38f8f20eae06e575938ffbeb64e31c9310e8c0ab50a2bc231f3aa9777abc3dbc

Resubmissions

06-12-2024 10:33

241206-mlpwbssrct 10

06-12-2024 10:28

241206-mh1tessqbs 8

06-12-2024 02:25

241206-cwfeja1mgn 3

Analysis

max time kernel
149s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38f8f20eae06e575938ffbeb64e31c9310e8c0ab50a2bc231f3aa9777abc3dbc.pdf
Size

16KB
MD5

e51378e49d1aa79ce88c018d748a186c
SHA1

d2e31a96af911a0cf932ec860ce839e254fbd5c8
SHA256

38f8f20eae06e575938ffbeb64e31c9310e8c0ab50a2bc231f3aa9777abc3dbc
SHA512

0f28b75712bcc9307e8bfe0b9c692cf1f582c957a718dde3eed7485c4e050075ef45ad49f57ade1536ac6b4c6418a26656318bc630156936892fd2c999fa0604
SSDEEP

384:9q3MsrhjEN4gQ3micNexY27IEPCUSkSaHTeOHAgJlATCUSN:9q3prh04d2aFU2dHTDHv62

Score

8^/10

discovery motw persistence phishing

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET4F8D.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET4F8D.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\acsock64.sys	MsiExec.exe

Executes dropped EXE 9 IoCs

pid	Process
5876	InstallHelper.exe
3488	InstallHelper.exe
1976	InstallHelper.exe
1784	InstallHelper.exe
5624	InstallHelper.exe
6072	InstallHelper.exe
840	InstallHelper.exe
5916	InstallHelper.exe
4824	InstallHelper.exe

Loads dropped DLL 64 IoCs

pid	Process
5544	MsiExec.exe
5544	MsiExec.exe
5544	MsiExec.exe
5544	MsiExec.exe
5544	MsiExec.exe
964	MsiExec.exe
964	MsiExec.exe
964	MsiExec.exe
964	MsiExec.exe
964	MsiExec.exe
3728	MsiExec.exe
3728	MsiExec.exe
5876	InstallHelper.exe
5876	InstallHelper.exe
5876	InstallHelper.exe
5876	InstallHelper.exe
5876	InstallHelper.exe
5876	InstallHelper.exe
5876	InstallHelper.exe
5876	InstallHelper.exe
5876	InstallHelper.exe
5876	InstallHelper.exe
5876	InstallHelper.exe
5876	InstallHelper.exe
3488	InstallHelper.exe
3488	InstallHelper.exe
3488	InstallHelper.exe
3488	InstallHelper.exe
3488	InstallHelper.exe
3488	InstallHelper.exe
3488	InstallHelper.exe
3488	InstallHelper.exe
3488	InstallHelper.exe
1976	InstallHelper.exe
1976	InstallHelper.exe
1976	InstallHelper.exe
1976	InstallHelper.exe
1976	InstallHelper.exe
1976	InstallHelper.exe
1976	InstallHelper.exe
1976	InstallHelper.exe
1976	InstallHelper.exe
1784	InstallHelper.exe
1784	InstallHelper.exe
1784	InstallHelper.exe
1784	InstallHelper.exe
1784	InstallHelper.exe
1784	InstallHelper.exe
1784	InstallHelper.exe
1784	InstallHelper.exe
1784	InstallHelper.exe
5624	InstallHelper.exe
5624	InstallHelper.exe
5624	InstallHelper.exe
5624	InstallHelper.exe
5624	InstallHelper.exe
5624	InstallHelper.exe
5624	InstallHelper.exe
5624	InstallHelper.exe
5624	InstallHelper.exe
6072	InstallHelper.exe
6072	InstallHelper.exe
6072	InstallHelper.exe
6072	InstallHelper.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cisco AnyConnect Secure Mobility Agent for Windows = "\"C:\\Program Files (x86)\\Cisco\\Cisco AnyConnect Secure Mobility Client\\vpnui.exe\" -minimized"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	MsiExec.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
85	4932	msiexec.exe
87	4932	msiexec.exe
90	4932	msiexec.exe
92	4932	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
25	https://www.firewall.cx/downloads/cisco-tools-a-applications/cisco-anyconnect-secure-mobility-client-v4-9-0195.html

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vpnevents.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vpncategories.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\wntdll.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\dll\wntdll.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wntdll.pdb	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vcruntime140.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\status_ico_noncompliant.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagentutilities.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\toolbar_help.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\boost_signals.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnapi.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acsock64.inf	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\about_hover.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\attention.ico	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\cisco_indigo.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\company_logo_alt.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acsock64.inf	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\mftogglebtn.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\manifesttool.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\cisco_indigo.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\Plugins\acfeedback.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpncommon.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\Uninstall.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acciscossl.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\toolbar.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnva64-6.sys	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\noncompliant.ico	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\msvcp140_2.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\error.ico	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnmgmttun.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\Plugins\vpnapishim.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acciscossl.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper64.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\manifesttool.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\company_logo.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\boost_chrono.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\boost_thread.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\mftogglebtn-down.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\transition_3.ico	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnva-6.cat	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\msvcp140.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\collapse.ico	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vcruntime140.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\GUI.ico	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\status_ico_error.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\gradient.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\mftogglebtn-down-solid.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\msvcp140.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\VACon64.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\status_ico_attention.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\ac_sock_fltr_api.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\status_ico_good.png	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\vpn_logo.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\ac_sock_fltr_api.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\Plugins\actoast.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\boost_date_time.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\cisco_blue.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\cfom.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\res\vpn_connected.ico	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\concrt140.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acruntime.dll	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acwebhelper.exe	msiexec.exe
File created	C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\Install\Component\acsock64.json	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59403b.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C2324E3B-0AED-4413-82FA-F638913C264A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI43B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4437.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EAB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EDB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59403b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4135.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI41E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4486.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5247.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI41A4.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI463D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47C4.tmp	msiexec.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI55F1.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f914d34881601a250000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f914d3480000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f914d348000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df914d348000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f914d34800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CC679CB8-DC4B-458B-B817-D447B3B6AC31}\AlternateCLSID = "{538793D5-659C-4639-A56C-A179AD87ED44}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{55963676-2F5E-4BAF-AC28-CF26AA587566}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{55963676-2F5E-4BAF-AC28-CF26AA587566}\AlternateCLSID = "{538793D5-659C-4639-A56C-A179AD87ED44}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\acwebhelper.exe = "11000"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\vpnui.exe = "11000"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CC679CB8-DC4B-458B-B817-D447B3B6AC31}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CC679CB8-DC4B-458B-B817-D447B3B6AC31}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{55963676-2F5E-4BAF-AC28-CF26AA587566}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\GrpConv	grpconv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	runonce.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	runonce.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	runonce.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	runonce.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\GrpConv	grpconv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	runonce.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	runonce.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d7d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	runonce.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d9c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	runonce.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	runonce.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	runonce.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	runonce.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01F3D78C-AC49-48D1-8782-0EB481961341}\ = "IPreference"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6292ECAC-42CD-43EA-A96C-0C072772B4BE}	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\TypeLib\Version = "1.0"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{42B1B1F3-5E1E-4D5D-9C59-2E484C726CE6}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\ProxyStubClsid32	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\NumMethods\ = "16"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C15C0F4F-DDFB-4591-AD53-C9A71C9C15C0}\ = "Cisco AnyConnect Secure Mobility Client VPN COM API"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}\1.0\0\win32\ = "C:\\Program Files (x86)\\Cisco\\Cisco AnyConnect Secure Mobility Client\\vpnapi.dll"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{027E04AD-347B-4E63-9E10-00BACB3970C8}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{811A60FE-D3E0-4FE6-B627-30723A93554C}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02E2AE5E-A8C8-458E-92B0-B72B322B623C}\TypeLib\Version = "1.0"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\ProxyStubClsid32\ = "{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0D63CA4-68E6-44E8-8738-19D6E4BC82BE}\ProxyStubClsid32\ = "{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{027E04AD-347B-4E63-9E10-00BACB3970C8}\NumMethods	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Cisco\\Cisco AnyConnect Secure Mobility Client"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{811A60FE-D3E0-4FE6-B627-30723A93554C}\TypeLib	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6292ECAC-42CD-43EA-A96C-0C072772B4BE}\TypeLib\Version = "1.0"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{42B1B1F3-5E1E-4D5D-9C59-2E484C726CE6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0D63CA4-68E6-44E8-8738-19D6E4BC82BE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6292ECAC-42CD-43EA-A96C-0C072772B4BE}\ProxyStubClsid32\ = "{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{42B1B1F3-5E1E-4D5D-9C59-2E484C726CE6}\ProxyStubClsid32\ = "{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C15C0F4F-DDFB-4591-AD53-C9A71C9C15C0}\VersionIndependentProgID	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01F3D78C-AC49-48D1-8782-0EB481961341}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01F3D78C-AC49-48D1-8782-0EB481961341}\ = "IPreference"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\ = "IPromptEntry"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{42B1B1F3-5E1E-4D5D-9C59-2E484C726CE6}\ProxyStubClsid32	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0854B5E-16D3-46B5-8767-420EB1F48041}\ProxyStubClsid32	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02E2AE5E-A8C8-458E-92B0-B72B322B623C}\TypeLib	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C15C0F4F-DDFB-4591-AD53-C9A71C9C15C0}\VersionIndependentProgID\ = "Cisco.AnyConnect.VpnApi"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E73BCCD-C4E4-4842-AB58-9F973E7D226F}	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02E2AE5E-A8C8-458E-92B0-B72B322B623C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F71DC93F-C07D-44A3-95B4-864177AE0F7E}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{42B1B1F3-5E1E-4D5D-9C59-2E484C726CE6}\ = "IVpnStats"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{42B1B1F3-5E1E-4D5D-9C59-2E484C726CE6}\TypeLib	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0D63CA4-68E6-44E8-8738-19D6E4BC82BE}\ProxyStubClsid32	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{027E04AD-347B-4E63-9E10-00BACB3970C8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{42B1B1F3-5E1E-4D5D-9C59-2E484C726CE6}\TypeLib	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02E2AE5E-A8C8-458E-92B0-B72B322B623C}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5D446DC1-A494-4D3D-B5AD-0ADACB3B3EE3}	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0854B5E-16D3-46B5-8767-420EB1F48041}	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{811A60FE-D3E0-4FE6-B627-30723A93554C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{027E04AD-347B-4E63-9E10-00BACB3970C8}\TypeLib	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F71DC93F-C07D-44A3-95B4-864177AE0F7E}\ProxyStubClsid32	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F71DC93F-C07D-44A3-95B4-864177AE0F7E}\ = "IFirewallInfo"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Cisco.AnyConnect.VpnApi.1\CLSID\ = "{C15C0F4F-DDFB-4591-AD53-C9A71C9C15C0}"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01F3D78C-AC49-48D1-8782-0EB481961341}\TypeLib\Version = "1.0"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\TypeLib	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{027E04AD-347B-4E63-9E10-00BACB3970C8}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{548A1F06-AECE-4506-8ABB-5E3D3A99B67B}\TypeLib	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02E2AE5E-A8C8-458E-92B0-B72B322B623C}\TypeLib\Version = "1.0"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F71DC93F-C07D-44A3-95B4-864177AE0F7E}\TypeLib	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02E2AE5E-A8C8-458E-92B0-B72B322B623C}\ = "IRouteInfo"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{42B1B1F3-5E1E-4D5D-9C59-2E484C726CE6}\ = "IVpnStats"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6292ECAC-42CD-43EA-A96C-0C072772B4BE}\TypeLib	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{811A60FE-D3E0-4FE6-B627-30723A93554C}\NumMethods\ = "20"	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C15C0F4F-DDFB-4591-AD53-C9A71C9C15C0}\InprocServer32\ = "C:\\Program Files (x86)\\Cisco\\Cisco AnyConnect Secure Mobility Client\\vpnapi.dll"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{027E04AD-347B-4E63-9E10-00BACB3970C8}\TypeLib	InstallHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{811A60FE-D3E0-4FE6-B627-30723A93554C}\TypeLib\ = "{C15C09AE-FCCE-9221-FFA2-7465FEAAE55A}"	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{027E04AD-347B-4E63-9E10-00BACB3970C8}	InstallHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E73BCCD-C4E4-4842-AB58-9F973E7D226F}	InstallHelper.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
2916	msedge.exe
2916	msedge.exe
3172	identity_helper.exe
3172	identity_helper.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
1816	msedge.exe
1816	msedge.exe
6116	msiexec.exe
6116	msiexec.exe
3728	MsiExec.exe
3728	MsiExec.exe
3728	MsiExec.exe
3728	MsiExec.exe
3728	MsiExec.exe
3728	MsiExec.exe
3728	MsiExec.exe
3728	MsiExec.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4428	7zG.exe
Token: 35	4428	7zG.exe
Token: SeSecurityPrivilege	4428	7zG.exe
Token: SeSecurityPrivilege	4428	7zG.exe
Token: SeShutdownPrivilege	4932	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4932	msiexec.exe
Token: SeSecurityPrivilege	6116	msiexec.exe
Token: SeCreateTokenPrivilege	4932	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4932	msiexec.exe
Token: SeLockMemoryPrivilege	4932	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4932	msiexec.exe
Token: SeMachineAccountPrivilege	4932	msiexec.exe
Token: SeTcbPrivilege	4932	msiexec.exe
Token: SeSecurityPrivilege	4932	msiexec.exe
Token: SeTakeOwnershipPrivilege	4932	msiexec.exe
Token: SeLoadDriverPrivilege	4932	msiexec.exe
Token: SeSystemProfilePrivilege	4932	msiexec.exe
Token: SeSystemtimePrivilege	4932	msiexec.exe
Token: SeProfSingleProcessPrivilege	4932	msiexec.exe
Token: SeIncBasePriorityPrivilege	4932	msiexec.exe
Token: SeCreatePagefilePrivilege	4932	msiexec.exe
Token: SeCreatePermanentPrivilege	4932	msiexec.exe
Token: SeBackupPrivilege	4932	msiexec.exe
Token: SeRestorePrivilege	4932	msiexec.exe
Token: SeShutdownPrivilege	4932	msiexec.exe
Token: SeDebugPrivilege	4932	msiexec.exe
Token: SeAuditPrivilege	4932	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4932	msiexec.exe
Token: SeChangeNotifyPrivilege	4932	msiexec.exe
Token: SeRemoteShutdownPrivilege	4932	msiexec.exe
Token: SeUndockPrivilege	4932	msiexec.exe
Token: SeSyncAgentPrivilege	4932	msiexec.exe
Token: SeEnableDelegationPrivilege	4932	msiexec.exe
Token: SeManageVolumePrivilege	4932	msiexec.exe
Token: SeImpersonatePrivilege	4932	msiexec.exe
Token: SeCreateGlobalPrivilege	4932	msiexec.exe
Token: SeCreateTokenPrivilege	4932	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4932	msiexec.exe
Token: SeLockMemoryPrivilege	4932	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4932	msiexec.exe
Token: SeMachineAccountPrivilege	4932	msiexec.exe
Token: SeTcbPrivilege	4932	msiexec.exe
Token: SeSecurityPrivilege	4932	msiexec.exe
Token: SeTakeOwnershipPrivilege	4932	msiexec.exe
Token: SeLoadDriverPrivilege	4932	msiexec.exe
Token: SeSystemProfilePrivilege	4932	msiexec.exe
Token: SeSystemtimePrivilege	4932	msiexec.exe
Token: SeProfSingleProcessPrivilege	4932	msiexec.exe
Token: SeIncBasePriorityPrivilege	4932	msiexec.exe
Token: SeCreatePagefilePrivilege	4932	msiexec.exe
Token: SeCreatePermanentPrivilege	4932	msiexec.exe
Token: SeBackupPrivilege	4932	msiexec.exe
Token: SeRestorePrivilege	4932	msiexec.exe
Token: SeShutdownPrivilege	4932	msiexec.exe
Token: SeDebugPrivilege	4932	msiexec.exe
Token: SeAuditPrivilege	4932	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4932	msiexec.exe
Token: SeChangeNotifyPrivilege	4932	msiexec.exe
Token: SeRemoteShutdownPrivilege	4932	msiexec.exe
Token: SeUndockPrivilege	4932	msiexec.exe
Token: SeSyncAgentPrivilege	4932	msiexec.exe
Token: SeEnableDelegationPrivilege	4932	msiexec.exe
Token: SeManageVolumePrivilege	4932	msiexec.exe
Token: SeImpersonatePrivilege	4932	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3584	AcroRd32.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 2916	3584	AcroRd32.exe	85
PID 3584 wrote to memory of 2916	3584	AcroRd32.exe	85
PID 2916 wrote to memory of 3428	2916	msedge.exe	87
PID 2916 wrote to memory of 3428	2916	msedge.exe	87
PID 3584 wrote to memory of 4968	3584	AcroRd32.exe	86
PID 3584 wrote to memory of 4968	3584	AcroRd32.exe	86
PID 3584 wrote to memory of 4968	3584	AcroRd32.exe	86
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1968	2916	msedge.exe	88
PID 2916 wrote to memory of 1660	2916	msedge.exe	89
PID 2916 wrote to memory of 1660	2916	msedge.exe	89
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90
PID 2916 wrote to memory of 5096	2916	msedge.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\38f8f20eae06e575938ffbeb64e31c9310e8c0ab50a2bc231f3aa9777abc3dbc.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://apt-as.com/linker/jump.php?sid=29&url=h%2574t%2570%253A%252F%252F%2564%256F%256D%252E%2566i%256C%2565%256Fu%2574%2570u%2574%252E%2570%2572%256F%2523%2566%2539%252D%2547%2530%252D%255A%256A
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd683146f8,0x7ffd68314708,0x7ffd68314718
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
    3⤵
    PID:876
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1
    3⤵
    PID:768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17578111511428151966,2920212969326584381,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6156 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1020
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4968
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=58E1089E25FB5B1074BD4434788529B6 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3164
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FF6C99228FBAB1CA989B1844BC3446DD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FF6C99228FBAB1CA989B1844BC3446DD --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1624
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8EA37910DBDBB2D2D97FB1B7D573F3B4 --mojo-platform-channel-handle=2352 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3852
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=33F4EF50A0FAC3295798A7C8842ABA3A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=33F4EF50A0FAC3295798A7C8842ABA3A --renderer-client-id=5 --mojo-platform-channel-handle=1708 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2480
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7D6A74F7ABD840DE549551376DB8F325 --mojo-platform-channel-handle=1784 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1048
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7B0D397951F3E588B4C8C1C0C4A3CE4A --mojo-platform-channel-handle=2804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5860

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap19653:114:7zEvent2286
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Cisco AnyConnect 4.9.0195\anyconnect-win-4.9.01095-core-vpn-predeploy-k9.msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4932

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6116
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 30A422AA217E32AD48D78C59F2C218DD C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5544
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5820
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 52F348D14C07A7502656B3F08C291ABD
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:964
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F3740E9AE443C72AB87FD3F4D432BF6D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{4E096B0B-4F51-43B3-BC2B-B87D0F5D3634}.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2128
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:6064
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{4E096B0B-4F51-43B3-BC2B-B87D0F5D3634}.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2308
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{4E096B0B-4F51-43B3-BC2B-B87D0F5D3634}.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5912
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{1D901D0F-EDDA-4107-8D65-AC37EFFD59CE}.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4836
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:1908
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{1D901D0F-EDDA-4107-8D65-AC37EFFD59CE}.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5448
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{1D901D0F-EDDA-4107-8D65-AC37EFFD59CE}.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5584
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveIfExist "C:\ProgramData\\Cisco\Cisco AnyConnect VPN Client\preferences_global.xml" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences_global.xml"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5876
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveIfExist "C:\Users\Admin\AppData\Local\\Cisco\Cisco AnyConnect VPN Client\preferences.xml" "C:\Users\Admin\AppData\Local\Cisco\Cisco AnyConnect Secure Mobility Client\\preferences.xml"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3488
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveFiles "C:\ProgramData\\Cisco\Cisco AnyConnect VPN Client\Profile\\" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\Profile\\" "*.xml"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1976
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveFiles "C:\ProgramData\\Cisco\Cisco AnyConnect VPN Client\Script\\" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\Script\\" "*.*"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1784
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -moveFiles "C:\ProgramData\\Cisco\Cisco AnyConnect VPN Client\l10n\\" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\l10n\\" "*.*"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5624
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -copyFiles "C:\Users\Admin\Downloads\Cisco AnyConnect 4.9.0195\Profiles\\" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\" "AnyConnectLocalPolicy.xml"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6072
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -copyFiles "C:\Users\Admin\Downloads\Cisco AnyConnect 4.9.0195\Profiles\vpn\\" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\\Profile\\" "*.xml"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:840
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -copyFiles "C:\Users\Admin\Downloads\Cisco AnyConnect 4.9.0195\Profiles\feedback\\" "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\CustomerExperienceFeedback\\" "CustomerExperience_Feedback.xml"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5916
- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe
  "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe" -registerdll "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnapi.dll"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4824
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F2AE60E381006E1869AF56CCBDD0ADA8 E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Drops file in Windows directory
  PID:4436
- - C:\Windows\system32\runonce.exe
    "C:\Windows\system32\runonce.exe" -r
    3⤵
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    PID:2428
  - - C:\Windows\System32\grpconv.exe
      "C:\Windows\System32\grpconv.exe" -o
      4⤵
      Modifies data under HKEY_USERS
      PID:3460
- - C:\Windows\system32\runonce.exe
    "C:\Windows\system32\runonce.exe" -r
    3⤵
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    PID:5572
  - - C:\Windows\System32\grpconv.exe
      "C:\Windows\System32\grpconv.exe" -o
      4⤵
      Modifies data under HKEY_USERS
      PID:5748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\InstallHelper.exe

Filesize
3.9MB

MD5
313a4c79212f1cd2ff5dd8aac7a02cab

SHA1
8daa73b2911f1434f4fa6a5e075e0949b97f6440

SHA256
ceb37977ae1cbc342af70da23a793754b54e25f31f00fbe781523a395d408e00

SHA512
989eb23e84f3eed3af2597e487df24b116e37f89687861de958012ab8a873a14746665c9fc0ff16ad39f0e5e8197ffe01cd98be982c32a6948187f05b44408c5

Download Submit
C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\MSVCP140.dll

Filesize
438KB

MD5
1fb93933fd087215a3c7b0800e6bb703

SHA1
a78232c352ed06cedd7ca5cd5cb60e61ef8d86fb

SHA256
2db7fd3c9c3c4b67f2d50a5a50e8c69154dc859780dd487c28a4e6ed1af90d01

SHA512
79cd448e44b5607863b3cd0f9c8e1310f7e340559495589c428a24a4ac49beb06502d787824097bb959a1c9cb80672630dac19a405468a0b64db5ebd6493590e

Download Submit
C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acciscocrypto.dll

Filesize
1.7MB

MD5
cb97a8f7d426dce639379a995affaca7

SHA1
0e0acdf19947b4e9ab977003b882ac93872ad0ef

SHA256
911af347b41ef81c16a992a72d8c5699437a0e1ab6e5c7b806823b3719e50135

SHA512
6fa3b0dccc9d68dbedf7ebeeac20d26878f66200f716687a620fc9f383dc9ba01faa3ed1359665381b472091f405e901070f52c204edf7a4709e6f2650df6886

Download Submit
C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\acciscossl.dll

Filesize
422KB

MD5
4a92135f4c03dfa85d5baa4ca964679a

SHA1
21f274bf23ea64e70bbea5dff5aedee806365c60

SHA256
7cccb12108764b124b5ceb0664f48c15c07d81ef9d70e7a45b282e01d6c1a5b8

SHA512
253a9ea748442f6f69ca31a40bde863023a26c49e3e695106ba0b80eb437443693c9e179ec7fcac960ccf49ce1a8e6b7c8366aed42a23f3774768ea1851fbbc1

Download Submit
C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\boost_date_time.dll

Filesize
55KB

MD5
d1f3d3546c85e7dee06097385054df05

SHA1
a2dea0defb191b03ea115daf7ceac0d6b5d5d36b

SHA256
a5615870dcdf3f3bd82b1340a9856e71f7a36e563abd6c5eea858045e5fea3c6

SHA512
89a16f4fd749a7a720f8329b1c1ddf7d7dd175fe99b47f028713dff542e63d391e26723aefbc5ad5582882cd973eefadd1bd98558a03be959b671c4125a1b80f

Download Submit
C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\boost_thread.dll

Filesize
91KB

MD5
c903c8308766f77aca61b8092cd66117

SHA1
6d4dac9b4d83ffe848f2aa30124d63244224698e

SHA256
b2ff444b81ac65934476d9ccbbbd066a9028de4696586ffdaeb79911dc5467fb

SHA512
224bc17699180a39a20370ca9a5a83d6877da447be2aba398a04ff0ef5c028f006002b89a4c103db7af9445fb8503089c78d8b3d38e9807604f2fae7caa8d2c3

Download Submit
C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpncommon.dll

Filesize
1.6MB

MD5
4ed830f6582af5c568905e49d521efed

SHA1
76be963fc6165254a0e4a6905bc25fa02113c2ea

SHA256
f0a48f478649d7feafee871bfb01238a20156d4fe59c2eba19834c21d349f38c

SHA512
a196b250952e3deb575d3d83c7485c77d6c372d56e1fd936e4020e7bf82183988053b200bad5fb2c6aa2d0cdb961e9ab9ea10a696dad217a08931f001903c9a4

Download Submit
C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpncommoncrypt.dll

Filesize
474KB

MD5
00a3a4000810c221cf317a503cd27e20

SHA1
24e3da01f744f99b7fa4294ce6d663d2e7e82e2b

SHA256
8b4d8da3e19c23fbc009ac4f3d77334b1b8a419cfd998547bd968eb727a6f34a

SHA512
c885c6133c3419d60647b3aa704c8792fbaf5497d618ec759371ce28c8fdf52fa670c979e213f228ba8f7646e7da6e080ec88453add1d7a868a455a3bf76c413

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco\Cisco AnyConnect Secure Mobility Client\Cisco AnyConnect Secure Mobility Client.lnk

Filesize
1KB

MD5
7919450221f6cfee76a36e28b9243674

SHA1
4f222ead8aad27e58027584096fd5d6132ad03c9

SHA256
44da1f5c969382163de18593ac9451fe6828d5f24a22eca86ca83b1918255528

SHA512
678e92cad0e4b3fc0e881920d2c240ed35f4ab3b05c0daa836bff3942da24270e6de98ac76f4debd6ea2bc97c003a8a17d3fd5e7a52a85dfbc79053327263561

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco\Cisco AnyConnect Secure Mobility Client\Cisco AnyConnect Secure Mobility Client.lnk~RFe594a2e.TMP

Filesize
1KB

MD5
56aa373606556d270eb6e5e9a7f942e4

SHA1
93fd310fb7929365af0db4b9c624eb0d8f24f153

SHA256
e6338a191be87fe42855dec0d22222778d14e1c4b47b835c9d610560f3ccc4fd

SHA512
7f8c55f61c84e988fb59c100c94799781f1a02fa331bcaedbf184e42e1c3fc4fc89dccd3e92a1f8a01e5059976faea03c4f9438b274cc2af515443a397922770

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
a06bd8d9798427d74c6b99183650a56a

SHA1
bd61dcca58b32915a8657186cf4d100b126fd5f3

SHA256
1d80dd0b96bca0e2b019122f95c503be4d98f671a91c45e1c4d825141a5731bb

SHA512
929930a6bca6b531088aa8f00b237ff4a877924fb8c930e0fcd939f8e8b8faaf8d27f360aa5200f4159ff1212e7f63c0dcff9c6d21842db6aad63de9ff0ca0c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3854FAC0D697873AEC36877F496668D2

Filesize
10KB

MD5
a22867da0f3cefd3d58f6da19cb05829

SHA1
8ee6f9156e707740949c24f8c3fdef7405e49509

SHA256
dfd2490021e0560695295455715e19536f50063312d272c2e4ace71ad0e9acc9

SHA512
77a850933df695e68937828a52e92b82d4918f14ddb2dc191110bcc6b4779393f8a2efe2680f84e2a1f079712e3c42ee7fc47f8aef8bb490d0988675662ad554

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\472BC96E644745821BD57EA65406C816

Filesize
1KB

MD5
b7b89696a30acab9b6b6b944d55514a7

SHA1
4d37505156c7c7288b4c4d569cec0087273ff718

SHA256
450d65c3e4a85fc4e7f39b972b71982042e1a1302dce6d9242aadd6fa90fbccb

SHA512
d34c1f79dcccc3147b568b2f2038c012a6b244cf6117aa59fcad65d3178de0b4abaed45f5cc4e3c9952ba4fbfdf2dcf63819b928d8c58d648da4b20596df78b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CDE89F9DCB25D8AC547E3CEFDA4FB6C2_C90A4A142FC951BB5BA5ADB1D629C0D7

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1401C7EC8E96BC79CBFD92F9DF762D_5398732881722BDE3E78D6CA6BB2B78B

Filesize
388B

MD5
eade09622fd631fa5ca894a28c519d9a

SHA1
93eb0cf054e8275acd85f927288304c9e9092573

SHA256
d33abadcb50dd60cee0d827605dd9f23315aac00785e89e57e3de66cef35a175

SHA512
fb0976054b2910ec0163cf01baf6f42fa13119d15a0dbed7e1e5540964de8db0c28206f4fb1f410f43d3f78b8f76ce69a7cd046a78915409e27e8608e8a90cd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3854FAC0D697873AEC36877F496668D2

Filesize
170B

MD5
4cd39ebec312cd90434f1693889f0e2c

SHA1
0989ea9dce93162f902e119a3e0cb8641047fe7a

SHA256
24d7538aa4ca23e530e58592eaa2690883432b161306e957bb31e3cb6864be8a

SHA512
76953da58079e582184e1a82d678cb22ec2c9811b635fb988205ce429b63e1890590e85bb0fefe89ed8d3bdaf44186df679d8c275ff0327a9a5343a5ad0f6ba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\472BC96E644745821BD57EA65406C816

Filesize
192B

MD5
64dd094dbb4b86497d1e619df5545ebb

SHA1
0d89eda4c9df254a752c598f2d8f23eea0b46bbd

SHA256
a2c24eae70fcce3bdb0592337ea11253652e55f75a94b562d0bd3dcf6ad52155

SHA512
2eb405cedd64e61d4317626d5520a6e26cd29f154bc31d62467127e700327a90fe998e94f58696316283b13794b6823a3f6ff3277b8597550b025268376b4f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CDE89F9DCB25D8AC547E3CEFDA4FB6C2_C90A4A142FC951BB5BA5ADB1D629C0D7

Filesize
394B

MD5
def2b21e1a20d8209cf1682f99f7e01e

SHA1
0ab0624db1a42ffb7fe33dcc21aaff0e2e2037a7

SHA256
16ff63366934149f8653e26c5ec85d38ad7f9b7fe2997ccfa4f6ee06b3031d30

SHA512
1936ea733db0c6153e673a7058c13ff2ec36a1f57602734ef3cc5dca4e4bdda35ac6d52330d0e630292379798d1e7250598712388df4b6c35a5f5ff2e6d43df5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
8b9650ee251416b24a797a57f3145a5b

SHA1
79a1afb3ff4fb5c765aa1bad264f9facf18517f7

SHA256
987edc13dcb9238d1edc6425d4b31beb696fab28e2904eb1e518d86cc402d901

SHA512
d5f9d4d2561803e4ce47a8de8e6474a2029aea92ddb9dddfb6e7f439acfa21e3d3515d6d9396e9e3e63fe91ae56e2d24ff16bfad9deabb47fb8c9c7c984752aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
477B

MD5
7093992832027a74163cd41ae226949b

SHA1
b09e329470cbae8b603409cc6d4c76ff76b841c4

SHA256
aacaef923b02e73a8ec787f0164eb78e976f95c0352cb3aadf2e02380f57e9e0

SHA512
926ab9c28fb49daebef6ca264f42c39f71a96276a1b8419b9a4667a7e45c02f4d438145a805500361976c352a84ef203a290d09cf56838e8d2d733f7117164ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c60d911bedd12bf801ccdcab42ae9582

SHA1
f84cbdd42c806151c937fc8a4cffede8b332b5de

SHA256
487e24bc14b8a8bd46fcc30f2d26d9aa461d151956d0a2c040cd0560df558303

SHA512
0a5439f49bce64ff4960219b833eb449e90964777e4f6296241e792dd00fc622a77fa1a30425119384c9a67493ea2e2033ef278b782d6ff0aa1caec1b47c16d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a267bc3d2fc0f866a010f0e6fd95145f

SHA1
1761e6c2dbd6eb7a572ff4e473e6d9e7417d3947

SHA256
f3291c4e94331bbe688a681bbc183a5619f8dbb21b3823cdc218c4cf96a60195

SHA512
1b1b98143057cb2eec12f571aa6617e3b4f1a340398de43465d32af2e25ad40c61210f752df7b3177661af9cdb4602fdac29cef9e59b94f50a04937406618481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
146e16d4aa2283c16000169793d2d4ad

SHA1
a770150e39aa8a2e7c90abe76243d8186f5e1a2d

SHA256
ff09d50b3e99369ee48ba94e2f3bf80bd726d9ab226659dfc72c6c16804b5443

SHA512
d2390f79e5d539ce06471278cb63679ca4d31d69e6fd4ddb733ad2ec540e2a1012e0aeebdf6fcb31dd04c493f0b2d9c21a7e033607555b8ca34381cef9be8a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
e12236ebb07c0271fd827715ac87e8d8

SHA1
758163865cc74c37ef383b6b2b4fb2431ac73536

SHA256
651098246b540924271de1171cbd9c42f8b1f8c23a6c78603564e9589c830b6b

SHA512
4a0691ed6963763ff94fddefdc51c9ceaff4547417534ea43bf2114bf30b0938363c81b2352eb9828927027a8aed5ca02669cec6fa24eeef4a39e80edb2824ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57feb3.TMP

Filesize
203B

MD5
759229fa2325271a18d5298d148fc2ac

SHA1
5cbbaf9330571dcac5522fbdcc104c8f1e3827d3

SHA256
29db72f34a6c1ef274c7adc428d5bedb6e9384d5e8820e95260a24058ce20d65

SHA512
4601ba8dc2855346311317e8c856202eb1454684637e6b7a567c98833e1a324f5bef88ceb220a400ddab702de9b25352043011e19573f7b266351c481d8d365e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a9d21adefd67d5dbedf4267611238831

SHA1
aac1807af71831e9f2b8fae4c13fe0c34583dcb5

SHA256
f969be19fe66617681f9b35af19f6c068057573008f0854b4daff49597aac0ee

SHA512
0e402d9ad7f704fe53f2ad3711362d68abc5a4d654451f86bf0725055a723ed53eacc3596670048a1f4fd9b98b7c08517da3aff22c5b68602db86c4b8c2a3390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
78f5e3dd99af1d975790c5674ff09ec1

SHA1
e7e7d345d75ca112d6ceb5d1124cdd2de49b80c1

SHA256
d71885c77420bd005e4b125b21f6985241379ffa925ce1659f6ebff1fa4b1009

SHA512
fa2bda2622320a12226d7a970780bc890d90bd6a6ff0e8583042d4dd4ccc10799fb23f5f14e94efcf6916fd4e87e7a0efe1be6265b42f33b235bd161850ed8a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF6BF.tmp

Filesize
349KB

MD5
09979fe43e7417c747ca0f71d811b5c1

SHA1
4765260722982446ccff12d6613de845177ccc98

SHA256
d3ab8b009c45ea39791a8179ec1ec8c649281d7af3c8e975991085a25d4757a9

SHA512
c150ff622aee88ddd849ca78b669bc469590110d01a393794c8c008c50f06d9b33f8d0c11106d6defba4750c7c93f2ff86a1fd524658161c9e5a93620a352282

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4E096B0B-4F51-43B3-BC2B-B87D0F5D3634}.bat

Filesize
104B

MD5
31fa5d0936cf7315acb8626e8052c98c

SHA1
ac7a3b50e43159ace55e92f205e93a4d128c750b

SHA256
2cf1bd05c65ff42ef725cc5f23b86c309562411f860d29f4ab847f3b87e73787

SHA512
b55da9057a8894ebe2a22c90548d2d4869f2f786367763917b82cad6365774b15cc0b15d413aad72d349ae959f88b2ac0f9426ea864a549127e1b19fe10bdfc5

Download Submit
C:\Users\Admin\Downloads\Cisco AnyConnect 4.9.0195\anyconnect-win-4.9.01095-core-vpn-predeploy-k9.msi

Filesize
14.9MB

MD5
ac37d288757434a5b2647d50664f8bbf

SHA1
1e03766bcc1b143d1531b1ef82afcb94743abdf8

SHA256
29448f083b2283f0093723fc3b994c6c3c2cf60a12293c1a46789eedb34a6215

SHA512
53c4e19b23c8e041867eefec46f065e677fa8a227a9ec1e7caf507a008a9bc6fa7777c860e6653205c3350481acd710760e371c7fca1f281d1b03771916a8cc0

Download Submit
C:\Windows\Installer\MSI41E3.tmp

Filesize
448KB

MD5
00f2517f894222ff9f3b53025ebb35ef

SHA1
a54933bce5c0ae2f2336d2085aeab68508709ccc

SHA256
be0544c916f7932d356b1ff47066ba17b7bf8a05b8f8b321d2e1cc48f8f3ba98

SHA512
96f02904f02048af87dda84e7e9bd12f908f809a5ebc94d52077d3434996baf6515d2b7765994c3b10487384a5224bcfdc5f0a4573890bd5459f67a2db11acd1

Download Submit
C:\Windows\Installer\MSI4437.tmp

Filesize
888KB

MD5
0baad6016a853e1f8d679bb806c4fd1f

SHA1
6f8b7658be119345a9775bc3bfe138fceaec3dee

SHA256
7cb824d870b9b0adee7234ce04fe4d73bbb476c328b62c844bf028d6aa02d31d

SHA512
3464f47400a53ba063d33e19ae4b69b4024056a4fe9f28fd1d2e2d6a21fa744506955bd6dd01071caaf54606a76f6e9e5d770497b35ccf4e31e980525a8d2044

Download Submit
C:\Windows\System32\drivers\acsock64.sys

Filesize
290KB

MD5
ae5158cc761a921d537887a9a88a197f

SHA1
e3c259c5cf3e70a3e509e4df4178da058073c856

SHA256
60a1558360e7a7f4fc279ef5cf95e3a5c2f45ac2de75fb01bffd9461be991fee

SHA512
81e8f2ba4766640a3c8a7b970f2e211de4ceee1993778bf246c1fa616ea7e3ada986bafbe5650f840719c527ed38e06e4f769a2082dc7d624dee2606f5ee0d0b

Download Submit