 wrote to memory of 5096	1284	Cpolar守护者.exe	103
PID 5096 wrote to memory of 1644	5096	msedge.exe	104
PID 5096 wrote to memory of 3656	5096	msedge.exe	105
PID 5096 wrote to memory of 3264	5096	msedge.exe	106
PID 5096 wrote to memory of 3264	5096	msedge.exe	106
PID 5096 wrote to memory of 3264	5096	msedge.exe	106
PID 5096 wrote to memory of 2452	5096	msedge.exe	108
PID 5096 wrote to memory of 2452	5096	msedge.exe	108
PID 5096 wrote to memory of 3112	5096	msedge.exe	116
PID 5096 wrote to memory of 3112	5096	msedge.exe	116
PID 5096 wrote to memory of 3112	5096	msedge.exe	116
PID 5096 wrote to memory of 3936	5096	msedge.exe	110
PID 5096 wrote to memory of 3936	5096	msedge.exe	110
PID 5096 wrote to memory of 3936	5096	msedge.exe	110
PID 5096 wrote to memory of 4504	5096	msedge.exe	111
PID 5096 wrote to memory of 4860	5096	msedge.exe	112
PID 5096 wrote to memory of 4504	5096	msedge.exe	111
PID 5096 wrote to memory of 4504	5096	msedge.exe	111
PID 5096 wrote to memory of 4860	5096	msedge.exe	112
PID 5096 wrote to memory of 4860	5096	msedge.exe	112
PID 5096 wrote to memory of 4756	5096	msedge.exe	115
PID 5096 wrote to memory of 4756	5096	msedge.exe	115
PID 5096 wrote to memory of 3112	5096	msedge.exe	116
PID 5096 wrote to memory of 3112	5096	msedge.exe	116
PID 5096 wrote to memory of 2620	5096	msedge.exe	117
PID 5096 wrote to memory of 4260	5096	msedge.exe	118
PID 5096 wrote to memory of 2620	5096	msedge.exe	117
PID 5096 wrote to memory of 4260	5096	msedge.exe	118
PID 5096 wrote to memory of 3756	5096	msedge.exe	120
PID 5096 wrote to memory of 100	5096	msedge.exe	121
PID 5096 wrote to memory of 100	5096	msedge.exe	121
PID 5096 wrote to memory of 100	5096	msedge.exe	121
PID 5096 wrote to memory of 5160	5096	msedge.exe	122
PID 5096 wrote to memory of 5160	5096	msedge.exe	122
PID 5096 wrote to memory of 5268	5096	msedge.exe	123
PID 5096 wrote to memory of 5268	5096	msedge.exe	123
PID 5096 wrote to memory of 5436	5096	msedge.exe	124
PID 5096 wrote to memory of 5436	5096	msedge.exe	124
PID 5096 wrote to memory of 5476	5096	msedge.exe	125
PID 5096 wrote to memory of 5476	5096	msedge.exe	125
PID 5096 wrote to memory of 6000	5096	msedge.exe	126
PID 5096 wrote to memory of 6000	5096	msedge.exe	126
PID 5096 wrote to memory of 5816	5096	msedge.exe	127
PID 5096 wrote to memory of 5820	5096	msedge.exe	128
PID 5096 wrote to memory of 5816	5096	msedge.exe	127
PID 5096 wrote to memory of 5816	5096	msedge.exe	127
PID 5096 wrote to memory of 5820	5096	msedge.exe	128
PID 5096 wrote to memory of 5180	5096	msedge.exe	130
PID 5096 wrote to memory of 1548	5096	msedge.exe	137
PID 5096 wrote to memory of 3992	5096	msedge.exe	138
PID 5096 wrote to memory of 1724	5096	msedge.exe	139
PID 5096 wrote to memory of 3080	5096	msedge.exe	140
PID 5096 wrote to memory of 3080	5096	msedge.exe	140
PID 5096 wrote to memory of 2208	5096	msedge.exe	142
PID 5096 wrote to memory of 2208	5096	msedge.exe	142
PID 5096 wrote to memory of 4664	5096	msedge.exe	143
PID 5096 wrote to memory of 4664	5096	msedge.exe	143
PID 5096 wrote to memory of 5332	5096	msedge.exe	144
PID 5096 wrote to memory of 5332	5096	msedge.exe	144
PID 5096 wrote to memory of 1432	5096	msedge.exe	145
PID 5096 wrote to memory of 1432	5096	msedge.exe	145

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Cpolar.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1180

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell .\Cpolar守护者.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Program Files\埃博拉酱\Cpolar守护者\Cpolar守护者.exe
    "C:\Program Files\埃博拉酱\Cpolar守护者\Cpolar守护者.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0-rc.2.24473.5&arch=x64&rid=win-x64&os=win10&gui=true
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffbe602c188,0x7ffbe602c194,0x7ffbe602c1a0
        5⤵
        
        PID:1644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,3595067002940057912,12896263638560870544,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
        5⤵
        Downloads MZ/PE file
        System Time Discovery
        
        PID:3656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,17461781688474570006,14743712741463273396,262144 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
        5⤵
        
        PID:3264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,4104100629739901220,9637311097562521515,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
        5⤵
        
        PID:2452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,6087832432483845516,9160083305796443413,2097152 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
        5⤵
        
        PID:3112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,7494880961103695403,1013622032738648275,2097152 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        5⤵
        
        PID:3936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,16854540294227878091,9800218838771129003,2097152 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
        5⤵
        
        PID:4504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,5372698198766900416,18251204322268514537,2097152 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
        5⤵
        
        PID:4860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,3154453907406090843,11876599177830188620,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
        5⤵
        
        PID:4756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,16782043842202430993,14317816778471147476,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
        5⤵
        
        PID:3112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,10795085746647458490,10591438616203847686,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
        5⤵
        
        PID:2620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,16508551747050110437,6426982897602645533,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
        5⤵
        
        PID:4260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,13129140152560403102,8228665044963086262,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
        5⤵
        
        PID:2096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,13129140152560403102,8228665044963086262,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
        5⤵
        
        PID:3756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5948,i,13860591016288898625,6756652640270441366,2097152 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
        5⤵
        
        PID:100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,11772159707554405550,364130070249349397,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
        5⤵
        
        PID:5160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,214652944341009005,17841132724205696448,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
        5⤵
        
        PID:5268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,11117390801110839560,1654576369560931173,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
        5⤵
        
        PID:5436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,3263358573130926561,15592362135883796904,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
        5⤵
        
        PID:5476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,16731162041033925414,9328476157025888757,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
        5⤵
        
        PID:6000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6252,i,9721138815890275225,5825454710859878719,2097152 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
        5⤵
        
        PID:5816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,2977906360887890342,12333641478421888673,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
        5⤵
        
        PID:5820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,7553983488170225765,16811703078895593407,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:8
        5⤵
        
        PID:5180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,9908744031354421438,11042774247738217862,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
        5⤵
        
        PID:1548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,1288042165328599741,13913605111176455725,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
        5⤵
        
        PID:3992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,10227589915864152860,4556795116298548418,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
        5⤵
        
        PID:1724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,5149137148799513009,9499453566850251102,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
        5⤵
        
        PID:3080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,1254826453683678726,3111359334343401282,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
        5⤵
        
        PID:2208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,2302741688128738422,11719967164666451212,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
        5⤵
        
        PID:4664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,11263281805761376327,13174275491492943041,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
        5⤵
        
        PID:5332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=876,i,1855582803528686985,9245514838294336767,524288 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
        5⤵
        
        PID:1432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5276,i,11100013851288444921,11236376525563179057,262144 --field-trial-handle=2220,i,13163514914991637192,5769232681565735576,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5684

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4272

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\858727693cad429d818fecb734a5e12b /t 3912 /p 3860
1⤵
PID:5312

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58ca9f.rbs

Path C:\Config.Msi\e58ca9f.rbs
Size 7KB
SHA256 57d9a219af818ce21e1d6143a77f2be478f267c751df3c36984398bfc7e35f98
MD5 1837ab88294a043ef3984f2eb7b8ca3e
SHA1 2cdc7e75b9fe4c1e7b809bf0913cf47239d90fdc
SHA512 e3767baca17699aa29e077b9437a73f88c892ad54d6ea9471ea89e160dfaad74e87264b82030833d1df1ca1f597593070210617793bf98f1a787a7a67a441a86
SSDEEP 96:VmbUESlKlCxdsFae6BRB+aUDTu3wLCOTl+9UDTu3wLCgjAJBLBlqpTl+E8Wd5BmZ:4wA2YaedtF2GZF2af/uBWp2
TLSH
T12DF12290B30143F3FA661BB4CB471B2577B7E2959720635F0A9C90244F6338D5F9978A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1246162746\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5096_1366171493\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

Cpolar守护者.exe

Path C:\Program Files\埃博拉酱\Cpolar守护者\Cpolar守护者.exe
Size 25.7MB
SHA256 04bbb7ebcba269a85aae0355d3e64b2b5c6ffcb28977e8b6b18914efcbfab14f
MD5 be5e7d80d107b50e5f8cd98bf4efc7af
SHA1 3eaefa4b3c23ed556b82d163faefa622f865adc4
SHA512 a76a43cdef9a777db6472dadaeffea28d49644e69de20557a4359abcbd163a792407c49d3b69c59f33b911adb6dba2d3f9ea10cc6f80151ff518c43c50cf3f5e
SSDEEP 196608:XRNmJEJERp1il+j60hBCxJ/EwrD3kJsPLbuQnnblJsiZ0f:vERpAEw/3kJILiQnnbci6f
TLSH
T1BE476B0227748D2AE82F637BE46107534739E285EF6BB3AA248CD1F04C737583A555FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cpolar守护者.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cpolar守护者.lnk
Size 2KB
SHA256 8e834d388548e2fced6c5340b75a20bf956ba14acd6488eaaf439c9e0d6eb7d0
MD5 fff435d7da73cde50b5d9e42c1917809
SHA1 2ac323e1549c2e8d4e639db780696972d71dac08
SHA512 1faaa3774300e46b46bce05fe1acf6aa202177fab70dcf9d412133ca322a97c7306906a2222cc315434c952dd04897190fd1b694532f6f0d8e31ff451da0e03e
TLSH
T13351A0546EF01ABAE3999BF25FE2DA31F635FC20A9009F37524251801762144E167F3F
MD5 SHA1 SHA512 TLSH

Submit Download

1c2c5bec-2a8f-4575-ba5a-6a5311a90cc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c2c5bec-2a8f-4575-ba5a-6a5311a90cc6.tmp
Size 28KB
SHA256 b4ee654e78ea32a85fd23c981983631bf9d9e8ff92d2e9e63bee9312fa47f31b
MD5 9a92dd2de35c066d33de9b79ee605efe
SHA1 2eba1556b0cb3fb94901a1633db2eb4c3199bb1d
SHA512 cd4ab6ba2772d70c4ffc6e6e8e4189e73df77ca67e7ec578ff87a67bb3b64a1cee4138efb4ccccd0d5f1a8d013618d0b5b36caeda4dbaf15e216dc75272c1851
SSDEEP 384:nOiFzQkUSvXzsNN8TUNTUlIlHLYD1dzCOhDfwfIGmFAk9wX+HiJH7vBErfIIlB:lFdDUwgRYDC1fCTA+HiJH75ErfLn
TLSH
T151D281F598E79936E9AE5743A37D2E429EBCD153B4885980FB884D0CCC861BFD20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a47cafe-8b70-4264-b982-db5a5c49d262.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3a47cafe-8b70-4264-b982-db5a5c49d262.tmp
Size 18KB
SHA256 efc510e633ecb11c0cdbaee13e558fa002781ced719ee93ba437fbc87d9b1ed8
MD5 85af2e5d313d571a39825e656936dd33
SHA1 18eda996f456b72b6147f3f1580b6cdf384e1141
SHA512 091bb911d564ebbd16a08a5f2f807b95443f26645ac1aca84e3565ea1a5c5eb34f73ba5b8b6a6cca13d24c31ee49d7401ade5bebbadb241b687a0efb635a6424
SSDEEP 384:nrQkUSv0sNzHLYD1dMOzIGmFAk9wXziJH7vBErfIIlB:l0GYDoYCTAziJH75ErfLn
TLSH
T18C826C75A87ABC375BF3A514F18A3B13AE746067D9D41F80E9D98B1C00CB28C370BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cb137bb-9f4a-4c3c-94d6-cd6e89949b9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6cb137bb-9f4a-4c3c-94d6-cd6e89949b9a.tmp
Size 8KB
SHA256 5db2276aa8d992456003688d2248c03b8ae5673327c5ef5478ca52233d6ab166
MD5 503283e31f4fe64697a1bb6f0c40d47c
SHA1 d72507a5cac38f654a4a9714955793a4fd60feae
SHA512 e9444e5bfb0322a09648901e13bf1a55ece7e65ecc08fcb65566c21ac0794e4d6fd5c098e4a06b2442f3861dbc631d86ec6062b9065f28fd6d5fb6e1b250f64f
SSDEEP 96:3qONkgQsjpfe/tyng7X5ih/cIPURHl8h4otop5MYDWNBnP9ZvEI0IG2jbg00Lx69:aONI6IE7QmiUytWTPuIGmF0LVC7sibU6
TLSH
T16B02E939AC7C7C7B9EF3AD48F4872B236EA5112BA5952F84D9E81B1D00D725C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

895af433-416e-4097-b07b-5c86bb14b810.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\895af433-416e-4097-b07b-5c86bb14b810.tmp
Size 18KB
SHA256 3c20f297a0a8ceb89bf957cadc74dfeb5c27cfe1bf6e5877c8e52e506f8e8a4a
MD5 1d5a9cb095600f4ecea6eb44291ecd84
SHA1 443d93b6db5fa02f75c3ca6ff78261a475356d44
SHA512 bb9c08937158e8449efc7e7eb3b0937ca0d018b0027ab94a99ce48a693393472866969c7747cfc96e77eae2fb64df658e3325f0382828d23582ffb99c43daf46
SSDEEP 384:niQkUSv0sNz2LYD1dMOzIGmFAk9wXziJH7vBErfIIlB:a0tYDoYCTAziJH75ErfLn
TLSH
T1E7826C75A87ABC375BF3A514F18A3B13AE746167D9D41F80E9D98B1C00CB28C270BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9eab8e46-9dea-4c5f-8741-4647b21a2fac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9eab8e46-9dea-4c5f-8741-4647b21a2fac.tmp
Size 8KB
SHA256 2953b296dc859874d5edee6940b8b0c876edcc549875acd981066682265b12f2
MD5 8d3707f0944a1e5e16c457a41e4ed438
SHA1 bf74e67a5d58f3ce81aeac002b943e736e5a94b9
SHA512 362fcf7253125960a9e7b4fb6616c51f342af151f69c05d77f7c26ecd683d3f3917de89433963fef21d8f3f33f629662c76d98c72c494e7028d99f3fd9a8e2c6
SSDEEP 192:XONAV6IEkQmiUy7WTquIGmF0Lk90FXa27HLqIBU6:XONO6D0/quIGmFAk9wXjHJU6
TLSH
T16412F935A879BC275EE3B444F4C33B239EA91177D9846F44E6D84B0C00DB35C274A966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33370ada-3b87-4a4e-b8e8-77d7a3e4fa6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\33370ada-3b87-4a4e-b8e8-77d7a3e4fa6a.tmp
Size 105KB
SHA256 aa204e7f585c1f2b64ec2dfe226fcda3dd40e2d6c7acaecb8bc39c51bf5021a2
MD5 82ef5ef3fd97f3d79a47f09529d45307
SHA1 4d70248d33884063e95777b4e6e0d998931440a1
SHA512 a3e3e08187ec16facc64907edae849970f4fffaceb0ff69b6b9421c352de4ae4396f6c7d28c814160c616bf604747c73d4cf8a04f10f2fc8fa4a07c14210288d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1F8B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4945E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

389d3f38-7e8e-43b2-95f9-c35c9ed05de7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\389d3f38-7e8e-43b2-95f9-c35c9ed05de7.tmp
Size 11KB
SHA256 0b4e892dbbd68a4c4281c322e3ddf2dd2569be5916827d139c9e0924ec9b13ad
MD5 34658f8fe460a994cd0a30d1c328ba40
SHA1 903194588e19eba220bf310631af5baf6e62a532
SHA512 2d3c48ef6527b7ea617ebf28f353d9f173ecac5524945d2343fd54061cb50bdb54a8e5c74a1e4b22492eb1faa572c3eb3aafa1381289a579b20d795e2f1b4e0a
SSDEEP 192:sxZlRL6Vv/fcsrVUlAcjIdpwEHW6+WNrnk/APapCRrRIg5AJ:sxZlgv/fcsrVYAXhHbA/S+
TLSH
T11632D856AE34A97B9CC7D219FA257F13D6F9103294D11E48A7FC861C14E6ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

420c33ff-eb37-45f6-b712-9df67de914e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\420c33ff-eb37-45f6-b712-9df67de914e9.tmp
Size 11KB
SHA256 736b2473d2d23ae5ce47cd9f0d766c91a914f1979b0570c0fed412afd7f03ae2
MD5 3f936b0c52f16364b029864d50609721
SHA1 34bc78e008f86ca18205c86c545ce0e5144c00aa
SHA512 271369f5e81664cf58134cdaafbcaa765d81571318f465383006c73469095a2b5b8f8ca68151284a2ea3d616f1519a26b4db5341538ae2ed88f704257d7a9acf
SSDEEP 192:sxZlRL6Vv/fcshVUlAcjIdpwEHW6+WNrnk/APapnXrRIg5mJ:sxZlgv/fcshVYAXhHbA/zY
TLSH
T11932E856AE34A97B9CC7E219FA157F13E7F9103294811E48A7FCCA1C14E6BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f46c035-f903-4c19-b088-e29f622e1ac5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f46c035-f903-4c19-b088-e29f622e1ac5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 deeea0ce21333cf22fda17be27f0667072758eb8f3688d7ffbac2aad74b2b83a
MD5 a65bf89fca0e35b37b4164d0ee665787
SHA1 93b9143bd3db728ca48ade5d73c3c77118bf33ca
SHA512 469348cb697ac9d1d866f244a94d6b55c57e4139bb740317d50047df4475cf68356d35cf432c21dfeade9703f42ac6a8c8db244ef6d4357dd3fec134fa4d2915
TLSH
T19D51548055A26370FFA4E8BE9EE4136F3B38D441D3C76E5A0896DC7CBBDA39D5105804
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 623fc2bfb9c73fd70d975c0bae6d4fe21cfe9e36ce7c8c4acf3821f6bd72e93f
MD5 82bdaf9a2551c50bb2bb452143f46384
SHA1 265c569f6fd543e0ac869fb5cab8c8f912f160ca
SHA512 2a8cc8a5ae94420862c116c8244220d5ebeb7f867fa71cf0a82ed6f50fa1fb30c2f324d6e3e6d385c9745cd8b3ced576338e29559d22faf526d5b1a29317797a
TLSH
T18151438056925370FF64F87D99E5136F3B38D481D7CB6E5A08A5DCBC7BCA39E9106044
MD5 SHA1 SHA512 TLSH

Submit Download

4f6183d4-f9e0-46a2-901a-0f91e11ac9e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4f6183d4-f9e0-46a2-901a-0f91e11ac9e6.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

31b2d28d-2a59-42b9-a561-1b6488e4e0c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\31b2d28d-2a59-42b9-a561-1b6488e4e0c6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c96b18a5-c4a8-4ef4-a226-7844ef7e5929.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c96b18a5-c4a8-4ef4-a226-7844ef7e5929.tmp
Size 3KB
SHA256 c7bd5ca883ca3c0c0c6445977d7e307a92ba3647d6b49844fd81856f136536cd
MD5 55f56e2f0812855e111e35d001905f9a
SHA1 e8ac065fec8cd7166068dacf47415fccd32cc48b
SHA512 f5348bb8ac8dc32f49a29e37fa4e6ea2d92b191f1b0214cc442175f84c6ae38366e6e0392deea125d35b893926246527988a96541e2f850a57abc71000f29021
TLSH
T1DC619DF787B4856E8A0196F09A18EE2FDF2C0615431C7D6A89D4EE27D3F3472E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

e50e4029-798a-418e-8fed-b56c710f989b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e50e4029-798a-418e-8fed-b56c710f989b.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d46608a9b0e92bd5a72429744db58e0728c0759a024c5c8140e9f7365c38fd57
MD5 27f771129857048f4fb426e918de1280
SHA1 e435b11f77bc48cf369e04b74a41e297df4c77cf
SHA512 3c72f5f050c774ed363337e94d8cf6e9c4044309038f74b04fc40b2fb111713207f575f062ac09204361156adcde70d0ad190c35b0d0a7cbc0d79e2431fff3f9
SSDEEP 48:KMIIbKZa0fyFPIlKoEYLk/YU+aWkmahPIhMkKAB42k800PB+05yj5+9pb3jkz3Q+:KMIAKZa+2PSKoEjt+K+AqK6W
TLSH
T1BCA1CF1132BA024238BE691981B58B2E525135B3751AF62F3FFD44A64E6BF184CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3068fd1-6343-4684-9c7b-1f0c53dcf93a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3068fd1-6343-4684-9c7b-1f0c53dcf93a.tmp
Size 10KB
SHA256 59e46ef8df38439a0387ca6dccc3c1d218077aec30c8af4af6f298d3cdae0cb9
MD5 4feaece7ce2e248500263c316aa582a6
SHA1 f250e3a2f7b37f5fc4cf0f7b21bf7c615db3c871
SHA512 1d5db4f2eb06f80003e19e31394a1ca5b50e41ef1ce843b7f19074d779da044ad9d81fa15bd185b3d263e595217dcc89958e7ab1daea650a452e45793d8bdc90
SSDEEP 192:sxZlRL6Vv/fcsJVUlAcjIdpwEHW6+WNrnk/APapCRrRIg4J:sxZlgv/fcsJVYAXhHbA/Sc
TLSH
T15B32C8566E34A97B9CC7D21DFA25BF13E6F9103294D11E48EBFC861C14E6ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c507d6f2-5c4d-4ef4-81a3-dc37e5f42549.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c507d6f2-5c4d-4ef4-81a3-dc37e5f42549.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f72bee24-d09d-4ebf-a137-5844f9ae79ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f72bee24-d09d-4ebf-a137-5844f9ae79ce.tmp
Size 32KB
SHA256 2958b235635f84badeb810c9282227007220b95cc8ab3ed5b7af77ef0e35239b
MD5 a3253decc0859a1ede8d9624ba58974f
SHA1 5b417c6f2f52f619ee7d6c621a5e235427e5c76b
SHA512 a66711a1353f54f7364603331c80d18f0291092e650e4f31962ccc36753767aa2c8d88e1bbed36e4eaa54f8235cca97b792162900ce73f1570958ae72ecc4b50
SSDEEP 768:JfWPcNu7pLuLjWKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYuHlLlACy7Lroh:JfWPcNuEjWKWvKeEeu1japuHlLiF744K
TLSH
T124E2EB7B680CCB7E4FC01A9DDD1A7F9F6EA8028B9A98CD4047FD945C02C67EA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0633178-c670-4519-935d-679cc23609ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e0633178-c670-4519-935d-679cc23609ba.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

2c63d1a3-546e-4d1e-96ba-7b2502f6c116.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2c63d1a3-546e-4d1e-96ba-7b2502f6c116.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e870d2de-3cd9-4460-978f-9533b305e8fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e870d2de-3cd9-4460-978f-9533b305e8fe.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

ed96db2e-894d-4571-b2e6-7eecbb2f74f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ed96db2e-894d-4571-b2e6-7eecbb2f74f0.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

3cf5de7b-b037-41b9-adbc-5d01e86e2cae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3cf5de7b-b037-41b9-adbc-5d01e86e2cae.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e380cebc1c98f8143b890f1375abff56cba2d43f9a2076e4bd5f0c3925d20b7b
MD5 e8d35ff2580b7ece28013a52752029cb
SHA1 a0cbcd3d5034ae8a3898815d9611b30fd113ba76
SHA512 6528af3aa2150174ad5b88b760be0762af6690daf07f61142f620ed20f65539793b4c794488a45db5027e387bf4e9c06b193b015455e25fc98cc99c0a339cc7c
TLSH
T1B2412859B6EA1108B3B77E5A9BF7A86D483E7C772E0A945D00010D4E4A27B40CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download

microsoft.windows[1].xml

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\C5KK0GV1\microsoft.windows[1].xml
Size 97B
SHA256 cb464987d444e646b09d9fdbe0fb8738131ca07c5b50a3ecad47374257deeefc
MD5 b0a7cad5d04062c0e024d66bd07df1eb
SHA1 5fe1139ef3596d053549f155967db48afb690d31
SHA512 6c572fd65619fbb677309c2cd8161ddb35d72709c41029ea01b06eeea07d5112ec4fb9aa5ef304dfc1dc884cb4ab1cb8c849ed7470fc812de73dfd55869e1dae
TLSH
T178B0925135489C180A5946A52D4A50E031AA008A920678B524E4BC02B995906C0168A6
MD5 SHA1 SHA512 TLSH

Submit Download

AppCache134380616824735356.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134380616824735356.txt
Size 87KB
SHA256 eb97df9b2d7914e9c5b14e88ca3f8575a8d4c427fd54568aabb5d38bb6c6f557
MD5 f6e598e02b16d6834db076ab6eb339f9
SHA1 4bccf3840bdca5e7752f9a64aa5c2f2100a2f9c0
SHA512 60d3240aeeb63753b5e87f6088f664532962eb880ac517dffddc2967ad596ef9752eb6208dc5d09bf707b5837c1cae0f519b1c5d4da8a55377df5737d6b7d4a7
SSDEEP 384:i/v8/n5U/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/er/iw:vYGzozuyXoPR21k
TLSH
T13B93B3A53281CBF3317966A0BCD9E435E13926B1E0A88F4461FA9617FC5ADDC62313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45e3a973-8939-43d6-9971-e860ce2c71ec.tmp

Path C:\Users\Admin\AppData\Local\Temp\45e3a973-8939-43d6-9971-e860ce2c71ec.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5af01c4b-4d40-44f4-b7ed-c7bbca7579e9.tmp

Path C:\Users\Admin\AppData\Local\Temp\5af01c4b-4d40-44f4-b7ed-c7bbca7579e9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_srpmy501.epd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_srpmy501.epd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5096_114422738\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9a0fa5a-a9c1-45b4-a886-4c768b22ce9b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5096_114422738\e9a0fa5a-a9c1-45b4-a886-4c768b22ce9b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5096_1584470740\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

094dd1b7-1067-471e-91a2-b217d2098360.tmp

Path C:\Users\Admin\Downloads\094dd1b7-1067-471e-91a2-b217d2098360.tmp
Size 15KB
SHA256 9c94544ab9f8872b74da6d857d2d965b768d57f246e5742074ed6fdf1017aaf3
MD5 61b0f84c34fbff35cd97943721683728
SHA1 f2bfba03df33a5405ed74676b746b1f063c47888
SHA512 c473c6e63667eb0f80e5cca7fc61bf44412c0a98c90415875986cea1e8c0e6899460c6b91eb84c3534f3c14382b847273d0f7f6d89114eca4c7fbd225dd8eda8
SSDEEP 384:sLDULILL7EounBaU3VttkZB2hyHIUFfTFYq2Qd1bLYH/:FMX7EounBj3VwZTFPb0f
TLSH
T14062F622B98995FBDBD20331CF2D393573A8823D0069C59B93586D4176E28438B7FB97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58caa0.msi

Path C:\Windows\Installer\e58caa0.msi
Size 10.4MB
SHA256 7289a9bf6251e784586d3144b12554ce6cf259786070f726c9bfa2773c488047
MD5 ac616a995b239c36ee6008116177d9ef
SHA1 f353c6529b6b964157509f760a15b3eb67b0fca6
SHA512 dde1454bc462d9e8a17f2e589083729ef16efd677813e7c67eb1d6bd6141d326b14a806fa88254165ef47ab98d0485fe46bcd36fc797a4c8b2563c1310416cf3
SSDEEP 196608:gJdzckJ+jdlPK/vU4wHynzppANBjswr2twy+ywtcrRxQo1k5r8q1zLR8DkoZlzB:Ccoqd5K/vUBG+YwrWwiwarRx31kF8IaH
TLSH
T1E1B6337124435F33F8BA747C71D799B96C652D5C0A0C2A7621B87F0798B8A2789E3DC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 5fc76efacccaefc9d57fe320daf3a5b88c2bb21a774faadcf6009e6fb60e9e96
MD5 88cfdf50983dbc8dccbf42a12efbef54
SHA1 d8ab90e639a9c166c157c77c0ec6cce7e620ab53
SHA512 4f951d809de00ff9759632e8f22d9d8b0bc0e6b2cd7c546502bd6c0b6e4639dbeeb9a22c371acdc4ee81c83de130ec93789db5fac690a2201699c4ef1e1d06ef
SSDEEP 24576:6u8m+1z8doO/vvTLb2t+oGqZc0UjVVdSBLGtPic1l0asOqEgIP1UlbGRI:9
TLSH
T1E047A3243AF92110E7B79E3C6CF0AA234D3A7D5B9C199E8D45411F4E0921FB0E972F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6d520085-a273-4bef-813a-652733e08798}_OnDiskSnapshotProp

Path \??\Volume{c9561ee0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6d520085-a273-4bef-813a-652733e08798}_OnDiskSnapshotProp
Size 6KB
SHA256 229fdef8d722bbe53bdc5f4f7354bd229222f0f422170eb22cd71ff3cc982e2a
MD5 56c0f65450e4e580ca58f74a04b22cbd
SHA1 287a1d3f87e3cb3da8d64329f517e2415d00f1a9
SHA512 52ca708ed809d824e9bc8b0dd2d144ddad64c27d732a7afa03ca73d0ea6278a37ecb2f37285129df7f397d55e889f54eb41aad96cf6e8a6d865b7e77ef4e69d8
SSDEEP 96:FAmhSgI5vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:CmhS1b++ZVmN
TLSH
T112D189085AF54311E2B3AB3229F18557A477B911EF33CB8E0298238E2671A10F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/868-35-0x0000029ADD020000-0x0000029ADD23C000-memory.dmp

Download

memory/868-30-0x0000029ADCE80000-0x0000029ADCEA2000-memory.dmp

Download

memory/5432-612-0x000002A2B5C70000-0x000002A2B5C90000-memory.dmp

Download

memory/5432-599-0x000002A2B5CB0000-0x000002A2B5CD0000-memory.dmp

Download

memory/5432-595-0x000002A2B4B00000-0x000002A2B4C00000-memory.dmp

Download

memory/5432-630-0x000002A2B6080000-0x000002A2B60A0000-memory.dmp

Download