bumblebee | b8794c9251e2c6fbb96c458a5e1821ddd029335933dfbb03efa7db63673562e8

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/06/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpjm09jc9x.msi
Size 4.7MB
Sample260609-a8gr1sav3n
SHA256 b8794c9251e2c6fbb96c458a5e1821ddd029335933dfbb03efa7db63673562e8
MD5 e63911bf851f892bab6d3933349a987e
SHA1 c3f5bd1aca61bd086f1aea3e4b86419a836888ce
SHA512 f00874b37580152bbb563b29763212de0452e8117f54e4199150cb8cebf3f4d8d1c31ed28d896b7b0cbb63c17e8847019ed76b53f7c0ae07021527705e1af17c
SSDEEP 49152:37Vh102T9dhkuqES58NtvUoBV0Sccd2b5+pnQ2fP1r8+/J4OV7AEqj7D4Uv6ZCOX:37VTVkufFN0ScaruSmHR9vaXZTUa3vg
TLSH
T18E36CF2233EAC036E27F0676B93EDD665539BD360B61C0DB66D8392D18B0DC256B1723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

1 discovery bumblebee loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

bumblebee

Botnet

Attributes

dga
45urhm0ldgxb.live

gx6xly9rp6vl.live

zv46ga4ntybq.live

7n1hfolmrnbl.live

vivh2xlt9i6q.live

97t3nh4kk510.live

kbkdtwucfl40.live

qk6a1ahb63uz.live

whko7loy7h5z.live

dad1zg44n0bn.live

7xwz4hw8dts9.live

ovekd5n3gklq.live

amwnef8mjo4v.live

e7ivqfhnss0x.live

rjql4nicl6bg.live

4mo318kk29i4.live

zpo18lm8vg1x.live

jc51pt290y0n.live

rg26t2dc4hf4.live

qw9a58vunuja.live

ugm94zjzl5nl.live

mckag832orba.live

pdw0v9voxlxr.live

m4tx2apfmoxo.live

n2uc737ef71m.live

hkk3112645hz.live

ugko9g5ipa4o.live

8wgq2x4dybx9.live

h81fx7sj8srr.live

a4tgoqi1cm8x.live

kse2q7uxyrwp.live

mfwnbxvt9qme.live

x99ahfftf28l.live

9n6bmko47gxe.live

6l96lk6edlyf.live

st5j8zqdrppf.live

dxjeucbj4p0j.live

bnpuxnov7lhr.live

a8bxv8lqe1m0.live

yczi2ujcyyro.live

sbeo0cztn1kh.live

o337yf9fh4bf.live

zoki7ma89z7b.live

x2r9bglz76r7.live

wi1w9yu1vush.live

mtqdvzkai700.live

r6o2sj70m85m.live

ut6qohwra5lm.live

9yi98fh7usy1.live

kkpjp9jzbzba.live

whvffwd7zphw.live

uztmazsno4y5.live

i3iubj73c21c.live

b72o02l2ilc6.live

wom4o4cutfx6.live

fek3qya20lid.live

nhkvd56j82xw.live

midyxlu6b22f.live

vp9c9rziba2a.live

rkffupb7i1gv.live

8u7r35mu2e4g.live

3c2xflq8mztc.live

wswis3sptby1.live

9rib57u1zu3c.live

sv3pldc5gkdl.live

bmdcn5celetq.live

y3mpywhmem7t.live

avwtkc23ffmw.live

nvgirtryox1z.live

3rlfa7w0bz37.live

vy9u47oyzltu.live

ysdwk0l8xass.live

tbt0aqol3sp2.live

xqqoo0a8zk0w.live

nevkq7lku38l.live

5u42wjin0vfz.live

y626kbnryktm.live

5k9b8nmc0x8r.live

i18t3jshekua.live

4hk1bcnxbse0.live

si00bu9fv5he.live

g3in90m5caz2.live

f6s4n6w41oov.live

sgl7og2qswmm.live

vrrbk7ykz8h1.live

zl7bmlfq8n9w.live

qydstwmw2imy.live

y9s73mnvurxr.live

7zggkh833im1.live

cvnsiogvl3kt.live

enf3gev34gis.live

doj6z5i9g803.live

zsm954jr5ek4.live

6z96z4mk84dc.live

e0et68offggh.live

au97foecnlrm.live

3ibjpmls5x46.live

mmmpa1byo300.live

3e60zvd64d8y.live

zt3nnzr70hn0.live
dga_seed
7834006444057268685
domain_length
12
num_dga_domains
300
port
443
tld
.live

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	AnyConnect Installer.exe

Executes dropped EXE 1 IoCs

pid	Process
4208	AnyConnect Installer.exe

Loads dropped DLL 17 IoCs

pid	Process
1716	MsiExec.exe
1716	MsiExec.exe
1716	MsiExec.exe
1716	MsiExec.exe
1716	MsiExec.exe
1716	MsiExec.exe
1716	MsiExec.exe
1716	MsiExec.exe
1716	MsiExec.exe
1716	MsiExec.exe
1716	MsiExec.exe
7128	MsiExec.exe
7128	MsiExec.exe
7128	MsiExec.exe
7128	MsiExec.exe
7128	MsiExec.exe
5788	MsiExec.exe

Badlisted process makes network request 36 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
179	5788	MsiExec.exe
186	5788	MsiExec.exe
188	5788	MsiExec.exe
193	5788	MsiExec.exe
198	5788	MsiExec.exe
200	5788	MsiExec.exe
206	5788	MsiExec.exe
208	5788	MsiExec.exe
212	5788	MsiExec.exe
214	5788	MsiExec.exe
216	5788	MsiExec.exe
222	5788	MsiExec.exe
224	5788	MsiExec.exe
225	5788	MsiExec.exe
238	5788	MsiExec.exe
245	5788	MsiExec.exe
247	5788	MsiExec.exe
251	5788	MsiExec.exe
255	5788	MsiExec.exe
257	5788	MsiExec.exe
259	5788	MsiExec.exe
261	5788	MsiExec.exe
264	5788	MsiExec.exe
266	5788	MsiExec.exe
268	5788	MsiExec.exe
270	5788	MsiExec.exe
272	5788	MsiExec.exe
274	5788	MsiExec.exe
276	5788	MsiExec.exe
278	5788	MsiExec.exe
280	5788	MsiExec.exe
282	5788	MsiExec.exe
284	5788	MsiExec.exe
286	5788	MsiExec.exe
288	5788	MsiExec.exe
290	5788	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1139950850\manifest.json	msedge.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e587d68.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DB7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F50.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI804B.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5B2892F8-A2A6-49F8-BA11-A5C777D0FEE1}	msiexec.exe
File opened for modification	C:\Windows\Installer\e587d68.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7EB2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F01.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI80F8.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4068	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5032	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134254400073829722"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{EFC186E3-92A4-4019-93C5-B1960C0273B3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5048	msiexec.exe
5048	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4068	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4068	msiexec.exe
Token: SeSecurityPrivilege	5048	msiexec.exe
Token: SeCreateTokenPrivilege	4068	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4068	msiexec.exe
Token: SeLockMemoryPrivilege	4068	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4068	msiexec.exe
Token: SeMachineAccountPrivilege	4068	msiexec.exe
Token: SeTcbPrivilege	4068	msiexec.exe
Token: SeSecurityPrivilege	4068	msiexec.exe
Token: SeTakeOwnershipPrivilege	4068	msiexec.exe
Token: SeLoadDriverPrivilege	4068	msiexec.exe
Token: SeSystemProfilePrivilege	4068	msiexec.exe
Token: SeSystemtimePrivilege	4068	msiexec.exe
Token: SeProfSingleProcessPrivilege	4068	msiexec.exe
Token: SeIncBasePriorityPrivilege	4068	msiexec.exe
Token: SeCreatePagefilePrivilege	4068	msiexec.exe
Token: SeCreatePermanentPrivilege	4068	msiexec.exe
Token: SeBackupPrivilege	4068	msiexec.exe
Token: SeRestorePrivilege	4068	msiexec.exe
Token: SeShutdownPrivilege	4068	msiexec.exe
Token: SeDebugPrivilege	4068	msiexec.exe
Token: SeAuditPrivilege	4068	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4068	msiexec.exe
Token: SeChangeNotifyPrivilege	4068	msiexec.exe
Token: SeRemoteShutdownPrivilege	4068	msiexec.exe
Token: SeUndockPrivilege	4068	msiexec.exe
Token: SeSyncAgentPrivilege	4068	msiexec.exe
Token: SeEnableDelegationPrivilege	4068	msiexec.exe
Token: SeManageVolumePrivilege	4068	msiexec.exe
Token: SeImpersonatePrivilege	4068	msiexec.exe
Token: SeCreateGlobalPrivilege	4068	msiexec.exe
Token: SeCreateTokenPrivilege	4068	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4068	msiexec.exe
Token: SeLockMemoryPrivilege	4068	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4068	msiexec.exe
Token: SeMachineAccountPrivilege	4068	msiexec.exe
Token: SeTcbPrivilege	4068	msiexec.exe
Token: SeSecurityPrivilege	4068	msiexec.exe
Token: SeTakeOwnershipPrivilege	4068	msiexec.exe
Token: SeLoadDriverPrivilege	4068	msiexec.exe
Token: SeSystemProfilePrivilege	4068	msiexec.exe
Token: SeSystemtimePrivilege	4068	msiexec.exe
Token: SeProfSingleProcessPrivilege	4068	msiexec.exe
Token: SeIncBasePriorityPrivilege	4068	msiexec.exe
Token: SeCreatePagefilePrivilege	4068	msiexec.exe
Token: SeCreatePermanentPrivilege	4068	msiexec.exe
Token: SeBackupPrivilege	4068	msiexec.exe
Token: SeRestorePrivilege	4068	msiexec.exe
Token: SeShutdownPrivilege	4068	msiexec.exe
Token: SeDebugPrivilege	4068	msiexec.exe
Token: SeAuditPrivilege	4068	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4068	msiexec.exe
Token: SeChangeNotifyPrivilege	4068	msiexec.exe
Token: SeRemoteShutdownPrivilege	4068	msiexec.exe
Token: SeUndockPrivilege	4068	msiexec.exe
Token: SeSyncAgentPrivilege	4068	msiexec.exe
Token: SeEnableDelegationPrivilege	4068	msiexec.exe
Token: SeManageVolumePrivilege	4068	msiexec.exe
Token: SeImpersonatePrivilege	4068	msiexec.exe
Token: SeCreateGlobalPrivilege	4068	msiexec.exe
Token: SeCreateTokenPrivilege	4068	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4068	msiexec.exe
Token: SeLockMemoryPrivilege	4068	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4068	msiexec.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1716	5048	msiexec.exe	89
PID 1716 wrote to memory of 4208	1716	MsiExec.exe	104
PID 4208 wrote to memory of 2080	4208	AnyConnect Installer.exe	107
PID 2080 wrote to memory of 4900	2080	msedge.exe	108
PID 2080 wrote to memory of 5032	2080	msedge.exe	111
PID 2080 wrote to memory of 764	2080	msedge.exe	112
PID 2080 wrote to memory of 764	2080	msedge.exe	112
PID 2080 wrote to memory of 764	2080	msedge.exe	112
PID 2080 wrote to memory of 3920	2080	msedge.exe	113
PID 2080 wrote to memory of 3920	2080	msedge.exe	113
PID 2080 wrote to memory of 2188	2080	msedge.exe	119
PID 2080 wrote to memory of 4568	2080	msedge.exe	115
PID 2080 wrote to memory of 2188	2080	msedge.exe	119
PID 2080 wrote to memory of 2188	2080	msedge.exe	119
PID 2080 wrote to memory of 4568	2080	msedge.exe	115
PID 2080 wrote to memory of 4568	2080	msedge.exe	115
PID 2080 wrote to memory of 432	2080	msedge.exe	117
PID 2080 wrote to memory of 432	2080	msedge.exe	117
PID 2080 wrote to memory of 432	2080	msedge.exe	117
PID 2080 wrote to memory of 2768	2080	msedge.exe	118
PID 2080 wrote to memory of 2768	2080	msedge.exe	118
PID 2080 wrote to memory of 2768	2080	msedge.exe	118
PID 2080 wrote to memory of 3948	2080	msedge.exe	120
PID 2080 wrote to memory of 3948	2080	msedge.exe	120
PID 2080 wrote to memory of 5208	2080	msedge.exe	121
PID 2080 wrote to memory of 5208	2080	msedge.exe	121
PID 2080 wrote to memory of 5884	2080	msedge.exe	124
PID 2080 wrote to memory of 5884	2080	msedge.exe	124
PID 2080 wrote to memory of 5884	2080	msedge.exe	124
PID 2080 wrote to memory of 5892	2080	msedge.exe	125
PID 2080 wrote to memory of 5900	2080	msedge.exe	126
PID 2080 wrote to memory of 5892	2080	msedge.exe	125
PID 2080 wrote to memory of 5900	2080	msedge.exe	126
PID 2080 wrote to memory of 5204	2080	msedge.exe	129
PID 2080 wrote to memory of 740	2080	msedge.exe	130
PID 2080 wrote to memory of 740	2080	msedge.exe	130
PID 2080 wrote to memory of 5792	2080	msedge.exe	131
PID 2080 wrote to memory of 5792	2080	msedge.exe	131
PID 2080 wrote to memory of 5512	2080	msedge.exe	132
PID 2080 wrote to memory of 5512	2080	msedge.exe	132
PID 2080 wrote to memory of 5664	2080	msedge.exe	133
PID 2080 wrote to memory of 5664	2080	msedge.exe	133
PID 2080 wrote to memory of 5340	2080	msedge.exe	134
PID 2080 wrote to memory of 5340	2080	msedge.exe	134
PID 5048 wrote to memory of 7040	5048	msiexec.exe	137
PID 5048 wrote to memory of 7128	5048	msiexec.exe	139
PID 5048 wrote to memory of 5788	5048	msiexec.exe	140
PID 2080 wrote to memory of 6152	2080	msedge.exe	141
PID 2080 wrote to memory of 6160	2080	msedge.exe	142
PID 2080 wrote to memory of 6172	2080	msedge.exe	143
PID 2080 wrote to memory of 6740	2080	msedge.exe	146
PID 2080 wrote to memory of 6740	2080	msedge.exe	146
PID 2080 wrote to memory of 5764	2080	msedge.exe	148
PID 2080 wrote to memory of 5764	2080	msedge.exe	148
PID 2080 wrote to memory of 5252	2080	msedge.exe	150
PID 2080 wrote to memory of 5252	2080	msedge.exe	150
PID 2080 wrote to memory of 5644	2080	msedge.exe	151

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpjm09jc9x.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4068

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9302955B1F7BD0ECB3372157B9909FE8 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Users\Admin\AppData\Roaming\Cisco Systems\Cisco Anyconnect\prerequisites\Cisco Installer\AnyConnect Installer.exe
    "C:\Users\Admin\AppData\Roaming\Cisco Systems\Cisco Anyconnect\prerequisites\Cisco Installer\AnyConnect Installer.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9WZDNCRDJ8LH?ocid=&referrer=psi
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x294,0x2c8,0x2cc,0x2c4,0x35c,0x7ffef93dc188,0x7ffef93dc194,0x7ffef93dc1a0
        5⤵
        
        PID:4900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,4785781530376206447,109740409940739736,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,16268834067234173272,236128713989966877,262144 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
        5⤵
        
        PID:764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,8832265578227703066,6940667796935227184,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:8
        5⤵
        
        PID:3920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,13813405654293399795,3431719330462092352,2097152 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
        5⤵
        
        PID:2188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,15928215900713089917,16845904586650868168,2097152 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
        5⤵
        
        PID:4568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,15719096814161290360,12659900238642408135,2097152 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
        5⤵
        
        PID:432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,18166738242285052630,16228273696903618128,2097152 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2
        5⤵
        
        PID:2768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,8488611441950514789,10952736525680451543,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
        5⤵
        
        PID:3948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,4923504522217116482,13865346880840116854,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:8
        5⤵
        
        PID:5208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5196,i,860240614666599936,10365146446727363050,2097152 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
        5⤵
        
        PID:5884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,1040230030573347082,6990969690421435527,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
        5⤵
        
        PID:5892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,6563131582513211069,7176280168980491512,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
        5⤵
        
        PID:5900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,4933986080308744867,2623940518381696865,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
        5⤵
        
        PID:3432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,4933986080308744867,2623940518381696865,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
        5⤵
        
        PID:5204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,4853546901261806932,12705240244114231971,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
        5⤵
        
        PID:740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,2452519117387127674,8593480015796298523,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
        5⤵
        
        PID:5792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,6387001589041685506,7119731063303255641,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
        5⤵
        
        PID:5512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,9965326373605893313,15265907346390323964,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
        5⤵
        
        PID:5664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,15362626729748994082,4193608163893509469,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
        5⤵
        
        PID:5340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,11611925952321782154,2919087591749044561,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
        5⤵
        
        PID:6152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,9695766956630861326,2677963937945959654,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
        5⤵
        
        PID:6160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,898577336783258375,1965054788480145695,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
        5⤵
        
        PID:6172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,16770569222288349255,13211936498907949922,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
        5⤵
        
        PID:6740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,17371239668111109375,13612328656438158034,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
        5⤵
        
        PID:5764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,16975577205968183634,14270873580059494217,524288 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
        5⤵
        
        PID:5252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=856,i,1673628725866297263,1628432116766298054,262144 --field-trial-handle=2328,i,9086072230663729938,15359213321477814994,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
        5⤵
        
        PID:5644
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:7040
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3F0821D7630B5EC02E75508B18A9C7BD
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:7128
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Users\Admin\AppData\Roaming\BmgqLbJUHL.dll"
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  PID:5788

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe
1⤵
PID:2584

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3984

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:2188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2080_1139950850\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 bc0067a8bf38741f79cb9eddb8c4728000113f3f284c7ba5d4623c7936636905
MD5 9b81d05891a216439a7fce5a2b98e659
SHA1 711fe92cf85f1ee07dc1f282f9a824adf149f239
SHA512 859d2a907c801ba2875863503266fc4c91d0bd3530cc752556c6c651424a256509bef46905e212fdc5b46a72e0bcdbef86e5868a7009ee88cb8111a73c0042e8
SSDEEP 96:Wb+vjgqvHGP27PI4W5aIUIG/cItA/M4l16mroy7bsc+s/jU8Va5m+GwYZPj2dg8E:Wb+vjgqvHGP27PrW5aIUIwcItA04l16i
TLSH
T156B15FF40472C3B1D3AA52B159D61FCD34337DF8F41B2E533AC288B2A6A4B364641056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58bbd9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bbd9.TMP
Size 3KB
SHA256 2aea7e0ffbdb8b5633c65467314d9d08d024c26cd51e8ef277a24b8f1d0978c3
MD5 b447a6303214dcd866971217e2fa2a1a
SHA1 9017b511f41b1c48e9397db7300fc6f01afd570b
SHA512 884b8ed97dc4ef886de568adce1e899f245ce680be3f85609558fba0e490de2c559b949b297218048513e56cf4a1793099c5cf097af849146ad6e4bb45086de2
TLSH
T1AB7128340572C3B1E7AA02B19DD72FCD34724CF9F51F6E933890C8B6A6A8F144645147
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ebadcee52423d2370dad43e573136021cd04b593cd3c8866f56017fcffe1d2e6
MD5 f9d9e3922c2610a178d261d4cec834d9
SHA1 16baac0463483776fa1ab5cadc77610319536f51
SHA512 7f2ad597b78166c8e91ab578e35e2b76081d314a7f7cbcd610484badc89d613ba5fb8abb4620a89fb0631a556d680697ca4815b86a10d7bdb477f168c07d42f1
TLSH
T1CD518CF783B5856E8A0196F0A618EE2FDE2C0615431C7C6989D4EE17D7E3472E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9d54029a871aa0d16a0005dfdcaa4e9f2e38e37319b27aaf0cf2f5772c999fdb
MD5 599d420b8221ace2132e8c68407dfaf0
SHA1 4a2d1626afd4ddd95d13cbd80b5c9eb439dd64b7
SHA512 1ad882f1545bff52eb280794335bc3ede9031b7045478a1e71e3cca01302ef920d204e96ecf744e04a68c7715bb1e4ae5ec4d6cb8e4389a61effcac40e80e42c
SSDEEP 192:sxZaRByM/jK1Ml8Miu/fwsrX7rEdpwJHW6+WNtM7/YXMKDCPrA+SIg4J:sxZaDqu/fwsrX7osHbi/HApc
TLSH
T1D352D812AA3499B7CCDBD209F551BB57D6F55573D6900E489AFCDA0C00F6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 745e311e9b3b33c113e977b8aa2cd35338fa00706e8876cc36632429a2bd132b
MD5 1cc6e64c8cc466cccfd46b147320f129
SHA1 98fe52c6a825614587eef66f898eb093d657160a
SHA512 dc068a80e238c52d875cf79696b5e7a4da5c718b04a238cdd51611e8115f86b4bfd9ddeb3cc4687fc54696e83250cff59d440e6195eb6de6b681043a41bd6a0a
SSDEEP 768:lS8bqC+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVwZLlRTKVKroZ:lS8bqC+WvSCt6u1jajZLbWVhZ
TLSH
T1C8E20A3B280CCB7E4F845E5DEC26AF962ED801CB67988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\e1883754-95ab-408b-b9c6-82b204700566\index-dir\the-real-index
Size 72B
SHA256 0fbdfd57bb8867cf4f0e513da0672e0dfa5fa7afaab57515309cc94237e828bc
MD5 a4b17df890636d7fcfdb6d67e94304f3
SHA1 5df690f409b98c270abba258cb569858f223864c
SHA512 b8e2c883844e3b1e067004df8aa4430a4427b4e875a2fd8ca07e77db435d821bb4280abf353f1d7e402b52465f45a2daff979490840b0c86bb2dd27e53234ee4
TLSH
T126A00251D945C135C195C3B91071099F221298D90B11030261F401DD8D747A54151232
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a0b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\e1883754-95ab-408b-b9c6-82b204700566\index-dir\the-real-index~RFe58a0b0.TMP
Size 48B
SHA256 8ca7aa040b1ea852792772f955fa87b0c593426b656aa783007205897c5249f9
MD5 00d5425009442e5c54f0083eee9b135d
SHA1 5e9ece80f4dfb9050f876d8eead57616f22e76ba
SHA512 d4a725783808d21e2e05abff4d7e7213ba864bca295953fccbb0f6160cbccb96577febfc8444cd48660e1f93b79098cdf0faffb2e6edc0be9dda5814d399a1c7
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\ef0af83a-538b-48a7-b647-e8faae884900\index-dir\temp-index
Size 3KB
SHA256 48868b38d01e2323b37c7bae058ac38c3d7b6b964a9dab3dc2b717c6a49295b9
MD5 c7caedb8dfab653ecd4c1482d809f185
SHA1 491b31268d4b9ac8ac75a2d3c458f5d986e09b9c
SHA512 f9aeaa0ec892ebe39dc324fc6f42551e7cd72de4120e9cda0ce844fd46c8e1dcaa7ef6325f8fb90cff32ee111aa7e77deee45bd53d5985d2668d12f5264056b8
TLSH
T11071D7853D999FB0D3AD8033D0FC305ECAA86BEECA061B1E456D43A02B575551391167
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b706.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\ef0af83a-538b-48a7-b647-e8faae884900\index-dir\the-real-index~RFe58b706.TMP
Size 48B
SHA256 c4716c4db81c6e6870c96f4e85bf06f0390d59fc37f524e016b06b51a3ed57b8
MD5 a92b246d15bbf81122de1e3035929603
SHA1 0e74673011d59891c2ed479e86403cb3bf48129e
SHA512 4b5455929fff2db8e5fce4bb50a5096ca7e841a7ff447240bb3090a8f405ffa678d9775030a906d6b814bef3b4699d98ace94b6dfa029d6f7df175d0a44974c6
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 383B
SHA256 fbb5fbd038760bed59d3857b1064f8aa8031d746e565cb728414cbcf0fb77858
MD5 8be589a9b64f1f3fc2a0dd163c2c34b0
SHA1 e491d9e64f4d0e18a0f9bcfb06fd2385a0c31bb8
SHA512 77348fd6dd8c48c342a25cb04f165e14dd40f858f7c4279f5eb61855cc7092ce8ac0b94a05b18dff65874ae55426c3b6a209f94957d08bc97ea55315e27bec3a
TLSH
T1CCE06117513381119B7159DD2ED5F668C83F27439950EE1D40C492530CAB96F5563F42
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 386B
SHA256 8d5fe09e86225ad579cf9f17d14061baf054a48a5f4d160c556f079278d28e0e
MD5 fdf7dd21e7781ebe40fb97a697292353
SHA1 bedc535c05d97524639354b087fd66c1b41b82a1
SHA512 a0ea33b4ba994419e41429c2f7d0f1fb2e4316c5480dbb2998983649ee8a15ff1abf6645031069e9d69ba891d956f1dce7d46760a8545a36392e4d033318b23b
TLSH
T1A8E068176132851297B519DE2ED0F2A8D83F2F435960EE1D40C8B1420CBB96E96A3F52
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe585290.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt~RFe585290.TMP
Size 195B
SHA256 310710ee346a303413f451b9340fe44643cded567ad2f3424a29b513b98d527f
MD5 b67665446d7fedc06b45cb6e5fdcc560
SHA1 a1a4373d62dd22183de1fb31df29d2e01fc708ef
SHA512 56c006a3ad50bd70129bdb97d0d8398cc45e069ba860c89a3063b34e25db51319a89ca51c2326a9379b09513a2e2b7f67355edae5007bce11518122dee46affd
TLSH
T1CDD02287403280028B902AA32F91F2C8E82F1F8328E0CCA984C9B2900C7624E4282A96
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 190bf06db83efb4fea2864514b3ec0822001b71f26cd92fa5bc57252d3acf2e8
MD5 adcc9e52f540bc14667bc875bb35f922
SHA1 b9c88d2ed0bb3fd6f92a44d14a2d5c731c50730a
SHA512 3269541f220c59b091b9f6dd783964a391ff79312f5a788ebd0504155ca3e49c5c3d17697155e9d0f7a62b7098157303bdcfb2d042abbd592fe8066e23e8fe5c
TLSH
T189A0021303E79073C1101371D44511CCB2309A6547411253D4E848B48CA13735152849
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a062.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a062.TMP
Size 48B
SHA256 fdb9086a9d39171bedd69767634d7527ded8a1fa01daf7237a40862e30cad5be
MD5 2a913f67263829bb19d0faed13a3e539
SHA1 7d0592af9eb7562884ee34ea1160f2dbd458336c
SHA512 4adfa845e7578a9763f86df04a075fc2f61df903e1f658ab14587e719b52974361b92a46225b09ef433328e585144e75b87fe4fd2f9caf7d3002bacaff0e67dc
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 33dcb9f9414f4335e95aba53178cd3538552a9d763961fcd0dbe76b440efacdb
MD5 7ccce7b85a7853efc82a6d3435b73533
SHA1 f6e637663230f27f32588849b513d411b0cd549b
SHA512 050da664cb29206d2d95487653d6ea36029dc0e1acb6ccdc40b8ddfa9203b89635832620c63e3e613a351200110300dfaef4f1099411e80518b625ca2428a6f3
SSDEEP 48:KwZIFKCwwPyNlIpKuEsKcILKRKkTyEufa+QUP:KwZ2KCwiWliKuE1cAKRKqQ
TLSH
T12B916402303E12013C7E6A0C9195E92B8D4275777529AD7F7BE871A25F26E612DFD8CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ab984f2-f5e2-46ba-b3f9-c43053037fea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0ab984f2-f5e2-46ba-b3f9-c43053037fea.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 810cd437af3202bac93af04427344a1b1d622ae9773ba001c7ff13aa83037e15
MD5 dca0b9887f6b8bae35a597c5698101dd
SHA1 5bb349b462a8e79c4c15c4c75f477eff051709f5
SHA512 d8b102ed2388b161744083df1b2cec8f7909a4a46d6f0585c7c2612abadf51e043e6e7169b8e4715c434ba735c369d443385baa390129efc79f3d1eb6bcad9e6
SSDEEP 384:nntNn/s3n9SfsNyULW8ThoEa+wOS7+2qB3AwWyvTx9U:nj+9UpKra1OS7lqVgyrvU
TLSH
T1E1928D3568289C774EE6A444F54B3B9B5FF400BB85862E99D5D9EF0D00DB39C230BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0bdd9bae29c3f514391e641155142863d10d15214142e630350bb1ca33cb3693
MD5 791469c08649e8e5ed16b0a32a1a5048
SHA1 9622301669f809222def804d7aecf6897e0678a2
SHA512 cb6cee411f1148cdbac865154044c73d586d68e863276617fd37d8a95ae6cfd53c70436b98dccc6730105d3219b273d669b575cc2763c57a54327a0cac668924
SSDEEP 384:nVtNn/s3n9SfsNyUCW8ThoEa+wOS7+2qB3AwWyvTx9U:Vj+9UyKra1OS7lqVgyrvU
TLSH
T105928D3569389C770EEAA444F54B3B9B5FF400BB85862E99D5C9EF0D00DA39C231BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a73bfca1487129037a59ce1e20a195b7a51e21e77e16ac6edc703afc06b48be2
MD5 3ac20b2dbfb1cbb6691db3aed45643e1
SHA1 765c758050ef583965978b8c10fda738bd2e38d7
SHA512 a4708d82f52c2e424a06580afbd8f1ddd883c4aaa67aa70ea0845b4732509628fb14ef10efc825536014af5875ad3890ab3afc6914f087c215bb79d951a5b6a0
SSDEEP 384:nYiF1tNn/s3n9SRozsNX8TUNTUlIlLW8ThoaDfYxa+wOS7+2ZB3AwWyvTx9U:jF1j+9xuwg4KQxa1OS7lZVgyrvU
TLSH
T129B23A36D864CE7BADE687C5F64B779B9EE000A385896DD8D9C9AE4C00C72DC130BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9f9ccd37a5a7d4dbb2d37664eb5009875e90a12d0b66c3d513b3d70b60d5278c
MD5 5443bdf32d1bf70df9596581ee597cd0
SHA1 447d45db91e68cf9db1b7f79c6ec1c3694072ec5
SHA512 9b5bf5dee10344284f4d91bcc98c52f2ea68601cb07e686be26b0677fb69c0fd0ba816ffa37a249e8e3146fcc55955e7fdd916fecad581b09883578495998c7b
SSDEEP 96:EqONkEQsjpf1bxX5ih/cIPURHl8h4otop5/nDjBfPgvE5BzatIRdy+jCOmhsR1Ra:vONw6Db6QmiUy79HBa+jcOmiRqRgsbU6
TLSH
T1D902E73568786CBB9EB26E49F88B37276FD4103B9A966F44D6D81F0C00D765C230783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a38230d9ddf230008a6775ca6029e68e2d199a32f0ba02ee8404e518b4fcd9f8
MD5 0e819298b12271703d07058eb4952b40
SHA1 11e6169192943f8cb8e865a0e8201e7d34dc3705
SHA512 80781e6fd34fdd592a96d76fb75989a36a7989b5359ae499a01dc57d53a97c33cbfa74986d5dafb5d7453bb2622618d74f236166c4db03e3ca105c4967f041e0
SSDEEP 192:vONA6Db+QmiUye9YBa+jcOmiR67+2sNzKqrl3U6:vONA6iXYBa+wOS7+2sB3U6
TLSH
T17512F635687C9C775EE2A944F48B3297AED82077D986AF95D2D85F0C00D768C234F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

372c50d7-7cbe-4785-8218-8d185287fe3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\372c50d7-7cbe-4785-8218-8d185287fe3f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 070befbeffd40cfc7185f5b1ed0474c7e16c5bc4c0e644685a284362a695625b
MD5 a49e591a415f9dd77a7753c46e5c655c
SHA1 beba70d84477000668a8cc7164c6608b52245235
SHA512 1cb2d6729a5b4f8c6a02cb7728ed07746547463e37339a2854f240b5873fc0f35e6a1097f8a65c3cdd59ce09cfe923086a2174a89fdad387348515cd1455da9d
TLSH
T14841076CBAEA5148F3B76F1AABF6786D447F7D672E07D45D10010E4E0622A40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

854c0ee2-a4cf-4800-b57d-2261d7317020.tmp

Path C:\Users\Admin\AppData\Local\Temp\854c0ee2-a4cf-4800-b57d-2261d7317020.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID60D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSID60D.tmp
Size 816KB
SHA256 8d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1
MD5 aa88d8f40a286b6d40de0f3abc836cfa
SHA1 c24eab9e4b10b159b589f4c3b64ef3db111ea1c8
SHA512 6c2f2f6a2d66015f30158962d653e381136f0f30023380a0ce95bd0944d856113fbde65db52dbb3b5de1c0e2edf2cd53184e721c64b916834be4198c61224519
SSDEEP 12288:3nre4I5heqAlr0TQG21EX4Ttph0lhSMXleTueml5P96jJtvU0:3ryDzAlr0ufTPh0lhSMXl0uN58NtvU0
TLSH
T116056D3339AAC126E37E05B02A3EDA5B693E7A650BB144CB53D41E2E2570DC26735F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID8F0.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSID8F0.tmp
Size 877KB
SHA256 7118cd0d6956c84dc8ede10db84491d7884bfb0baa4a0ab96afc7eea47f46dd0
MD5 6a639b68fe7f4e67b7510af13403772b
SHA1 255ba543d6fdd8f037823ff321ec00abe3575c54
SHA512 43cfa4cdf669df71d7da59669ec9653c4facba4c2e6fe52deada469116b5c8b63a927a9ddc2f240ca9e1a2cc4335c12936007662bf47cd11c7e61392af219cef
SSDEEP 24576:VQ6ico5krSkZtX0HyZemYh0lhSMXl4s2b5ulpnQ2fP1N:7BV0Sccd2b5+pnQ2fP1N
TLSH
T129157C70358EC022F1AD51B1762FCE7BE1ADAA760F7184DB67D0BD2A65308C21A35E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp30DF.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp30DF.tmp
Size 1KB
SHA256 28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6
MD5 a10f31fa140f2608ff150125f3687920
SHA1 ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b
SHA512 cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12
TLSH
T10F21CA2FA1324D9E49BDF27D4C0B0CFE85260FB792F4960217541E12B04DD548AF8C4D
MD5 SHA1 SHA512 TLSH

Submit Download

b0bd8d9f-4e55-41ef-9e36-e3bd395d84a0.tmp

Path C:\Users\Admin\AppData\Local\Temp\b0bd8d9f-4e55-41ef-9e36-e3bd395d84a0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2080_17928784\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88282255-84c3-49c5-a25c-81f468a2d6ab.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2080_671847923\88282255-84c3-49c5-a25c-81f468a2d6ab.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BmgqLbJUHL.dll

Path C:\Users\Admin\AppData\Roaming\BmgqLbJUHL.dll
Size 2.1MB
SHA256 3844008c0697a64633357ba8d7088ee41e36ac321969bb442b97eb31e530e4a6
MD5 29e117e9f0ce89cb29a3b14f39a2624b
SHA1 1c1060ef434826f6785ea248b647da569e83cd6a
SHA512 757ac09a94ac4b434daeaf19509183e778208c5b82865e877ee25027080fb367a0e6a177a2ebb0e10dff1307975efb0d45b81568866bec478beca59bd822ab45
SSDEEP 49152:Qa3kz96wkTimJGCqHpRHVaIF1wvdGNPM:QzklcVVkdv
TLSH
T1D1A5AD4BD6374FBBE666C0FEE9A69D179314900BEBE713A1108DD429B0C724107D3B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnyConnect Installer.exe

Path C:\Users\Admin\AppData\Roaming\Cisco Systems\Cisco Anyconnect\prerequisites\Cisco Installer\AnyConnect Installer.exe
Size 1.0MB
SHA256 ffa9df9f2ee9b98a9c9d2edf1521d2e8b952f58e1382cc1d84964d0054564091
MD5 5e9965bc72df9f663ca049d40b1fa3af
SHA1 3fb8de364e3e67f093c1a6c73dc0cac1fd9b2202
SHA512 418abf3447f885a8fee31cf367a83264eaedfa8a90cd30684f9291d9c37c402595e5f782aa8335bc081adf8f2b18b45171a52d846b48c372a00013da64b61339
SSDEEP 12288:qvUGQWpy+Tac0RDffXJjyYpcyoNHSy5viczPESsQ3BaE32VfXJjyYpz:lGQB+2DR7BWYpcyo44u0aPVBWYpz
TLSH
T1C3354C9123FC4439E7B70B39BD7A58610735BC395942E5AE098E293C18F2B1689F2737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 78c5ad8645330b00734f84be7df04d35e759bee14f9c755d7dc8aa84afb82f10
MD5 b567f3ac93f073f7c68805d19471e756
SHA1 d21c90b9d8a56cef76fe6c91b6c3861287b47378
SHA512 42c42d661241828727c384bb5e97c0ff43d930db5f53ab7c23e25c6edbefe2bc566cd11dbcc69c1360079d19c9f125c2ad75fee7149dddabab3ec6805caff551
SSDEEP 24576:Ou8m+1zEdoO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:t
TLSH
T19247B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{efd07e34-39ad-4fe9-92a5-3c851bf20628}_OnDiskSnapshotProp

Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{efd07e34-39ad-4fe9-92a5-3c851bf20628}_OnDiskSnapshotProp
Size 6KB
SHA256 71ddb33d20ef746058645d03d7a57981bec394b2eb48e1346b08da2a5897de83
MD5 489753dcc5b1862600132a1499134c3e
SHA1 1cca5388b2d20f3c3af855d9e161043550606f9a
SHA512 8e67c6b1d88265f445c8a7b70ff65ccc7f37f41a6355aa28ddf048a837e0e16d2f75185d53fc5422fe1a4fd48d7ee51ee6ff52fba8ecdbc7f538079ad6de1e5e
SSDEEP 96:Fn27ELJrGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:IY1GPGnb++ZVmN
TLSH
T1C4D198085AF54711E2B3AB7129F14557A877B911EF33CB8E0298638E2670A10F835F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4208-71-0x000002C949F90000-0x000002C949FCC000-memory.dmp

Download

memory/4208-56-0x000002C949CE0000-0x000002C949CEA000-memory.dmp

Download

memory/4208-78-0x000002C94DB60000-0x000002C94DC62000-memory.dmp

Download

memory/4208-76-0x000002C94DFC0000-0x000002C94DFE6000-memory.dmp

Download

memory/4208-72-0x000002C94A980000-0x000002C94A988000-memory.dmp

Download

memory/4208-73-0x000002C94CC40000-0x000002C94CC78000-memory.dmp

Download

memory/4208-57-0x000002C94A690000-0x000002C94A74A000-memory.dmp

Download

memory/4208-70-0x000002C949D30000-0x000002C949D42000-memory.dmp

Download

memory/4208-74-0x000002C94AB10000-0x000002C94AB1E000-memory.dmp

Download

memory/4208-55-0x000002C92E080000-0x000002C92E182000-memory.dmp

Download

memory/4208-75-0x000002C94DCF0000-0x000002C94DE76000-memory.dmp

Download

memory/5788-1014-0x00000221060D0000-0x00000221062EE000-memory.dmp

Download

memory/5788-1013-0x00000221060D0000-0x00000221062EE000-memory.dmp

Download

memory/5788-1010-0x00000221060D0000-0x00000221062EE000-memory.dmp

Download

memory/5788-1011-0x00000221060D0000-0x00000221062EE000-memory.dmp

Download

memory/5788-1012-0x00000221060D0000-0x00000221062EE000-memory.dmp

Download