bumblebee | b1bae0bca6cef482524586746abfda822829edad434a164cf764eb34c15736a6

Analysis

max time kernel
128s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2023 08:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cisco-anyconnect-4_9_0195.msi
Size

4.2MB
MD5

72f7a880209c875d48c153b5b8db71f9
SHA1

f861232236ddcd2df75dfe77c7ba5342b84bf777
SHA256

b1bae0bca6cef482524586746abfda822829edad434a164cf764eb34c15736a6
SHA512

fe9c4f18ac24f89aac02dcc372a65c9d611c3d4755fdd060ae50d79228192b788fca61aef6776b0aa4576d5f124de77ec2b7a790bd2d87099ac357e165ddaac9
SSDEEP

98304:PPKnw39kiUnMUYeg8F1HWMUKFln1EJCl1ZPYzrkFE:6wNJUnMUYetUKFZ+CFPY0F

Score

10^/10

bumblebee cis21503 persistence trojan

Malware Config

Extracted

Family

bumblebee

rc4.plain

Extracted

Family

bumblebee

Botnet

cis21503

194.135.33.90:443

45.66.248.64:443

107.189.1.219:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
41	984	powershell.exe
63	984	powershell.exe
86	984	powershell.exe
87	984	powershell.exe
96	984	powershell.exe
97	984	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET3CBB.tmp	VACon64.exe
File created	C:\Windows\system32\DRIVERS\SET3CBB.tmp	VACon64.exe
File opened for modification	C:\Windows\system32\DRIVERS\acsock64.sys	VACon64.exe

Executes dropped EXE 7 IoCs

pid	Process
4828	CiscoSetup.exe
1088	InstallHelper.exe
3504	InstallHelper.exe
3592	InstallHelper.exe
3848	InstallHelper.exe
4544	InstallHelper.exe
4012	VACon64.exe

Loads dropped DLL 32 IoCs

pid	Process
4828	CiscoSetup.exe
4224	MsiExec.exe
4224	MsiExec.exe
1836	MsiExec.exe
1836	MsiExec.exe
1836	MsiExec.exe
1088	InstallHelper.exe
1088	InstallHelper.exe
1088	InstallHelper.exe
1088	InstallHelper.exe
1088	InstallHelper.exe
3504	InstallHelper.exe
3504	InstallHelper.exe
3504	InstallHelper.exe
3504	InstallHelper.exe
3592	InstallHelper.exe
3592	InstallHelper.exe
3592	InstallHelper.exe
3592	InstallHelper.exe
3848	InstallHelper.exe
3848	InstallHelper.exe
3848	InstallHelper.exe
3848	InstallHelper.exe
4544	InstallHelper.exe
4544	InstallHelper.exe
4544	InstallHelper.exe
4544	InstallHelper.exe
4520	MsiExec.exe
4520	MsiExec.exe
4520	MsiExec.exe
4520	MsiExec.exe
4520	MsiExec.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	VACon64.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cisco AnyConnect Secure Mobility Agent for Windows = "\"C:\\Program Files (x86)\\Cisco\\Cisco AnyConnect Secure Mobility Client\\vpnui.exe\" -minimized"	msiexec.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vpnevents.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vpncategories.dll	msiexec.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
984	powershell.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\transition_3.ico	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\vpn_connected.ico	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\toolbar_about.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\Uninstall.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\OpenSource.html	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\app_logo.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\toolbar_prefs_hover.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acsock64.cat	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\ManifestTool.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\mftogglebtn.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\status_ico_trusted.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\transition_1.ico	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\Plugins\actoast.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acsock64.cat	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\status_ico_transition.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\transition_2.ico	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\GUI.ico	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\ManifestTool.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\ac_sock_fltr_api.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\about_hover.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\neutral.ico	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\toolbar_prefs.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper64.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\error.ico	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acciscocrypto.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagentutilities.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\company_logo.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\status_ico_attention.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\status_ico_error.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpndownloader.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpncli.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\cues_bg.jpg	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\ac_sock_fltr_api.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acsock64.inf	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\toolbar_help_hover.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\toolbar_about_hover.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\toast_nam.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnapi.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\about.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\toolbar.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\company_logo_alt.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acciscossl.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnva-6.inf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acsock64.sys	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\VACon64.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\mftogglebtn-down.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\mftogglebtn-down-solid.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\Plugins\acfeedback.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\toolbar_help.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\toast_vpn.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acciscossl.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\Uninstall.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\attention.ico	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\vpn_logo.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpncommon.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpncommoncrypt.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acsock64.sys	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\status_ico_good.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper64.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acciscocrypto.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI3105.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3135.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC8C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e56cb28.msi	msiexec.exe
File created	C:\Windows\Installer\e56cb25.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CBE.tmp	msiexec.exe
File created	C:\Windows\Installer\e56cb28.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C706092D-491F-4D29-BB49-FF7B47CD12F2}	msiexec.exe
File opened for modification	C:\Windows\Installer\e56cb25.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D960-4AF4-BB8A-BE91FA942756}	msiexec.exe
File created	C:\Windows\Installer\e56cb27.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3164.tmp	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f9d6c693febb2fce0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f9d6c6930000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900f9d6c693000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f9d6c69300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f9d6c69300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CC679CB8-DC4B-458B-B817-D447B3B6AC31}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CC679CB8-DC4B-458B-B817-D447B3B6AC31}\AlternateCLSID = "{538793D5-659C-4639-A56C-A179AD87ED44}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CC679CB8-DC4B-458B-B817-D447B3B6AC31}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{55963676-2F5E-4BAF-AC28-CF26AA587566}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{55963676-2F5E-4BAF-AC28-CF26AA587566}\AlternateCLSID = "{538793D5-659C-4639-A56C-A179AD87ED44}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{55963676-2F5E-4BAF-AC28-CF26AA587566}\Compatibility Flags = "1024"	msiexec.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	runonce.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\GrpConv	grpconv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	runonce.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d9c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	runonce.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	runonce.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	runonce.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	runonce.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{027E04AD-347B-4E63-9E10-00BACB3970C8}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02E2AE5E-A8C8-458E-92B0-B72B322B623C}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02E2AE5E-A8C8-458E-92B0-B72B322B623C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5D446DC1-A494-4D3D-B5AD-0ADACB3B3EE3}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C15C0F4F-DDFB-4591-AD53-C9A71C9C15C0}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C15C0F4F-DDFB-4591-AD53-C9A71C9C15C0}\ProgID\ = "Cisco.AnyConnect.VpnApi.1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6292ECAC-42CD-43EA-A96C-0C072772B4BE}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02E2AE5E-A8C8-458E-92B0-B72B322B623C}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Cisco.AnyConnect.VpnApi	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{027E04AD-347B-4E63-9E10-00BACB3970C8}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02E2AE5E-A8C8-458E-92B0-B72B322B623C}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\ProxyStubClsid32\ = "{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0D63CA4-68E6-44E8-8738-19D6E4BC82BE}\ProxyStubClsid32\ = "{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{42B1B1F3-5E1E-4D5D-9C59-2E484C726CE6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0854B5E-16D3-46B5-8767-420EB1F48041}\TypeLib\Version = "1.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0854B5E-16D3-46B5-8767-420EB1F48041}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01F3D78C-AC49-48D1-8782-0EB481961341}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02E2AE5E-A8C8-458E-92B0-B72B322B623C}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01F3D78C-AC49-48D1-8782-0EB481961341}\ = "IPreference"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Cisco\\Cisco AnyConnect Secure Mobility Client"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5D446DC1-A494-4D3D-B5AD-0ADACB3B3EE3}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\InProcServer32\ = "C:\\Program Files (x86)\\Cisco\\Cisco AnyConnect Secure Mobility Client\\vpnapi.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\ = "PSFactoryBuffer"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0D63CA4-68E6-44E8-8738-19D6E4BC82BE}\ = "IProtocolInfo"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0D63CA4-68E6-44E8-8738-19D6E4BC82BE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\ = "IPromptEntry"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0D63CA4-68E6-44E8-8738-19D6E4BC82BE}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{42B1B1F3-5E1E-4D5D-9C59-2E484C726CE6}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6292ECAC-42CD-43EA-A96C-0C072772B4BE}\ = "IStringCollection"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E73BCCD-C4E4-4842-AB58-9F973E7D226F}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01F3D78C-AC49-48D1-8782-0EB481961341}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}\1.0\ = "Cisco AnyConnect Secure Mobility Client VPN API 1.0 Type Library"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5D446DC1-A494-4D3D-B5AD-0ADACB3B3EE3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0854B5E-16D3-46B5-8767-420EB1F48041}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6292ECAC-42CD-43EA-A96C-0C072772B4BE}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0854B5E-16D3-46B5-8767-420EB1F48041}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01F3D78C-AC49-48D1-8782-0EB481961341}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5D446DC1-A494-4D3D-B5AD-0ADACB3B3EE3}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\NumMethods	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{42B1B1F3-5E1E-4D5D-9C59-2E484C726CE6}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E73BCCD-C4E4-4842-AB58-9F973E7D226F}\NumMethods	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C15C0F4F-DDFB-4591-AD53-C9A71C9C15C0}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0854B5E-16D3-46B5-8767-420EB1F48041}\ = "IInterfaceCollection"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02E2AE5E-A8C8-458E-92B0-B72B322B623C}\ = "IRouteInfo"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E73BCCD-C4E4-4842-AB58-9F973E7D226F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E73BCCD-C4E4-4842-AB58-9F973E7D226F}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1675742406-747946869-1029867430-1000\{5BB5C4A6-8619-4BCA-A94B-79CB5D021FA8}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5D446DC1-A494-4D3D-B5AD-0ADACB3B3EE3}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0854B5E-16D3-46B5-8767-420EB1F48041}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{42B1B1F3-5E1E-4D5D-9C59-2E484C726CE6}\ProxyStubClsid32\ = "{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C15C0F4F-DDFB-4591-AD53-C9A71C9C15C0}\AppID = "{C15C0F4F-DDFB-4591-AD53-C9A71C9C15C0}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{811A60FE-D3E0-4FE6-B627-30723A93554C}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F71DC93F-C07D-44A3-95B4-864177AE0F7E}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0854B5E-16D3-46B5-8767-420EB1F48041}\ProxyStubClsid32\ = "{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{42B1B1F3-5E1E-4D5D-9C59-2E484C726CE6}\NumMethods\ = "13"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{811A60FE-D3E0-4FE6-B627-30723A93554C}\NumMethods	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{811A60FE-D3E0-4FE6-B627-30723A93554C}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E73BCCD-C4E4-4842-AB58-9F973E7D226F}\ = "IPreferenceInfo"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0854B5E-16D3-46B5-8767-420EB1F48041}\ProxyStubClsid32	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1256	msiexec.exe
1256	msiexec.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
1256	msiexec.exe
1256	msiexec.exe
5408	msedge.exe
5408	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
644	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	672	msiexec.exe
Token: SeIncreaseQuotaPrivilege	672	msiexec.exe
Token: SeSecurityPrivilege	1256	msiexec.exe
Token: SeCreateTokenPrivilege	672	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	672	msiexec.exe
Token: SeLockMemoryPrivilege	672	msiexec.exe
Token: SeIncreaseQuotaPrivilege	672	msiexec.exe
Token: SeMachineAccountPrivilege	672	msiexec.exe
Token: SeTcbPrivilege	672	msiexec.exe
Token: SeSecurityPrivilege	672	msiexec.exe
Token: SeTakeOwnershipPrivilege	672	msiexec.exe
Token: SeLoadDriverPrivilege	672	msiexec.exe
Token: SeSystemProfilePrivilege	672	msiexec.exe
Token: SeSystemtimePrivilege	672	msiexec.exe
Token: SeProfSingleProcessPrivilege	672	msiexec.exe
Token: SeIncBasePriorityPrivilege	672	msiexec.exe
Token: SeCreatePagefilePrivilege	672	msiexec.exe
Token: SeCreatePermanentPrivilege	672	msiexec.exe
Token: SeBackupPrivilege	672	msiexec.exe
Token: SeRestorePrivilege	672	msiexec.exe
Token: SeShutdownPrivilege	672	msiexec.exe
Token: SeDebugPrivilege	672	msiexec.exe
Token: SeAuditPrivilege	672	msiexec.exe
Token: SeSystemEnvironmentPrivilege	672	msiexec.exe
Token: SeChangeNotifyPrivilege	672	msiexec.exe
Token: SeRemoteShutdownPrivilege	672	msiexec.exe
Token: SeUndockPrivilege	672	msiexec.exe
Token: SeSyncAgentPrivilege	672	msiexec.exe
Token: SeEnableDelegationPrivilege	672	msiexec.exe
Token: SeManageVolumePrivilege	672	msiexec.exe
Token: SeImpersonatePrivilege	672	msiexec.exe
Token: SeCreateGlobalPrivilege	672	msiexec.exe
Token: SeBackupPrivilege	5044	vssvc.exe
Token: SeRestorePrivilege	5044	vssvc.exe
Token: SeAuditPrivilege	5044	vssvc.exe
Token: SeBackupPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeTakeOwnershipPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeTakeOwnershipPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeTakeOwnershipPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeTakeOwnershipPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeTakeOwnershipPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeTakeOwnershipPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeTakeOwnershipPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeTakeOwnershipPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeTakeOwnershipPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeTakeOwnershipPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeTakeOwnershipPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeTakeOwnershipPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe
Token: SeTakeOwnershipPrivilege	1256	msiexec.exe
Token: SeRestorePrivilege	1256	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
672	msiexec.exe
672	msiexec.exe
1404	msiexec.exe
1404	msiexec.exe
952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 4520	1256	msiexec.exe	97
PID 1256 wrote to memory of 4520	1256	msiexec.exe	97
PID 1256 wrote to memory of 984	1256	msiexec.exe	99
PID 1256 wrote to memory of 984	1256	msiexec.exe	99
PID 1256 wrote to memory of 4828	1256	msiexec.exe	101
PID 1256 wrote to memory of 4828	1256	msiexec.exe	101
PID 1256 wrote to memory of 4828	1256	msiexec.exe	101
PID 984 wrote to memory of 1784	984	powershell.exe	102
PID 984 wrote to memory of 1784	984	powershell.exe	102
PID 4828 wrote to memory of 1404	4828	CiscoSetup.exe	103
PID 4828 wrote to memory of 1404	4828	CiscoSetup.exe	103
PID 1256 wrote to memory of 4224	1256	msiexec.exe	104
PID 1256 wrote to memory of 4224	1256	msiexec.exe	104
PID 1256 wrote to memory of 4224	1256	msiexec.exe	104
PID 1784 wrote to memory of 4716	1784	csc.exe	105
PID 1784 wrote to memory of 4716	1784	csc.exe	105
PID 984 wrote to memory of 664	984	powershell.exe	107
PID 984 wrote to memory of 664	984	powershell.exe	107
PID 664 wrote to memory of 2160	664	csc.exe	108
PID 664 wrote to memory of 2160	664	csc.exe	108
PID 1256 wrote to memory of 1836	1256	msiexec.exe	111
PID 1256 wrote to memory of 1836	1256	msiexec.exe	111
PID 1256 wrote to memory of 1836	1256	msiexec.exe	111
PID 1256 wrote to memory of 1088	1256	msiexec.exe	112
PID 1256 wrote to memory of 1088	1256	msiexec.exe	112
PID 1256 wrote to memory of 1088	1256	msiexec.exe	112
PID 1256 wrote to memory of 3504	1256	msiexec.exe	116
PID 1256 wrote to memory of 3504	1256	msiexec.exe	116
PID 1256 wrote to memory of 3504	1256	msiexec.exe	116
PID 1256 wrote to memory of 3592	1256	msiexec.exe	115
PID 1256 wrote to memory of 3592	1256	msiexec.exe	115
PID 1256 wrote to memory of 3592	1256	msiexec.exe	115
PID 1256 wrote to memory of 3848	1256	msiexec.exe	113
PID 1256 wrote to memory of 3848	1256	msiexec.exe	113
PID 1256 wrote to memory of 3848	1256	msiexec.exe	113
PID 1256 wrote to memory of 4544	1256	msiexec.exe	114
PID 1256 wrote to memory of 4544	1256	msiexec.exe	114
PID 1256 wrote to memory of 4544	1256	msiexec.exe	114
PID 1256 wrote to memory of 4520	1256	msiexec.exe	117
PID 1256 wrote to memory of 4520	1256	msiexec.exe	117
PID 1256 wrote to memory of 4520	1256	msiexec.exe	117
PID 1256 wrote to memory of 4012	1256	msiexec.exe	118
PID 1256 wrote to memory of 4012	1256	msiexec.exe	118
PID 4012 wrote to memory of 3736	4012	VACon64.exe	119
PID 4012 wrote to memory of 3736	4012	VACon64.exe	119
PID 3736 wrote to memory of 444	3736	runonce.exe	120
PID 3736 wrote to memory of 444	3736	runonce.exe	120
PID 952 wrote to memory of 3832	952	msedge.exe	133
PID 952 wrote to memory of 3832	952	msedge.exe	133
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136
PID 952 wrote to memory of 5400	952	msedge.exe	136

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cisco-anyconnect-4_9_0195.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:672

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\ciscoinstall.ps1"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rfx3fi5t\rfx3fi5t.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD40E.tmp" "c:\Users\Admin\AppData\Local\Temp\rfx3fi5t\CSCF91AAA5F68624539B35BCD6BA09658E8.TMP"
      4⤵
      PID:4716
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\txccvtw4\txccvtw4.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:664
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE66D.tmp" "c:\Users\Admin\AppData\Local\Temp\txccvtw4\CSC21E8B83419C047BB86639671F4DCD34.TMP"
      4⤵
      PID:2160
- C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\CiscoSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\CiscoSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\system32\msiexec.exe
    /i "C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\WinSetup-Release-web-deploy.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\CiscoSetup.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\"
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:1404
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AFF53CC3EEB9A95152422A180162DA9E C
  2⤵
  - Loads dropped DLL
  PID:4224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D359E6BEFEE40C9732DAB49D01287C32
  2⤵
  - Loads dropped DLL
  PID:1836
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveIfExist "C:\ProgramData\\Cisco\Cisco AnyConnect VPN Client\preferences_global.xml" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences_global.xml"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1088
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveFiles "C:\ProgramData\\Cisco\Cisco AnyConnect VPN Client\Script\\" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\Script\\" "*.*"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3848
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveFiles "C:\ProgramData\\Cisco\Cisco AnyConnect VPN Client\l10n\\" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\l10n\\" "*.*"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4544
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveFiles "C:\ProgramData\\Cisco\Cisco AnyConnect VPN Client\Profile\\" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\Profile\\" "*.xml"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3592
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveIfExist "C:\Users\Admin\AppData\Local\\Cisco\Cisco AnyConnect VPN Client\preferences.xml" "C:\Users\Admin\AppData\Local\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences.xml"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3504
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnapi.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4520
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\VACon64.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\VACon64.exe" kdf -install "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\\" acsock
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\system32\runonce.exe
    "C:\Windows\system32\runonce.exe" -r
    3⤵
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\System32\grpconv.exe
      "C:\Windows\System32\grpconv.exe" -o
      4⤵
      Modifies data under HKEY_USERS
      PID:444

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9bf0dc08h5245h4f69hb9b3h5bd3e828331f
1⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb298e46f8,0x7ffb298e4708,0x7ffb298e4718
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,8207997470907639838,11309058251078035631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8207997470907639838,11309058251078035631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,8207997470907639838,11309058251078035631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:5484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:5352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e56cb26.rbs

Filesize
7KB

MD5
6d8bf927dbc18445948ebd1a41fb0051

SHA1
3df668c8ec9f80eeb82beef3d0c1dbb55c126852

SHA256
4161ac73d13c70ce36398dc786f9eb12c1203ad7bb921431e3c2bae242a06e2e

SHA512
8a6d1fc89b8a4f5c3d2fd42e1d8e4b2c013c59a377722c0ba563aa82566b60704effd897b9b0dde88d6036f7c509eb96062e5654551453d7a0ea750959da03ab

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco\Cisco AnyConnect Secure Mobility Client\Cisco AnyConnect Secure Mobility Client.lnk

Filesize
1KB

MD5
ed59d3d797a7aaa0095850c63cff5cef

SHA1
fe870fd960261202a903933af047af17a3638b20

SHA256
c092dd0cd75777f0b21fc6d56e607d6d7469f3a2302caf001a957e36eb61ace4

SHA512
5585f7b328ee343bbb4ef7cdfff458252419a6679d3a5ce6a80edca5c1a1ddb0040db3ffb335f94d8648e414ae55fee180f09dedf5c09300b9eded05d7a7f952

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco\Cisco AnyConnect Secure Mobility Client\Cisco AnyConnect Secure Mobility Client.lnk~RFe5732e7.TMP

Filesize
1KB

MD5
6fc25913d7b58836f8122fd6d6b94f34

SHA1
ee4215e1ea72b49bf2b0f31176d51eff71387008

SHA256
ad19a2db65070492fc291377298b6132c8eac4537322afec43966f71b4c3fa03

SHA512
52d5481302b141b4de2039d7d98b8b37a23b1d7c102af462f974596439bd47c56440c21933d4bb978a0d6ab9a872648fb2378fc98ef5daeab9e559132e200253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cd4f5fe0fc0ab6b6df866b9bfb9dd762

SHA1
a6aaed363cd5a7b6910e9b3296c0093b0ac94759

SHA256
3b803b53dbd3d592848fc66e5715f39f6bc02cbc95fb2452cd5822d98c6b8f81

SHA512
7072630ec28cf6a8d5b072555234b5150c1e952138e5cdc29435a6242fda4b4217b81fb57acae927d2b908fa06f36414cb3fab35110d63107141263e3bba9676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
2a44daf43f85ce3e64d06071126d5b88

SHA1
5366e59132a68acaf29010174a9414afedfd53a7

SHA256
612131a41728b1fc5b6ed0d6c67d23ee2c07e5d2d4724892cdf0a7d91ed7ff60

SHA512
6c84f2de407676e2ce7f8fa5068b73d99c9570b34e0d5a4408a5a69510d309b24eb1baac94d72b30ba361155bc461e2600e5646193b40cb1aa1b34a0e973678c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
3KB

MD5
3d898aef59992b62422d3181f5f7349f

SHA1
db7b47d207e6f5a428f7d6da4b7295f2bd5619ea

SHA256
479cd3745af371e46a57d8d0432b7d2fe7991c69282ca069cdb879208cf90f93

SHA512
857e23857a8b226a74d7f1b1b99defa9e876ebe07d455fe5cebb7ce0839432cbea5983c2374ddbb0b3c339077703479c115acbc14eeedc8f8d30b41811b8899c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
1f1e2addfa423506f8816b7554a5b46d

SHA1
10843fb9efb16854ec27ffa14016ebf7dfb71b34

SHA256
8df29d08a1d3d463da8baa1be72e5f11048a18f1fc8177b272b201343f13286e

SHA512
4c250f62a5eb89cc330e9525155e35ee1d9a54e4a1d00fcb6829eec4762d59680f09246095f74dad6fa878bc03092c69211969b7a4474ec9b9d5bd7e75ad8120

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID3C0.tmp

Filesize
43KB

MD5
b759a21d153a42060a53a89a26b9931c

SHA1
6260cecd55db44d75121b1f88506a4a9978c1b0f

SHA256
6adcc31d2e3746c81f47041e9c6cc576cfe303fc1ed6dadd002c54f98c20cbcd

SHA512
78bf70af5b91bd4dd3ed75e0f25957f8f7cb540872e7c2ead0c429ec1d493058a603a37c64236270b31602e226ac928983f6143d4df52b4058eed9c9be2259f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID3C0.tmp

Filesize
43KB

MD5
b759a21d153a42060a53a89a26b9931c

SHA1
6260cecd55db44d75121b1f88506a4a9978c1b0f

SHA256
6adcc31d2e3746c81f47041e9c6cc576cfe303fc1ed6dadd002c54f98c20cbcd

SHA512
78bf70af5b91bd4dd3ed75e0f25957f8f7cb540872e7c2ead0c429ec1d493058a603a37c64236270b31602e226ac928983f6143d4df52b4058eed9c9be2259f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID661.tmp

Filesize
43KB

MD5
b759a21d153a42060a53a89a26b9931c

SHA1
6260cecd55db44d75121b1f88506a4a9978c1b0f

SHA256
6adcc31d2e3746c81f47041e9c6cc576cfe303fc1ed6dadd002c54f98c20cbcd

SHA512
78bf70af5b91bd4dd3ed75e0f25957f8f7cb540872e7c2ead0c429ec1d493058a603a37c64236270b31602e226ac928983f6143d4df52b4058eed9c9be2259f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID661.tmp

Filesize
43KB

MD5
b759a21d153a42060a53a89a26b9931c

SHA1
6260cecd55db44d75121b1f88506a4a9978c1b0f

SHA256
6adcc31d2e3746c81f47041e9c6cc576cfe303fc1ed6dadd002c54f98c20cbcd

SHA512
78bf70af5b91bd4dd3ed75e0f25957f8f7cb540872e7c2ead0c429ec1d493058a603a37c64236270b31602e226ac928983f6143d4df52b4058eed9c9be2259f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\CiscoSetup.exe

Filesize
3.3MB

MD5
f58f1216150ab62f270d322930401d51

SHA1
30878587ace8ccfb0e054433fddf1d88f1e2ee90

SHA256
713c13abdc4ec1047ba2e2081c7a31f64ceac5fc6d7c6e21c56a16cd219e946c

SHA512
9aeccab1e95376d481f41faed0b19b5dce8ce993ee11b0a9e563bf10925b91ec7a0e8e2843df9cffc7409420bb62c0cf19d0596eaa9fefe1104ce3b7d9d8c9e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\CiscoSetup.exe

Filesize
3.3MB

MD5
f58f1216150ab62f270d322930401d51

SHA1
30878587ace8ccfb0e054433fddf1d88f1e2ee90

SHA256
713c13abdc4ec1047ba2e2081c7a31f64ceac5fc6d7c6e21c56a16cd219e946c

SHA512
9aeccab1e95376d481f41faed0b19b5dce8ce993ee11b0a9e563bf10925b91ec7a0e8e2843df9cffc7409420bb62c0cf19d0596eaa9fefe1104ce3b7d9d8c9e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\ciscoinstall.ps1

Filesize
2.2MB

MD5
962cc61dc68b2a4a30b1b71c5e775a58

SHA1
a4f8be8adef32440dc2c4ec0139033cc080ed67a

SHA256
c45c37b7925da4793ef5b8c203fb6dd5fa31f248f0d30d1263f22559624d555d

SHA512
969c34cfa053a0db89c13840e7f56237fccb21ff1a7aed78ba10d1439f3b13c47b0083eaa4b91f6563bc4bd4080546a85f091c991f7de457e1ce7d53ca9b35f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD40E.tmp

Filesize
1KB

MD5
7edbe6753d4905f1d4a829ca44c0a3be

SHA1
11b94d5696f64914b6691dafa1e7f0dd9527bf7d

SHA256
6a0097c42ddc7339a9f2d56150e8f5e9d940e9a951acc51b4dae0f1203ad0f06

SHA512
1305905c5dd24b2e3ff36816acc7b655bb0ec76808a4bd3bf098abf05ef4f8776731e7d42a233be2ef4864a334fa1b0f60223952d993ec8e5b636c47d012856d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESE66D.tmp

Filesize
1KB

MD5
a41f11211f793ce9de737c39b6bd25be

SHA1
4d7bd1bb056f71c091c5ba6c62d9f75ee3769205

SHA256
25dc2fd0a5614baa1ee1ce9bb5bda2d8c76e74e16b73882d523ed3e1816d5ce2

SHA512
b7e0d38422736aafff9ddbf6b05068c5a3cd15af81aa88b10dde73dde20b7d4ad7c7a092dd841c66e259abfe16325d9b71cd39e6cf71f60f3b43929985fd6291

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_04dmake2.bxo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\CommonAppDataFolder\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\AnyConnectProfile.xsd

Filesize
81KB

MD5
061b80b8ec0b53e059050da71eb319ed

SHA1
e575e76dd8c6f07f912b2ad39a7947cc1e89fc53

SHA256
02dfd7797e2e3f77f094163b7285d350251a3ca648d37361ae9a151346bd083b

SHA512
5d18f82e7f3af91d6c5cdede7a1c0bd995396f8fced300dd794ab76c68606874f6ebc9c80a6ef94e4033feedc53cf03d37161a4f586eb88d6c569bd60df6ef4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\InstallHelper.exe

Filesize
130KB

MD5
51fb3328b8bdc491820200ba4c107bc7

SHA1
a2de1456dc687acccc3a78f3f074531a84e0a201

SHA256
86bc1b1bac1b476b5c2baef0a8e461f986da699ca0727593adb8e763119c4812

SHA512
e0d840baa46ec04282ed8a7532b10916a5e8f48e090dec501fd605533ae142af726e01c04492909ebf6fc34ed698a3963da8f524e33f92532697f4ebe1d02e48

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\InstallHelper64.exe

Filesize
304KB

MD5
6c292bffcb32ede34bc0eba93e959a82

SHA1
d9eb0bc1b85d30668623363901c55102df6b8276

SHA256
3a6b0cf8f248f2c108bb250d32ffbec5aadcc9115483987ffec3eed5d639afa7

SHA512
57455f452da745792c9d376ec324e656e9100bc4a59000d887bddd9fb2a948f46a76a4f8cb4d267278b742ecf227c2bf96d4d780348447bf06ba7c751595d3eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\ManifestTool.exe

Filesize
252KB

MD5
8029e4214ddda50ade4060a260b7c67e

SHA1
e4b2c83dc850fd5abbc1c126fa852382c6ac102b

SHA256
dc2ed840dd27ee6354662d008e41a482b8e54640f8e2b4092960e8a999b5c01a

SHA512
bb8ed2f4203cee176ce3bb28fa341c07b7d60b6c09dbc465d70733c692ced923d504c2f04fae79c345b4ccdb90a3938ef23cd79b2936e7256b9cced0c974023b

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\OpenSource.html

Filesize
68KB

MD5
66c957b4adf4ee5621ab270e3e3dadca

SHA1
b39e6fb5914e24c0012bfde5d24ee31d134d67e8

SHA256
517c6e4a5e727961e4dfbea3998ccfca04ca9e00600e4d4feffd1f3b09adad7a

SHA512
963d6752888c5e21540aa96615d8d25f90fe654d7e691a303b55e081e59a4f86a71cee01bdaf9fc680dfcf45c896b061cf74d13db3c39d0a6757d440e2952d33

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\Plugins\acfeedback.dll

Filesize
109KB

MD5
19954215db500943faccb4768840768d

SHA1
0f64d57a590b63e5ba6bd1a20bf4d1a0c6fbbec5

SHA256
2ad1cc33e8e839dd43ed4ab81135ecddef00c8bac4876734a011d861ae14ac69

SHA512
d2b3240f5879214e3057eaf474c8f520c98da3d98ac74adb6e9ea6e12ebce4dcb800ccf0881f547fe62567d1b778e3ad700f4be1379837495f67431f42bf7296

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\Plugins\actoast.dll

Filesize
100KB

MD5
e66bcd826617a06266b9d45c5c3869d2

SHA1
504ceb54dd840f1b071c78fb5707818ff7c64d1a

SHA256
867adece3ccfe85ec4aa4a96dce722a84c06393cb51c421b79b69c049deae5c7

SHA512
dea948d2e0dccf992ce096db9a402f3ae18f6e7aa64e9a608a9b11f80ce096d30016399f4ecd832e878f815fe65d0a32047e4f7eb0f4cad6476023a81a06a53e

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\Plugins\vpnipsec.dll

Filesize
514KB

MD5
d792e2d223255ba0f8a97ee63d5d5669

SHA1
758ece1342244747d424d0a6cc1e2b5715cf6649

SHA256
94c418b728438d9d1cb682ceccdda3c0a2a60f2dacb3c15862a561e8f2d0c475

SHA512
458b3ce031ba42f254574c4a53be19ccf50fbaa9d982665e1972dec5555baa2b373603b469beebab4cf8c0bc7470ad1699a9be800a8a0c854e46a7582733a79b

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\SystemFolder\vpncategories.dll

Filesize
17KB

MD5
a205f452a37fd45623340346bf23c706

SHA1
62574460f85b06f2b28e86ac9222e954272f5785

SHA256
de79c47bf4ef5724b12e5a5626b8add179c45dd20b56bb3e16da2cd67b594356

SHA512
bd56d7ffad640665e2629c0b68fb25f8431036f61c9aed63af6b9e5ab2282dc2808eab82d8673ac69d8cef6415e932b3fba39256f89c785cdf7f4cf7f472831f

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\SystemFolder\vpnevents.dll

Filesize
40KB

MD5
a1a7d6e9bffc0227894f89d32d8c5116

SHA1
04c73451ac0e0a3db8b901940906b1e39a73fc4d

SHA256
ac3522b8a4f22e5f890f9c9dc96fdbac6201b53f5d573d05cb2e10e97e9dd80f

SHA512
ba9f3c737bcf20912ce0c9f6d17ef60c68f2a7a9e06bd28612b597c6e5c8760d52303bd4c6f64561904d01d5137e009c16726470bf2ad01e7806006e8ec0a3a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\Uninstall.exe

Filesize
293KB

MD5
3c1f76be25868c1428aa723b005a9c83

SHA1
40dcedd6b6659a347f007404fd11d042ded04106

SHA256
32e7a532653f0009571388198efec940f9a02970751d32ad274431594f0a2a01

SHA512
706100688690efaf3fa7e2bc77405673e40f5624a78d0ac6d7c1e9b95d1c935985a2dcceebbca70a87535b01e5b306ee969950a13fe31c6ad229c2465779e327

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\VACon.exe

Filesize
216KB

MD5
1226914bd9051622419108cb65ac6694

SHA1
98847578de344435831c831db5cc4927ee8df654

SHA256
27dd96e5da4d109244bfb68170becd418deb7fed9380f6a818d3680e272e6921

SHA512
f40d398b17bad92cdca640f140dd87c82c3ef65d07b79a4b757be9272a39a60f864c75494ebe978f520c2a04d41118d40e4b8c67c363b13c588164129d7b215a

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\VACon64.exe

Filesize
243KB

MD5
28f7700e7e058e31afce915c9a9b8b53

SHA1
49897ba0536876ac2192bf054deeb6b47448c206

SHA256
1c1ba6b95f73c49743536721eda27d15e4113dd1dc13b24cbe0cbc81b9d1188d

SHA512
a1d99ba7d6cb68020291f18199b4658b5cb791992a1937a33068bd0a2e4b26dae053e2077ae31e0bf52c6f1c54f4e1b46c597d349ad6375c4a4c7c92cb062752

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\WinSetup-Release-web-deploy.msi

Filesize
347KB

MD5
9e81383d5c5694835ebe9c853546b856

SHA1
a115c76e85960ae9c6dc505dad92ebb4e206567e

SHA256
8058c37115d53b13d0bdccfc5b1360364e2d1476873906f924deff84c3c73e00

SHA512
0566890e88a7e70c0d3dde84acfb9e5e24023af68acb9dc00884f3dc061613afc1d6b669c48fa4d600aa2fb5f92534c117d301159e416b7ac46391d419e554a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\ac_sock_fltr_api.dll

Filesize
97KB

MD5
3ccfc5d111e470682d0fe5eb952353ec

SHA1
6268e5ab3c114ca23b0e8defb92e1db2241dec36

SHA256
98c5080155dedefb0eaee01a21cd734a2e5595e215986b93305a504d0a160813

SHA512
f5bd21d449a0940e364e3f9e85d57575acd20bc65fdf369b590620e89f720c25cba9380a3f83db13b05b92a0e01ab7b8b0a2156e2096b25cb72fdc14073de951

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\acciscocrypto.dll

Filesize
1.5MB

MD5
6b26e629cf76578b2ef9a01b4a4ccd2d

SHA1
d034741e808c02ef5d1b07f811f82a78f3a8d1a6

SHA256
bb6206951a18c5c04bb30acda14a364b391b5312d9f2d9300d2ea2a6a0c62be7

SHA512
84be3d4bb03f938aabcfc48c9574d0ec3e14542a49a41d2c39ca41d3c567acb85579182d98a1ea02a36aaec38216d8ab2f934c55652eb3ff6ba953e5b4772fa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\acciscossl.dll

Filesize
328KB

MD5
756ac9c287b87fa3209d349b7f165c49

SHA1
d29935d0c18442e60caa8bb95f848ac57ef5eb03

SHA256
50c3a40e76ccd679c52ea3f617131f10b4be0ad7214cd59b05b0f66e6f23b624

SHA512
5e2d424af4228c47f9692d1fea63830486f3752c4449e8146debde0e4eae88d7bd9f101c3aadb0f0090e07a7cb6589db3d0fd52ed45d774f32bd4f2dbcfd01d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\acsint.sys

Filesize
49KB

MD5
36bd8a8e457aa2e2fac45cac899c18c9

SHA1
66049e4a4851451b344a9167854129b9ea4d7fa9

SHA256
0d0482da7fb9c07fb683cb371c75e2f750d44a9c2fc2103d0660adab0b2d28d6

SHA512
d10c00bdc03e31d094d22c95e2b26df226da8f734f786ca21ef95007d6715334c79e03cd6ee41c2b4a5f0b3f93335f8142f1d869318cdfb35e80887356115095

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\acsint64.sys

Filesize
59KB

MD5
a1b185b044abb4a9a3ef411767b249aa

SHA1
4f6e2e3a73f86f6a27315b5db88a0c94db1ec1f7

SHA256
330786836358c947138b68fc4cb643a9a84f8b529f6dbc6e0637e77328f5993a

SHA512
691f92e0572937b36bacd8186fd75652875861c017c97faa2cfea550635582dc6d4a69822f9a25043d306c22344a6aa5dfc8cc70d1ec4b33e523b2b3dd65063b

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\acsmux.sys

Filesize
68KB

MD5
f1868ec29de5305b43db2c9473cbdcff

SHA1
eea9b05de8bb3474b84ab665f23a04ec82d6657d

SHA256
866c55dd38256dcd48276449ba26777277f32329850ecd0dcd868a4b42b5aaf5

SHA512
c12936d6d7a817f5811dfb25f393ab9e8c50f9e53b7ed97ec7ce6750ff0c8e13528af5922d4426374633579c3dce41175060d0a838341e4c63eeb38716e5a2c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\acsmux64.sys

Filesize
82KB

MD5
c5519039a87ac341af20d82372b46b3c

SHA1
5bc3264276ebc38f38c0584b4dc5b57843522d7a

SHA256
9d9aef514669cb1e563234fcfee89e18fad4c78db6e0af3a49b4602dd8eb8306

SHA512
6f14e327e6a53785db692f35d537a3d83acb5c480490152c17fe6f2939a64f6c7a9b513c28dc4c27071761d5083c9a72231e443bd9204a3e7247ac4111b065e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\acsock.inf

Filesize
1KB

MD5
2be51c4997a2d99d163f03ba92c90788

SHA1
886ea7e09700dc1b2d17e9e96d79382b78836a44

SHA256
48c34b3a1a593b89b86bd90d70c5d696b9df0202b96603776224bd85403400bf

SHA512
d3002f9694e037b31cc81ce7a9a894c36d31beb0c824361a4a964d3e4787391db523d287623be4d036307b5497627bec42bb420523c334dfeb9b988c0959736a

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\acsock.sys

Filesize
110KB

MD5
96eb8ddc60eb891259ac4037884319bd

SHA1
492661dbd75780110b8547d480a97989be6d6174

SHA256
b08816c627bb9a33bce0c6df61fb5856e45416f0e76a0bca4b11e584ca947837

SHA512
b953502b4557fc73a5571ddad4f41adde99d11217cf397bb50ee42b6cc49b1d22861432be7d33d64036280ca6355ddf8447e1ce3e7199816cdd7bea25f12cc80

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\acsock64.sys

Filesize
130KB

MD5
f28ade410436b42a3fcb53c38cefefc8

SHA1
b36cf0f3c98e9a8160a4b1e3076362e841dcab88

SHA256
15faf5cfc498fa08ff086c2ae50cbd0414d325f92fb1da44f521ca0f1078b2c3

SHA512
19344fd84a6f03ba600793a354e6f2d7c5dfb3b08a35e0c02261cdf88b2226371c6f8a59bdd28da7eff443800712cd0a112b3a30c16b8afe42840654d1ba9952

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\res\attention.ico

Filesize
1KB

MD5
17378c7237316af904fc5d101df4228f

SHA1
a69b2ceb842745905ac056a328f69939d889139a

SHA256
69b10b84b59aebfdb0fe7f7fe04176be63848f7f57dca0f467f313a8bd0fde07

SHA512
f4e5d9df13d08b8f2cfc3fb6b286586d3faff4015f80ae23a6f6f06bad8d0b7a44640128989bfb73944db2d86854735645a7fdcf61ab5923d0b13cd1c38d2edb

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\res\gradient.png

Filesize
998B

MD5
04c5de9f86cc2f0381a0042e73093cf5

SHA1
b56bda32158678da1a8e4d4bb3a856e9e0e46dad

SHA256
03663db3e312f320a51002847e9d66107ed51d20c9d191217dcb97a41b734605

SHA512
0c7c37421271b29ce621ef5ce654945d43d84d29a74c64421a7737455f291103b0e49508dd91c792f58409621b897fef7691e4341fe776b481af00793f03c998

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\res\mftogglebtn-down-solid.png

Filesize
1KB

MD5
23621a086ede9b1fd7e2bc47d34e6411

SHA1
2f820b5e425206c75c175ea06a84b3300a92940a

SHA256
3f57c1f1ec3585bff41ed202c122755778439df44e3cc31ff298e449dd1b6411

SHA512
2c28d30d34e87704ed6ba72dcb776185523a96fd9d7120d516b32b843c9fe6f95cf8d1ce0b83bc6e8b4b6846ac62eb7fa7eda6df8d7eb5b059be6456286d1961

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\res\status_ico_transition.png

Filesize
4KB

MD5
bb592cbb7c96a421fd8bc37e8597a8fd

SHA1
149b0ef611eebcbd8c812cc270372ae1aee35d96

SHA256
210246922c3643baa8e9c0c93cc36eb23dcc754e184c96bb798aeebac2a454d6

SHA512
5c40418da7990b5a9e0215b3229d8482e2501ccc9fbd7acf0dc8f4afba3e3fbb55c5073970b9db32901ca72be315dca18c71def55efef2ef1f3bbe01156dc991

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\res\toolbar_about.png

Filesize
3KB

MD5
ca2fa1aee6b912baf0ed54a7be93c7a5

SHA1
1fe293bf973987f5edf69e347faa06f24ac2d00b

SHA256
2a15a223956866ef6a3bb27932fcdecbce05be29c6dbec0d7fd91eab302e6a9b

SHA512
27054dc36dd407e788673a8d7cacdc414213d70abbafe86bee0ab104170ce0f0ec2c81b6bac60617e4ac80c79b9f6c1c23bca3aefefba3e56c909997f0c1bee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\vpnagent.exe

Filesize
560KB

MD5
ced5750ecf0d60f76727be53ce05ed68

SHA1
00cb4e922bbff87338155bda0b208a6411b42d42

SHA256
192e7767bed6c1ea925f5a790ec75a1c2bc4ff20f6c832a1c910d515aa565b69

SHA512
4dfdab776394de7f3a0c151d6297e5017b39e350eb077158f225195e5256f424fe3e2767e6e23c6addff22591399c4ee159bdc43cf7d90f0e0b62f91f33d16b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\vpnagentutilities.dll

Filesize
599KB

MD5
96bf7994bfaa91a974363c08a5e646d4

SHA1
d4496dfa08081dd812aeb2ab5b08bce350b35c5f

SHA256
785503631675a19dabfe9fc94a00fb8e08fcdb5cbc72419b3af3337d3484ff47

SHA512
cbfc1c7040cdb7bce72f38df94087435e1b199188939b68e353772eeae45f05b5717b754e172fc968997aa014a250ba73784f3a0333fbb4103435dd354453d25

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\vpnapi.dll

Filesize
1.0MB

MD5
cea128048bb04379419cf25520675117

SHA1
a73df6cac0bc28b1719b451c29e398e3ab31e9dd

SHA256
39a903bcd9d62496ad7fcb8fd15f4508289eed4ecac056d9507ad557c497934c

SHA512
d900a2a2dca937e172b65f08476f71eba3fbef97d20b4b48e57b1a20ae32ea65e40d8d2391a743711a1cf62ce51e69294d5611faea006900168db3e5b54b81b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\vpncli.exe

Filesize
64KB

MD5
7230c688cacd204548e23fbec970a4d8

SHA1
626bc1b333b85345686d4019e2df4ea33b04c89c

SHA256
0fd122e104367d6420ee9cd2cb2f98196e2b693ffa857c517f3c7d90cb1c509d

SHA512
98da7d8f9d29ebf8ab37f8c4912642a8242221480e3959d1915817138891278a49135ce81053c390ec63c3011fcc63f560b24743bf1252c69706d851bc9eb94c

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\vpncommon.dll

Filesize
1.1MB

MD5
4a115aca42d156f3e939dce444e025ee

SHA1
71b70f5405392757ad88559e1658b5c4912c2610

SHA256
a9b1cfddb59e56458485896a538425762d655be440345860c11a6c0bcaf82bc5

SHA512
ca50b0639a48193be58cc04ad5228ddb08df34d2470e3c3c8a265599dd050f3849738d7953f37af22982ba377b27149d82bd6696ff5cef3a0e094e11da646ed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\vpncommoncrypt.dll

Filesize
406KB

MD5
ff2921941469069eeeb387152abc7d5b

SHA1
9bf024829f6a891db8992e069633a8abde9bcdb7

SHA256
4a371e4af418943c5a39d270c81f2870113d5d2ae1e0b176b726438cf167c144

SHA512
65ea4a0d3cc13bb9f32ededbffce419024e75e0f6ef9c10589f743e8fd6c839566364bc04473914b7d982d61207e1c0248efda03f31f5cf27bb7c9542a5953f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\vpndownloader.exe

Filesize
920KB

MD5
ee6a8b692b4c5c9f1ca4e7ddc29ae575

SHA1
e52cae113e71f99c6d501ebe688ae0a346eac119

SHA256
34d3542027e3ef84d61da7da0614321e6c3d93b0fafdc4aaa5ea426416ef2364

SHA512
90ff4d137047bdb5c02ff52188ca5523483c7995be0f9d1ba080b6a05892c58ddc6b1b1dd20f5eeb33e4ce51724d8e74b1a36496dbfb244acf5b859f05b9ca72

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\vpnui.exe

Filesize
748KB

MD5
c4ffd238884d74241c9dd3cd9bd1b5f7

SHA1
21566c53348a24a5e02da8459040283ec764cfb2

SHA256
ab6c54313a75bb7ff7faeec0cc6c4d67805af89b0692de2a112928c5f62763ea

SHA512
c4eda875218d7db6c47ae3a919c85ee04f3fe7ee587e762a4c88faa000e4333c5d34380aed40b34c744ec469cc66a3e12f468657deaa944639f63f8591d9e12b

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\vpnva-6.cat

Filesize
8KB

MD5
3d4ae82dba0e7b160649221e9f8a3f14

SHA1
0d622789b158554c7f6b35af377a8e9cd71b8cbb

SHA256
a78ff25683bd836426fa425cf2cf09575436870a0dc3e74a47a33525571e2fd4

SHA512
7bac5283193b102bd465d3454a6f5f30c8744eb36cb1ff3f5b4276d34e51ff8552618b8b924eae6a486e1ec3f3dce6cc75e2b3ab1be9cf35e934a252afba4dec

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\vpnva-6.inf

Filesize
3KB

MD5
ab0a1104734f3bdcb1128d29db9cc759

SHA1
693a858cc4c0b0906f8a2108258b224f2f722508

SHA256
45e18c056b68b6fa4418261267eba02fd6b8504e04abde7e5c48d8891aac42dc

SHA512
4244a84db6681007b8475843c7516b044fdf32d24b295aa3dfa872e6b32041ec762f1d8987f2f296b09eab7ad959f1d6baad217d4457c90656a7663b382ef855

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\vpnva64.cat

Filesize
7KB

MD5
eada1c070e70f8e443763f75493e96a1

SHA1
a24e0219a7ed18d12a47d44d9f397c18af740529

SHA256
2b0c591055766f6b3dbb6aeda9b3144f1848c86e09ff16a88e0b380e46cd62fa

SHA512
9258d370f47758ca2c28d3115971f2aec1f11d320a1d755aafda4a73af93b21b34d75b420a0798cf6115e49c660b448c881d9f0f5d4ff05e7a498a544a4cb619

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\vpnva64.sys

Filesize
26KB

MD5
a8d4fed106b4bd337df3da20ba44e18e

SHA1
9b16a79100e0affe0cf662af0f41a5daee3a57bd

SHA256
066f58895f9ff71e72852db982c3cd2f7e92092411686ce972449b0123a04b1e

SHA512
129944d556b5f46fc453bdf0e654d06d355cc9b11d323f95f0e3ec030b0bbc0da0e5f1d40e01468710a175d07e661dd96617ad983ca9f7f18449fc9967c91fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\7CD12F2\zlib1.dll

Filesize
68KB

MD5
a2b0c6c8b44717ecaab345e5f920c3bc

SHA1
46449166c16928bb06000e9fff90d38df77696cd

SHA256
9836d83b5e81d23650a3104c7425d10c6a0a9e2d9e93419aa794d6e758aa72ac

SHA512
51dfee773e98f9033a265ec672cdcef4ef7dfbf3d0e303ca2ca3ebdf8084c1749a30f55486278518a49e09c5243e6d14940f8767a0bc761c982a6a85107dfb8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\install\decoder.dll

Filesize
105KB

MD5
143da6747fff236a473bdf6007629490

SHA1
aed2e6ecbd53ce1e281cee958b3c867f14c8262d

SHA256
75f59cfba8c75d7646a697609a9baefb3388b1b6e66db37c50924e3fcba68893

SHA512
d52393c33b647ad82adfa1c66f7adb3f8d148d71675fca7df62c974ef9c1d0b25092164fe9603184370f8ecdb5d00d1dd61dd626ec7655b94e03509aaf9fddd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\rfx3fi5t\rfx3fi5t.dll

Filesize
3KB

MD5
6bcda30f3302d07724a40f56adb045c3

SHA1
c26fac6f3c1d0ad2fd2636d652c952fb5f50dffa

SHA256
f74c5df8e0d022512f42f7326b9c2412536af54bb904b0bf9a1ffe0b0ec0a04e

SHA512
0c7587933702c75e283772f9cfcad621f8fa92ec8d3eaac24ce6cf92a8eaabb2844a002d3c3c1f626f72e62457265b4dc0032433fbe755033854d6cb60f9939f

Download Submit
C:\Users\Admin\AppData\Local\Temp\txccvtw4\txccvtw4.dll

Filesize
3KB

MD5
03a21ab0ed5afaad9d26d7d8d87546d7

SHA1
a6d14f84e1bdeba7322b7e1999f349f90a47b650

SHA256
b1cc4d90ed4db1e0a66494606b494f5c99da0b6fdf6eed4a0e01dd4afb19ad13

SHA512
38d9b11a4eaea093b27fdbfc400a0b08452a0ad02e26e49aa7b6228c17169a875e8e00d2a6962debed8276d8f17179927df0e0999fe42bb0fba0e52fe0cbab42

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\Windows\Installer\MSI2CBE.tmp

Filesize
43KB

MD5
b759a21d153a42060a53a89a26b9931c

SHA1
6260cecd55db44d75121b1f88506a4a9978c1b0f

SHA256
6adcc31d2e3746c81f47041e9c6cc576cfe303fc1ed6dadd002c54f98c20cbcd

SHA512
78bf70af5b91bd4dd3ed75e0f25957f8f7cb540872e7c2ead0c429ec1d493058a603a37c64236270b31602e226ac928983f6143d4df52b4058eed9c9be2259f0

Download Submit
C:\Windows\Installer\MSI2CBE.tmp

Filesize
43KB

MD5
b759a21d153a42060a53a89a26b9931c

SHA1
6260cecd55db44d75121b1f88506a4a9978c1b0f

SHA256
6adcc31d2e3746c81f47041e9c6cc576cfe303fc1ed6dadd002c54f98c20cbcd

SHA512
78bf70af5b91bd4dd3ed75e0f25957f8f7cb540872e7c2ead0c429ec1d493058a603a37c64236270b31602e226ac928983f6143d4df52b4058eed9c9be2259f0

Download Submit
C:\Windows\Installer\MSI2CBE.tmp

Filesize
43KB

MD5
b759a21d153a42060a53a89a26b9931c

SHA1
6260cecd55db44d75121b1f88506a4a9978c1b0f

SHA256
6adcc31d2e3746c81f47041e9c6cc576cfe303fc1ed6dadd002c54f98c20cbcd

SHA512
78bf70af5b91bd4dd3ed75e0f25957f8f7cb540872e7c2ead0c429ec1d493058a603a37c64236270b31602e226ac928983f6143d4df52b4058eed9c9be2259f0

Download Submit
C:\Windows\Installer\e56cb25.msi

Filesize
4.2MB

MD5
72f7a880209c875d48c153b5b8db71f9

SHA1
f861232236ddcd2df75dfe77c7ba5342b84bf777

SHA256
b1bae0bca6cef482524586746abfda822829edad434a164cf764eb34c15736a6

SHA512
fe9c4f18ac24f89aac02dcc372a65c9d611c3d4755fdd060ae50d79228192b788fca61aef6776b0aa4576d5f124de77ec2b7a790bd2d87099ac357e165ddaac9

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
127d387cfdc9a3e14f0f208d46de083a

SHA1
2357797b773344b4d2f9760c173323cceeb726c3

SHA256
e6f773638c723445b006d4f021cce75b358253b34ce06944ad8e472c0da31e41

SHA512
2222365d9d0aebdfb785618f037440600983dcc798f102a0e61bc4b25006e35f9544deedcb8d0b3c800c057d080910d555087b61587a227a16569e470009e511

Download Submit
\??\Volume{93c6d6f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8a0e9f21-1e24-42a0-92f4-b3c32e831c72}_OnDiskSnapshotProp

Filesize
5KB

MD5
b56c6a108f086ea8398573b3ada2c220

SHA1
b8ccce02153369e048fff1931f8cce77d89bbc1b

SHA256
f54469ba692df174142e93dac68af231f75f7e4e2f89e98e5c9f4b20ca85ee5b

SHA512
1e4a540a573c10f2531a682b76283f50c99e6dcdab7c7a2b61570fc7c7fa4ee6636489623804143ac30749b26313bd32f9fe5881b2c4234d81415929fd695c1d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rfx3fi5t\CSCF91AAA5F68624539B35BCD6BA09658E8.TMP

Filesize
652B

MD5
91d285c10eafe9d939257dacfa6a6ebb

SHA1
843a7ef1f9b7325e699116cff877e8256cf80f1a

SHA256
46c4d6034498cba39b0ef6864d786fb081aef3c1be7be2190cbfca6fedc5bd9d

SHA512
730efe50acce433560cb41498b7bda27167fae4f16289e94849edf405ee61f423182bda4ccee6ea36c78d023b4e9a39bab94fb59e43c51e529720c0767379cad

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rfx3fi5t\rfx3fi5t.0.cs

Filesize
203B

MD5
b611be9282deb44eed731f72bcbb2b82

SHA1
cc1d606d853bbabd5fef87255356a0d54381c289

SHA256
ee09fdd61a05266e4e09f418fc6a452f1205d9f29afba6b8a1579333dc3ff3b6

SHA512
63b5ad7b65fd4866fb8841e4eee567e4f1e7888bb9fda8dd5c8dca3461d084d3f80ce920ae321609e4ff32ba13a55b7320282ce7201bb74a793d4700240360a4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rfx3fi5t\rfx3fi5t.cmdline

Filesize
369B

MD5
85564353afc14ca879ba6398d98fa508

SHA1
b7e8549c4d65a15ca91b2a5a89e68f4020d39d6c

SHA256
44172058f9f41a18dc4e21d28e5c1b35e2251007cb52441b6c7673cb29b44d92

SHA512
50b24d1e180c3433d50cb80ce3a68b8ea42c1f47728a3bffd6f168ff7f7c9c0a855e494da0771e1cb7c7a2bf6c6f02398acef46c355e1f17812067f6906480e1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\txccvtw4\CSC21E8B83419C047BB86639671F4DCD34.TMP

Filesize
652B

MD5
7e75daf233854ed9316857b10e65df45

SHA1
1e5a8895c43c22984be8b5b1f11ded7a881de1e3

SHA256
aea70fb1b71ce143748590ac8f17a2a1644c034f9556197d0af9d420673c0d71

SHA512
c01fbc30287edc8d00ce42c71774bf1e7cfa1815e89ac031cae80ca8a481bde07107bf722fe29e3c004f25dc12966c739a6bd6a5d2812b19177ce90b6b8dbf89

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\txccvtw4\txccvtw4.0.cs

Filesize
582B

MD5
2bb8d0ee93aeae61a09adf4db6f29c1c

SHA1
8da3034bb8f84ea2522e276b492b2797b5db30ca

SHA256
68d44e3c373d2aec9dacf51326cbfebcba76c1c1a56545e5e1cbf58b44a9f817

SHA512
b3ec6841a9541e96a671a7d81378293567972541d9cdfc3137b478d9b4d3cccd4b5f536d0f059ee9c12fe9ba86bca62b795139a5215843465cb751e0ade95677

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\txccvtw4\txccvtw4.cmdline

Filesize
369B

MD5
4153600d3ea8363bee308fec6e5e2a88

SHA1
c1407db9adce645d727b9e7bc4d5eeb37477692f

SHA256
a52297a6f0398a3068712eefe63c18969e85e25e2013f31b125c3f545cc523b6

SHA512
eb8ba194c95f718f84331396e35ad5593dbf10c42887b9a81080d5cf95970fdc577becde8656b6dbd4dd88461c7077bb68e360fb5e6afc20b15584efa54776f3

Download Submit
memory/984-315-0x0000021B737A0000-0x0000021B73914000-memory.dmp

Filesize
1.5MB

Download
memory/984-312-0x0000021B737A0000-0x0000021B73914000-memory.dmp

Filesize
1.5MB

Download
memory/984-313-0x0000021B73030000-0x0000021B73040000-memory.dmp

Filesize
64KB

Download
memory/984-314-0x00007FFB54D50000-0x00007FFB54D51000-memory.dmp

Filesize
4KB

Download
memory/984-306-0x0000021B73620000-0x0000021B73794000-memory.dmp

Filesize
1.5MB

Download
memory/984-316-0x0000021B737A0000-0x0000021B73914000-memory.dmp

Filesize
1.5MB

Download
memory/984-322-0x0000021B73030000-0x0000021B73040000-memory.dmp

Filesize
64KB

Download
memory/984-176-0x0000021B73030000-0x0000021B73040000-memory.dmp

Filesize
64KB

Download
memory/984-175-0x0000021B73030000-0x0000021B73040000-memory.dmp

Filesize
64KB

Download
memory/984-323-0x0000021B73030000-0x0000021B73040000-memory.dmp

Filesize
64KB

Download
memory/984-324-0x0000021B73030000-0x0000021B73040000-memory.dmp

Filesize
64KB

Download
memory/984-159-0x0000021B73170000-0x0000021B73192000-memory.dmp

Filesize
136KB

Download
memory/984-325-0x0000021B73030000-0x0000021B73040000-memory.dmp

Filesize
64KB

Download