Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-06-2024 15:44
Static task
static1
Behavioral task
behavioral1
Sample
em_Kia5weA1_installer_Win7-Win11_x86_x64.msi
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
em_Kia5weA1_installer_Win7-Win11_x86_x64.msi
Resource
win10v2004-20240226-en
General
-
Target
em_Kia5weA1_installer_Win7-Win11_x86_x64.msi
-
Size
93.9MB
-
MD5
a295cf96ebabdfa1d30424e72ed6d4df
-
SHA1
7d5fb6b88051115b59f47dadb49ea8114cdf5c4b
-
SHA256
f4d1b970bc9e5d319c5432be9e3863b5a20bf26e557c8cea6f3949df0012cf01
-
SHA512
b098929b66bdfa26e26e7965f6166cc5f008d09bf913d172c84aed2b631b9b6a2aa71739d36705509343d644c69b71d91dfd9ccabc948b858377ebe5a36d80e9
-
SSDEEP
1572864:ofSCYWHh+jXJ16YaOPnGJ52t8/MdYs3iR7cGY+v5mK//pHKH3LgjmWDCZT3V5cR+:kSC/B+7L68nGJ5GLdn3Mh/pHeUj7DCpt
Malware Config
Extracted
redline
@DolphinLoader_Bot
157.90.5.250:18637
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2932-6088-0x0000000000090000-0x00000000000E0000-memory.dmp family_redline behavioral1/memory/2932-6090-0x0000000000090000-0x00000000000E0000-memory.dmp family_redline behavioral1/memory/2932-6089-0x0000000000090000-0x00000000000E0000-memory.dmp family_redline -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
Ft.pifdescription pid process target process PID 1428 created 1148 1428 Ft.pif Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\ITarian\\Endpoint Manager\\ITSMAgent.exe" msiexec.exe -
Blocklisted process makes network request 4 IoCs
Processes:
msiexec.exeflow pid process 3 2276 msiexec.exe 5 2276 msiexec.exe 7 2276 msiexec.exe 9 2276 msiexec.exe -
Checks for any installed AV software in registry 1 TTPs 8 IoCs
Processes:
ITSMService.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm ITSMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm ITSMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS ITSMService.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS ITSMService.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm ITSMService.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\ ITSMService.exe Delete value \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity ITSMService.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity ITSMService.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in System32 directory 16 IoCs
Processes:
WmiApSrv.exedescription ioc process File created C:\Windows\system32\perfh009.dat WmiApSrv.exe File created C:\Windows\system32\perfh010.dat WmiApSrv.exe File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h WmiApSrv.exe File created C:\Windows\system32\perfh007.dat WmiApSrv.exe File created C:\Windows\system32\perfc00A.dat WmiApSrv.exe File created C:\Windows\system32\perfh00C.dat WmiApSrv.exe File created C:\Windows\system32\perfc00C.dat WmiApSrv.exe File created C:\Windows\system32\perfc010.dat WmiApSrv.exe File created C:\Windows\system32\perfh011.dat WmiApSrv.exe File opened for modification C:\Windows\system32\PerfStringBackup.INI WmiApSrv.exe File created C:\Windows\system32\PerfStringBackup.TMP WmiApSrv.exe File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini WmiApSrv.exe File created C:\Windows\system32\perfc007.dat WmiApSrv.exe File created C:\Windows\system32\perfc009.dat WmiApSrv.exe File created C:\Windows\system32\perfh00A.dat WmiApSrv.exe File created C:\Windows\system32\perfc011.dat WmiApSrv.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
python_x86_Lib.exemsiexec.exedescription ioc process File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\EFileBox.tcl python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\tearoff.tcl python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\locations.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Denver python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Brazil\East python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT-0 python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib2to3\fixes\fix_imports.py python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\msgs\fr_ca.msg python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\demos\tixwidgets.tcl python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Simferopol python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\entry.tcl python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\xmllib.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\commands python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib2to3\fixes\fix_ws_comma.py python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\encoding\ksc5601.enc python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\encoding\macCyrillic.enc python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Jakarta python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\encoding\cp1251.enc python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\encoding\cp1253.enc python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Tehran python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\filebox.xpm python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\audiodev.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib2to3\fixes\fix_unicode.py python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\operations\freeze.py python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\status_codes.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\SText.tcl python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\xml\dom\expatbuilder.py python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Chile\Continental python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\demos\tcolor python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\xdrlib.py python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\distutils\command\clean.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\msgs\lt.msg python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Antarctica\McMurdo python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Taipei python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib2to3\fixes\fix_reduce.py python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\statvfs.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\EFileBox.tcl python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\WInfo.tcl python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\wsgiref\validate.py python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\_abcoll.py python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\distutils\ccompiler.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\email\mime\base.py python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\rfc822.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\SystemV\PST8 python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib2to3\fixes\fix_dict.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib2to3\main.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\__init__.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\msgs\id.msg python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\pref\Old12Pt.fs python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\demos\ttkprogress.tcl python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\repr.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\symbol.py python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Jamaica python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Ust-Nera python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Menominee python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\HST python_x86_Lib.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\_LWPCookieJar.py python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\plugindlls\MaintenanceWindowPlugin.dll msiexec.exe File opened for modification C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\encodings\iso2022_jp_ext.py python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\Rio_Gallegos python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\idlelib\Icons\openfolder.gif python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Johannesburg python_x86_Lib.exe File created C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\demos\icon.tcl python_x86_Lib.exe -
Drops file in Windows directory 24 IoCs
Processes:
msiexec.exeDrvInst.exeMsiExec.exeWmiApSrv.exedescription ioc process File created C:\Windows\Installer\f763527.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI3871.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI391F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI394F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3FD7.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CA6B5E30-616B-4A5E-BC20-52629865CC0A}\icon.ico msiexec.exe File created C:\Windows\Installer\wix{CA6B5E30-616B-4A5E-BC20-52629865CC0A}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\MSI5414.tmp msiexec.exe File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini WmiApSrv.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\f763524.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI38FF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3EFC.tmp msiexec.exe File created C:\Windows\Installer\{CA6B5E30-616B-4A5E-BC20-52629865CC0A}\icon.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI4C08.tmp msiexec.exe File created C:\Windows\Installer\f763525.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\inf\WmiApRpl\WmiApRpl.h WmiApSrv.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f763524.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3786.tmp msiexec.exe File opened for modification C:\Windows\Installer\f763525.ipi msiexec.exe File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h WmiApSrv.exe -
Executes dropped EXE 11 IoCs
Processes:
python_x86_Lib.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exeRmmService.exeRmmService.exeRmmService.exeCharmVitamin.exeFt.pifRegAsm.exepid process 1196 python_x86_Lib.exe 2172 ITSMService.exe 716 ITSMAgent.exe 2000 ITSMAgent.exe 312 ITSMAgent.exe 2580 RmmService.exe 540 RmmService.exe 360 RmmService.exe 1884 CharmVitamin.exe 1428 Ft.pif 2932 RegAsm.exe -
Loads dropped DLL 64 IoCs
Processes:
MsiExec.exeMsiExec.execmd.exeITSMService.exeITSMAgent.exepid process 2188 MsiExec.exe 2188 MsiExec.exe 2188 MsiExec.exe 2188 MsiExec.exe 2908 MsiExec.exe 2908 MsiExec.exe 2020 cmd.exe 2908 MsiExec.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1632 timeout.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 2576 tasklist.exe 1688 tasklist.exe -
Modifies data under HKEY_USERS 53 IoCs
Processes:
DrvInst.exeITSMService.exepython_x86_Lib.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" python_x86_Lib.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ python_x86_Lib.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" python_x86_Lib.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT ITSMService.exe -
Modifies registry class 25 IoCs
Processes:
ITSMService.exemsiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDM\proxy = "false" ITSMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\ProductName = "Endpoint Manager Communication Client" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\PackageCode = "DFFE6588FCABA52429605389FCB2DC8B" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CDM ITSMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\03E5B6ACB616E5A4CB0225268956CCA0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\Version = "134527975" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\ProductIcon = "C:\\Windows\\Installer\\{CA6B5E30-616B-4A5E-BC20-52629865CC0A}\\icon.ico" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\03E5B6ACB616E5A4CB0225268956CCA0 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\DeploymentFlags = "3" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\PackageName = "em_Kia5weA1_installer_Win7-Win11_x86_x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\03E5B6ACB616E5A4CB0225268956CCA0\DefaultFeature msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
Processes:
ITSMAgent.exeITSMAgent.exeITSMAgent.exepid process 716 ITSMAgent.exe 2000 ITSMAgent.exe 312 ITSMAgent.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
CharmVitamin.exepid process 1884 CharmVitamin.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
msiexec.exeITSMService.exeRmmService.exeFt.pifRegAsm.exepid process 2900 msiexec.exe 2900 msiexec.exe 2172 ITSMService.exe 2172 ITSMService.exe 360 RmmService.exe 1428 Ft.pif 1428 Ft.pif 1428 Ft.pif 1428 Ft.pif 1428 Ft.pif 1428 Ft.pif 1428 Ft.pif 1428 Ft.pif 2932 RegAsm.exe 2932 RegAsm.exe 2932 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid process Token: SeShutdownPrivilege 2276 msiexec.exe Token: SeIncreaseQuotaPrivilege 2276 msiexec.exe Token: SeRestorePrivilege 2900 msiexec.exe Token: SeTakeOwnershipPrivilege 2900 msiexec.exe Token: SeSecurityPrivilege 2900 msiexec.exe Token: SeCreateTokenPrivilege 2276 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2276 msiexec.exe Token: SeLockMemoryPrivilege 2276 msiexec.exe Token: SeIncreaseQuotaPrivilege 2276 msiexec.exe Token: SeMachineAccountPrivilege 2276 msiexec.exe Token: SeTcbPrivilege 2276 msiexec.exe Token: SeSecurityPrivilege 2276 msiexec.exe Token: SeTakeOwnershipPrivilege 2276 msiexec.exe Token: SeLoadDriverPrivilege 2276 msiexec.exe Token: SeSystemProfilePrivilege 2276 msiexec.exe Token: SeSystemtimePrivilege 2276 msiexec.exe Token: SeProfSingleProcessPrivilege 2276 msiexec.exe Token: SeIncBasePriorityPrivilege 2276 msiexec.exe Token: SeCreatePagefilePrivilege 2276 msiexec.exe Token: SeCreatePermanentPrivilege 2276 msiexec.exe Token: SeBackupPrivilege 2276 msiexec.exe Token: SeRestorePrivilege 2276 msiexec.exe Token: SeShutdownPrivilege 2276 msiexec.exe Token: SeDebugPrivilege 2276 msiexec.exe Token: SeAuditPrivilege 2276 msiexec.exe Token: SeSystemEnvironmentPrivilege 2276 msiexec.exe Token: SeChangeNotifyPrivilege 2276 msiexec.exe Token: SeRemoteShutdownPrivilege 2276 msiexec.exe Token: SeUndockPrivilege 2276 msiexec.exe Token: SeSyncAgentPrivilege 2276 msiexec.exe Token: SeEnableDelegationPrivilege 2276 msiexec.exe Token: SeManageVolumePrivilege 2276 msiexec.exe Token: SeImpersonatePrivilege 2276 msiexec.exe Token: SeCreateGlobalPrivilege 2276 msiexec.exe Token: SeBackupPrivilege 2668 vssvc.exe Token: SeRestorePrivilege 2668 vssvc.exe Token: SeAuditPrivilege 2668 vssvc.exe Token: SeBackupPrivilege 2900 msiexec.exe Token: SeRestorePrivilege 2900 msiexec.exe Token: SeRestorePrivilege 2336 DrvInst.exe Token: SeRestorePrivilege 2336 DrvInst.exe Token: SeRestorePrivilege 2336 DrvInst.exe Token: SeRestorePrivilege 2336 DrvInst.exe Token: SeRestorePrivilege 2336 DrvInst.exe Token: SeRestorePrivilege 2336 DrvInst.exe Token: SeRestorePrivilege 2336 DrvInst.exe Token: SeLoadDriverPrivilege 2336 DrvInst.exe Token: SeLoadDriverPrivilege 2336 DrvInst.exe Token: SeLoadDriverPrivilege 2336 DrvInst.exe Token: SeRestorePrivilege 2900 msiexec.exe Token: SeTakeOwnershipPrivilege 2900 msiexec.exe Token: SeRestorePrivilege 2900 msiexec.exe Token: SeTakeOwnershipPrivilege 2900 msiexec.exe Token: SeRestorePrivilege 2900 msiexec.exe Token: SeTakeOwnershipPrivilege 2900 msiexec.exe Token: SeRestorePrivilege 2900 msiexec.exe Token: SeTakeOwnershipPrivilege 2900 msiexec.exe Token: SeRestorePrivilege 2900 msiexec.exe Token: SeTakeOwnershipPrivilege 2900 msiexec.exe Token: SeRestorePrivilege 2900 msiexec.exe Token: SeTakeOwnershipPrivilege 2900 msiexec.exe Token: SeRestorePrivilege 2900 msiexec.exe Token: SeTakeOwnershipPrivilege 2900 msiexec.exe Token: SeRestorePrivilege 2900 msiexec.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
Processes:
msiexec.exeITSMAgent.exeFt.pifpid process 2276 msiexec.exe 2276 msiexec.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 1428 Ft.pif 1428 Ft.pif 1428 Ft.pif 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe -
Suspicious use of SendNotifyMessage 35 IoCs
Processes:
ITSMAgent.exeFt.pifpid process 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 1428 Ft.pif 1428 Ft.pif 1428 Ft.pif 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe 716 ITSMAgent.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
ITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exepid process 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 2172 ITSMService.exe 716 ITSMAgent.exe 2000 ITSMAgent.exe 2172 ITSMService.exe 312 ITSMAgent.exe 2172 ITSMService.exe 2172 ITSMService.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msiexec.exeMsiExec.execmd.exepython_x86_Lib.exeITSMService.exeRmmService.exeRmmService.execmd.exeCharmVitamin.execmd.exedescription pid process target process PID 2900 wrote to memory of 2188 2900 msiexec.exe MsiExec.exe PID 2900 wrote to memory of 2188 2900 msiexec.exe MsiExec.exe PID 2900 wrote to memory of 2188 2900 msiexec.exe MsiExec.exe PID 2900 wrote to memory of 2188 2900 msiexec.exe MsiExec.exe PID 2900 wrote to memory of 2188 2900 msiexec.exe MsiExec.exe PID 2900 wrote to memory of 2188 2900 msiexec.exe MsiExec.exe PID 2900 wrote to memory of 2188 2900 msiexec.exe MsiExec.exe PID 2900 wrote to memory of 2908 2900 msiexec.exe MsiExec.exe PID 2900 wrote to memory of 2908 2900 msiexec.exe MsiExec.exe PID 2900 wrote to memory of 2908 2900 msiexec.exe MsiExec.exe PID 2900 wrote to memory of 2908 2900 msiexec.exe MsiExec.exe PID 2900 wrote to memory of 2908 2900 msiexec.exe MsiExec.exe PID 2900 wrote to memory of 2908 2900 msiexec.exe MsiExec.exe PID 2900 wrote to memory of 2908 2900 msiexec.exe MsiExec.exe PID 2908 wrote to memory of 2020 2908 MsiExec.exe cmd.exe PID 2908 wrote to memory of 2020 2908 MsiExec.exe cmd.exe PID 2908 wrote to memory of 2020 2908 MsiExec.exe cmd.exe PID 2908 wrote to memory of 2020 2908 MsiExec.exe cmd.exe PID 2020 wrote to memory of 1196 2020 cmd.exe python_x86_Lib.exe PID 2020 wrote to memory of 1196 2020 cmd.exe python_x86_Lib.exe PID 2020 wrote to memory of 1196 2020 cmd.exe python_x86_Lib.exe PID 2020 wrote to memory of 1196 2020 cmd.exe python_x86_Lib.exe PID 2020 wrote to memory of 1196 2020 cmd.exe python_x86_Lib.exe PID 2020 wrote to memory of 1196 2020 cmd.exe python_x86_Lib.exe PID 2020 wrote to memory of 1196 2020 cmd.exe python_x86_Lib.exe PID 1196 wrote to memory of 1872 1196 python_x86_Lib.exe cmd.exe PID 1196 wrote to memory of 1872 1196 python_x86_Lib.exe cmd.exe PID 1196 wrote to memory of 1872 1196 python_x86_Lib.exe cmd.exe PID 1196 wrote to memory of 1872 1196 python_x86_Lib.exe cmd.exe PID 2172 wrote to memory of 716 2172 ITSMService.exe ITSMAgent.exe PID 2172 wrote to memory of 716 2172 ITSMService.exe ITSMAgent.exe PID 2172 wrote to memory of 716 2172 ITSMService.exe ITSMAgent.exe PID 2172 wrote to memory of 716 2172 ITSMService.exe ITSMAgent.exe PID 2172 wrote to memory of 2000 2172 ITSMService.exe ITSMAgent.exe PID 2172 wrote to memory of 2000 2172 ITSMService.exe ITSMAgent.exe PID 2172 wrote to memory of 2000 2172 ITSMService.exe ITSMAgent.exe PID 2172 wrote to memory of 2000 2172 ITSMService.exe ITSMAgent.exe PID 2172 wrote to memory of 312 2172 ITSMService.exe ITSMAgent.exe PID 2172 wrote to memory of 312 2172 ITSMService.exe ITSMAgent.exe PID 2172 wrote to memory of 312 2172 ITSMService.exe ITSMAgent.exe PID 2172 wrote to memory of 312 2172 ITSMService.exe ITSMAgent.exe PID 2172 wrote to memory of 2580 2172 ITSMService.exe RmmService.exe PID 2172 wrote to memory of 2580 2172 ITSMService.exe RmmService.exe PID 2172 wrote to memory of 2580 2172 ITSMService.exe RmmService.exe PID 2172 wrote to memory of 2580 2172 ITSMService.exe RmmService.exe PID 540 wrote to memory of 360 540 RmmService.exe RmmService.exe PID 540 wrote to memory of 360 540 RmmService.exe RmmService.exe PID 540 wrote to memory of 360 540 RmmService.exe RmmService.exe PID 540 wrote to memory of 360 540 RmmService.exe RmmService.exe PID 360 wrote to memory of 1308 360 RmmService.exe cmd.exe PID 360 wrote to memory of 1308 360 RmmService.exe cmd.exe PID 360 wrote to memory of 1308 360 RmmService.exe cmd.exe PID 360 wrote to memory of 1308 360 RmmService.exe cmd.exe PID 1308 wrote to memory of 1884 1308 cmd.exe CharmVitamin.exe PID 1308 wrote to memory of 1884 1308 cmd.exe CharmVitamin.exe PID 1308 wrote to memory of 1884 1308 cmd.exe CharmVitamin.exe PID 1308 wrote to memory of 1884 1308 cmd.exe CharmVitamin.exe PID 1884 wrote to memory of 2032 1884 CharmVitamin.exe cmd.exe PID 1884 wrote to memory of 2032 1884 CharmVitamin.exe cmd.exe PID 1884 wrote to memory of 2032 1884 CharmVitamin.exe cmd.exe PID 1884 wrote to memory of 2032 1884 CharmVitamin.exe cmd.exe PID 2032 wrote to memory of 2576 2032 cmd.exe tasklist.exe PID 2032 wrote to memory of 2576 2032 cmd.exe tasklist.exe PID 2032 wrote to memory of 2576 2032 cmd.exe tasklist.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\em_Kia5weA1_installer_Win7-Win11_x86_x64.msi2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\437256\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\437256\RegAsm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 99D063D981F4535F9691AD4A2717D7152⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 860E31A2D0245C48ABB605CC240029DF M Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\ITarian\Endpoint Manager\" && "C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe"C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe"4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "5⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000598" "00000000000003CC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe"1⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe" noui2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe"C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe" --start2⤵
- Executes dropped EXE
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe"C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe"C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe" --run_procedure --in Global\sharedInputMemory_1 --out Global\sharedOutputMemory_2 --err Global\sharedErrorMemory_32⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\CharmVitamin.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CharmVitamin.exeC:\Users\Admin\AppData\Local\Temp\CharmVitamin.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy Yeast Yeast.cmd & Yeast.cmd5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"6⤵
-
C:\Windows\SysWOW64\cmd.execmd /c md 4372566⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V "DirtYnRepublicCarroll" Fares6⤵
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Luke + Everyone + Breed + Noted + Mental 437256\H6⤵
-
C:\Users\Admin\AppData\Local\Temp\437256\Ft.pif437256\Ft.pif 437256\H6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\timeout.exetimeout 56⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\f763526.rbsFilesize
711KB
MD5d448d7c25ffbb0363ebb2484cf8cf3e1
SHA19e1e282a0c0e0d30d31ea4bb87dd31881deb9cf3
SHA25646fa4ebfacf12e9a670963ef2113b13fe6bf91f4ba2f23f7a5ba080434ad337e
SHA512d64885bff14a2d9a13a9aefcb6c97106b95e082d3e851b7135837bf6d38aacbfa2316060148c5da71dce9440b5e44ed91252e55a22d98e46bfdf7272b587b312
-
C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exeFilesize
2.9MB
MD5a223cbdc0a058b5158a7b46cd2c5d06c
SHA13376c1f6a9d28791c259623846604979ddfc70dd
SHA2568382bea9ebf7638cd1c5170444330cf27e89eb5e96f76d7a89b47b3ae21425e3
SHA512ea26b077355dd4000dfb698c1a6d68eea93bc96afd4b1d9e98c3ce6fc597afa7ec436b903b419f872dc2c0d082dee0f75b42b2a776321f26bb6f27883086d5f3
-
C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exeFilesize
8.4MB
MD538c0aeef07c40a5ca17923cd91863019
SHA1d9e349796dfe589e6e9f68f5a64eab989a62a923
SHA256b0e21d8ec7942126ffff069640f2918f45ab8ecb0f42bf129efe87a9539bc61b
SHA512756502a96a6408b48bddb625d8b80fc98c914cc7d1aa4adc5e0f153d122dfca19cc7780e9e2cd5b94aedcd1d876ddbfb76426a16c262406daad0755ebf8c2b5e
-
C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safeFilesize
2B
MD581051bcc2cf1bedf378224b0a93e2877
SHA1ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA2567eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA5121b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
-
C:\Program Files (x86)\ITarian\Endpoint Manager\MSVCP140.dllFilesize
426KB
MD58ff1898897f3f4391803c7253366a87b
SHA19bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA25651398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
SHA512cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03
-
C:\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-core-synch-l1-2-0.dllFilesize
11KB
MD5c250b2e4ff04d22306bf8ce286afd158
SHA1e5c60b7892ff64cbff02d551f9dbf25218c8195b
SHA25642367b6b7285bddc185c0badefe49e883646f574b1d7d832c226f2d1ce489c5b
SHA512a78c4ddf98330698c9da8d1d2c7c3176f22dfabf0900008cff1f294f56a2a14b52becd09ba37a065d544f58617911b3f5850614b5aabd0ec7daf236f29c9b10b
-
C:\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-environment-l1-1-0.dllFilesize
11KB
MD59806f2f88ba292b8542a964c0b102876
SHA1c02e1541a264a04963add31d2043fa954b069b6b
SHA256cf601a7b883bb4fb87c28b4a1d9f823d2454b298cdbcb4da4f508db8bd1278ba
SHA512d68cb926de3caa498ad2aea60e2c5dbb72f30836a6ad9bb11a48f2ca706656981d9332dae44769ccf6f8de3b2ea1507983440afbe1322520f2fd1674cd8de823
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDBFilesize
765B
MD532c5aeda7947edb5499aa47ce4ac2209
SHA174fe8c913c673a9116e865e1b7c8fd8260595a14
SHA2565187d064a80dfcdec144dfc65e70fd756e947a0e592ad9ea837708955d7b9672
SHA512c7b7352ffd272a9da80d643e8657e0a77470342b04100ace52a8d3bbe4dcbb18a55ecedd3cbf3037eefece30d5b303783cb4c10f54fb27168f7c381d82ea0826
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_8627E3B7B7F53AEB154CA2955D073D2FFilesize
638B
MD5eb7b71ae4505ba0a269d0555a84fd51f
SHA1e7aa27cbd7795961b8d1af849cba8c315d2ff79c
SHA2567689034bc1b374ed6cb85f427594ec47fe5e0e2fa821ca68df23034fe655f2d0
SHA51231b2d96c7e46567a33c0d0f7f122816abe9a1866620d9e26da23d8f4283632720fdb02f5107012191480e88a1ff3efcfadd668b4dba3279ae72743c0557a4454
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225FFilesize
1KB
MD53c99ea206fb3c3f6bf159adb02cf4737
SHA1f07b0dab096cbe14a972fa6eca3a34a062c6c203
SHA256396730735f20969ab9e2b0de8b01e2fddf5d92c5237e8aa915407613e05c2e76
SHA51282eabc2a8ae85e8ff114a99de82d9cf60be3e2a50f123510157fbcadd275159df4b4db700a9c3b0776920c2d9fc019b57355be369cfd31f744f26107d5e3ef8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDBFilesize
484B
MD5d3380dac6dd48b175c4f4e061e130cf7
SHA17e0e0d611f57adbc72e6507ad9e33d8bfc969472
SHA256451aa943985163f174b32cf1c6176396e38bc5362d20adc18f6e8e1b5d5fdc72
SHA5122ae831b0c954a8000951c29d120037408cc693fa7933ad978b546bbed99a14203da598cea3c044146bbc3ded798ee4bed027f40cd0c267e4df019dd6d43d2f21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD58d306c044c1d58aa2b76dc0b85d8a5c5
SHA15c0d6403568d73fac075ae1b020435a1b98f11a9
SHA256773bd29a491e1e76c130c963064c2821d8de4ccea747cb16aa45bfbddbc39af2
SHA512da2e4f1e0732dfd2d93ba55624c155e243616dc62ff2441a27fd73920cb15be76126bf988eb1612116156b6c379e0fd48c6653cfa73a80c338568b8769211982
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_8627E3B7B7F53AEB154CA2955D073D2FFilesize
484B
MD5787dbd9dd6600e8716db4d277987cbe0
SHA1df6278f161996dc4d768803877cd96f0dcec3d0c
SHA25629abda98cd8eada693b8fae40d12b9aac204ab9713de1734e60514169cc2cad1
SHA5124a1242f6f0248154552adf3156f49fe5eb78a102e86f5e8eda6a73aac2a6dfb69a7c5ccebae708c7ce2c0045e86aad389dbea091550056f0c8be6cb5a5204ea0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225FFilesize
482B
MD5ca1e50d27e18730cb02503ec0920f4c4
SHA1b72377ce4e32740ab9fa3064d4f8298b01efbb06
SHA256572aad823cdbdd9ab6220745d11a6ea5620a0fdd5204aa365b21a7babf6bf6b2
SHA51267ff9f2c2d49bda2f3eeea2d9cb1e392d4e94c9a1d94a716fab40a4c876a75f37ec35784eaf697889675d6cb868fe63b1e41e1b82d40de5b5c256ac18ec5a36a
-
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmdFilesize
228B
MD58f45e0ea664b30edd40e277c6eb8fc89
SHA19742d05a0eabe8c4960d80bcb24e51514e77a803
SHA256e2cdd1993e117f75ecd7833a86becccc3ecee73d8afd7197971acac88408c4d3
SHA5126dec7f7a59cff0533eee2f50c44eefff880f1486d8cc0c3fa2884bb222d837dde26d7a21f4879b3ed2e4081dee6580529bbd3f23b93efd2e80609bb37b85f00d
-
C:\Users\Admin\AppData\Local\Temp\Cab146D.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar147F.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\Tar159E.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
C:\Users\Admin\AppData\Local\Temp\Yeast.cmdFilesize
27KB
MD513863535fe8906ea34153509929dcd65
SHA103694307d248296f37ad8468063cf72f681a19c5
SHA2561769878e8aaa40f007a3b7cddd2174ebb46b59a783c61c2ecd35b8bcd29044a9
SHA5127227fd9599349539538faa62d1cd64c46342aac79d17b5076f90068ebb6ff18a2fb8e595c88813c692b3de77994f8a8fa7ec0395a43768cb6837e26999b54dd3
-
C:\Windows\Installer\MSI3786.tmpFilesize
284KB
MD58d992a2126c1d93fe274057e6d4fb1d0
SHA1bab132d4923c48b88b746f48114564cfae8184a5
SHA2566c435a95b9ded21a2c27bfdfb096de2367a9e4f8e002a3dbb6aa6f52b6409276
SHA512136babf8a8f2053e0c4d1d10c345b4b47dde10f15e230a4e914f3c72eb1144ccded421b2d47ad428a02c4273ac124a86e3e32222b0f1b24f69e22a221001869d
-
C:\Windows\System32\perfc007.datFilesize
141KB
MD50f3d76321f0a7986b42b25a3aa554f82
SHA17036bba62109cc25da5d6a84d22b6edb954987c0
SHA256dfad62e3372760d303f7337fe290e4cb28e714caadd3c59294b77968d81fe460
SHA512bb02a3f14d47d233fbda046f61bbf5612ebc6213b156af9c47f56733a03df1bb484d1c3576569eb4499d7b378eb01f4d6e906c36c6f71738482584c2e84b47d0
-
C:\Windows\System32\perfc00A.datFilesize
150KB
MD5540138285295c68de32a419b7d9de687
SHA11cf6a2a0f53f0516ff9fe5ac733dbb5a9255ae56
SHA25633867c52f756f2b0f645f4bd503c65969d73676dcb14e6a6fdb2ffb11c7562eb
SHA5127c17c10d4b6165aa0c208811dc6d98e2f4e75e3da1cc2313cc7da9d657626beb3e4ec00b07b71376a7c549725d40db20d8952753e70acc86e87a8390e224a64a
-
C:\Windows\System32\perfc00C.datFilesize
145KB
MD5ce233fa5dc5adcb87a5185617a0ff6ac
SHA12e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA25668d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
SHA5121e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2
-
C:\Windows\System32\perfc010.datFilesize
142KB
MD5d73172c6cb697755f87cd047c474cf91
SHA1abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA2569de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
SHA5127c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6
-
C:\Windows\System32\perfc011.datFilesize
114KB
MD51f998386566e5f9b7f11cc79254d1820
SHA1e1da5fe1f305099b94de565d06bc6f36c6794481
SHA2561665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f
-
C:\Windows\System32\perfh007.datFilesize
668KB
MD55026297c7c445e7f6f705906a6f57c02
SHA14ec3b66d44b0d44ec139bd1475afd100748f9e91
SHA256506d3bec72805973df3b2e11aba4d074aeb4b26b7335536e79ea1145108817cc
SHA5125be8e51ecacda465b905df3e38ac114240d8fa6bae5bb17e8e53a87630454b57514ca0abbd8afefd798d450cd4ee89caf4391eeb837ced384260c188482fb48d
-
C:\Windows\System32\perfh009.datFilesize
634KB
MD51c678ee06bd02b5d9e4d51c3a4ec2d2b
SHA190aa7fdfaaa37fb4f2edfc8efc3994871087dedb
SHA2562d168ab31836a08d8ca00aab9685f040aac4052a7f10fbbf0c28e9f880a79dd3
SHA512ec665d7a20f27b2a0fe2475883009c6d34615cc2046d096de447ef57bcac9da0ae842be0556f5736f42d9c1c601fb8629896a2444990e508f7c573165088ab32
-
C:\Windows\System32\perfh00A.datFilesize
727KB
MD57d0bac4e796872daa3f6dc82c57f4ca8
SHA1b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA256ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
SHA512145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e
-
C:\Windows\System32\perfh00C.datFilesize
727KB
MD55f684ce126de17a7d4433ed2494c5ca9
SHA1ce1a30a477daa1bac2ec358ce58731429eafe911
SHA2562e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
SHA5124d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b
-
C:\Windows\System32\perfh010.datFilesize
722KB
MD54623482c106cf6cc1bac198f31787b65
SHA15abb0decf7b42ef5daf7db012a742311932f6dad
SHA256eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
SHA512afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f
-
C:\Windows\System32\perfh011.datFilesize
406KB
MD554c674d19c0ff72816402f66f6c3d37c
SHA12dcc0269545a213648d59dc84916d9ec2d62a138
SHA256646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
SHA5124d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f
-
C:\Windows\System32\wbem\Performance\WmiApRpl.hFilesize
3KB
MD5b133a676d139032a27de3d9619e70091
SHA11248aa89938a13640252a79113930ede2f26f1fa
SHA256ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
-
C:\Windows\System32\wbem\Performance\WmiApRpl.iniFilesize
27KB
MD546d08e3a55f007c523ac64dce6dcf478
SHA162edf88697e98d43f32090a2197bead7e7244245
SHA2565b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42
-
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-core-file-l1-2-0.dllFilesize
10KB
MD57d64aefb7e8b31292da55c6e12808cdb
SHA1568c2a19a33bb18a3c6e19c670945630b9687d50
SHA25662a4810420d997c7fdd9e86a42917a44b78fb367a9d3c0a204e44b3ff05de6d4
SHA51268479da21f3a2246d60db8afd2ae3383a430c61458089179c35df3e25ca1a15eba86a2a473e661c1364613baa93dcb38652443eb5c5d484b571ab30728598f9b
-
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-core-file-l2-1-0.dllFilesize
10KB
MD5dcd09014f2b8041e89270fecd2c078b2
SHA1b9f08affdd9ff5622c16561e6a6e6120a786e315
SHA2566572965fd3909af60310db1e00c8820b2deef4864612e757d3babab896f59ed7
SHA512ef2ac73100184e6d80e03ce5aa089dbddb9e2a52adf878c34b7683274f879dcf2b066491cfc666f26453acbd44543d9741f36369015bd5d07e36b49d435751f6
-
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-core-localization-l1-2-0.dllFilesize
13KB
MD53979437d6817cdf82da474c8a1eefb0d
SHA15e96fe40993acbc7c2e9a104d51a728950ad872e
SHA2563dd2e16b6f135cdd45bce4065f6493540ebbaf2f7f1553085a2442ea2cf80a10
SHA5124f64c6d232fdae3e7e583cb1aa39878abbfbbc9466108b97a5dce089c35eb30af502b5b212b043c27c1b12b23c165bd2b559060c43d9e2efcdda777b34f0066b
-
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-core-processthreads-l1-1-1.dllFilesize
11KB
MD54da67feefeb86b58a20b3482b93285b3
SHA16cd7f344d7ca70cf983caddb88ff6baa40385ef1
SHA2563a5d176b1f2c97bca7d4e7a52590b84b726796191ae892d38ad757fd595f414d
SHA512b9f420d30143cf3f5c919fa454616765602f27c678787d34f502943567e3e5dfb068fec8190fea6fa8db70153ed620eb4fe5dc3092f9b35b7d46b00cc238e3ba
-
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-core-timezone-l1-1-0.dllFilesize
11KB
MD53339350008a663975ba4953018c38673
SHA178614a1aad7fc83d6999dcc0f467b43693be3d47
SHA2564f77abb5c5014769f907a194fd2e43b3c977df1fb87f8c98dd15a7b950d1e092
SHA512a303fd57dd59f478a8d6c66785768886509625a2baf8bf2b357bb249fc93f193ac8c5c2c9193e53738805700e49b941bf741d6c4850a43f29a82424ccdda191b
-
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-convert-l1-1-0.dllFilesize
14KB
MD5392b572dc6275d079270ad8e751a2433
SHA18347bba17ed3e7d5c2491f2177af3f35881e4420
SHA256347ceeb26c97124fb49add1e773e24883e84bf9e23204291066855cd0baea173
SHA512dbdbd159b428d177c5f5b57620da18a509350707881fb5040ac10faf2228c2ccfd6126ea062c5dd4d13998624a4f5745ed947118e8a1220190fdb93b6a3c20b7
-
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-filesystem-l1-1-0.dllFilesize
12KB
MD51747189e90f6d3677c27dc77382699d8
SHA117e07200fc40914e9aa5cbfc9987117b4dc8db02
SHA2566cc23b34f63ba8861742c207f0020f7b89530d6cdd8469c567246a5879d62b82
SHA512d2cc7223819b9109b7ce2475dfb2a58da78d0d3d606b05b6f24895d2f05fb1b83ee4c1d7a863f3c3488f5d1b014cd5b429070577bd53d00bb1e0a0a9b958f0b1
-
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-heap-l1-1-0.dllFilesize
11KB
MD51bcb55590ab80c2c78f8ce71eadeb3dc
SHA18625e6ed37c1a5678c3b4713801599f792dc1367
SHA256a3f13fa93131a17e05ad0c4253c34b4db30d15eae2b43c9d7ec56fdc6709d371
SHA512d80374ec9b17692b157031f771c6c86dc52247c3298594a936067473528bbb511be4e033203144bbf2ec2acfd7e3e935f898c945eb864dcf8b43ae48e3754439
-
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-locale-l1-1-0.dllFilesize
11KB
MD57481e20041cf8e366d737962d23ec9de
SHA1a13c9a2d6cf6c92050eaae5ecb090a401359d992
SHA2564615ec9effc0c27fc0cfd23ad9d87534cbe745998b7d318ae84ece5ea1338551
SHA512f7a8e381d1ac2704d61258728a9175834cf414f7f2ff79bd8853e8359d6468839585cb643f0871334b943b0f7b0d868e077f6bd3f61668e54785ee8b94bf7903
-
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-runtime-l1-1-0.dllFilesize
15KB
MD5047c779f39ebb4f57020cd5b6fb2d083
SHA1440077fc83d1c756fe24f9fb5eae67c5e4abd709
SHA256078d2551f53ca55715f5c6a045de1260ce331b97fd6d047f8455e06d97ef88dc
SHA51295a57d79c47d11f43796aea8fd1183d3db9448dee60530144b64a2dd3cd863f5b413356076c26101d96dd007ebf8aff9e23cf721ba4e03d932c333b8e5536b73
-
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-stdio-l1-1-0.dllFilesize
16KB
MD510e9dfc88bf784847e7b9aab82e28d0c
SHA1cb750cf87d561ca32f5860854da374dae6c9f2ad
SHA256e6bab87156c9e7ae14ce36a754eb6891891a22ddfff584b706538152017fbb0f
SHA51229c2edb44cada75ee8ccae1b55a405c8282c937450913196d54b6da1a1e121451c6e14a92a200574984961fa8c649d8a40caf58ea50a33d42a7dfae4439091c2
-
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-string-l1-1-0.dllFilesize
17KB
MD51f1d50aa4553e77f6b90ae13bd56a95c
SHA1cf421a298f485c2a000791e1840ededeea19bad0
SHA256d343529d2a49cbb89d644deafce573b873ab45e0bf57e2d906b2f2a964d7bd9a
SHA512a08bdcc2883066a8bdb9336eec5c7f8593202c367ce75a7d7390ed4c6e0e1dbe80b7afadeee78f12ac0386d70ac360af12bf0ff3285acda0425789038951f180
-
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-time-l1-1-0.dllFilesize
13KB
MD5fa5327c2a3d284385d8dc3d65935604b
SHA1a878b7cdf4ad027422e0e2182dad694ed436e949
SHA256704ad27cab084be488b5757395ad5129e28f57a7c6680976af0f096b3d536e66
SHA512473ff715f73839b766b5f28555a861d03b009c6b26c225bc104f4aab4e4ea766803f38000b444d4d433ff9ea68a3f940e66792bae1826781342f475860973816
-
\Program Files (x86)\ITarian\Endpoint Manager\log4cplusU.dllFilesize
471KB
MD5deb3f322eb7ca3c0b6daf4090029c9b8
SHA132cdfabfe95fc0a9c4b978574ef9445522cd0184
SHA256658079c48d9b4b953c7076f3f77aeddf7f2b7433c42b35e69b1f510e3bee7c8d
SHA5123657b9f0749afebc20bcdc79122afe875ad4b8f19e505d53c4e1a974d0bce580785a8b8de6e4383f0f8f80ddfa4ee6259c7b7feab336cea581627b5db9c8bae6
-
\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exeFilesize
7.2MB
MD55c6bb7660240850918b681d7db03d537
SHA1b0eafb948aef588bffdc04698e13a621bcfa4026
SHA256746ca047811f552dbca21660310513b3a53181bcd8400c24743f72669b1988ac
SHA512b1ae5b3cedf3f5b92a771134c2eb13d0f7ae945f6088d4ae52b245456f644ac73539f9d8374be96e9642c56415244c3ac4eac06882115dcec293a085d323496f
-
\Program Files (x86)\ITarian\Endpoint Manager\ucrtbase.dllFilesize
1.1MB
MD5126fb99e7037b6a56a14d701fd27178b
SHA10969f27c4a0d8270c34edb342510de4f388752cd
SHA25610f8f24aa678db8e38e6917748c52bbcd219161b9a07286d6f8093ab1d0318fa
SHA512d787a9530bce036d405988770621b6f15162347a892506ce637839ac83ac6c23001dc5b2292afd652e0804bd327a7536d5f1b92412697c3be335a03133d5fe17
-
\Program Files (x86)\ITarian\Endpoint Manager\vcruntime140.dllFilesize
74KB
MD51a84957b6e681fca057160cd04e26b27
SHA18d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA2569faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA5125f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
-
\Windows\Installer\MSI3871.tmpFilesize
203KB
MD5d53b2b818b8c6a2b2bae3a39e988af10
SHA1ee57ec919035cf8125ee0f72bd84a8dd9e879959
SHA2562a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2
SHA5123aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e
-
memory/312-5146-0x0000000000350000-0x000000000035A000-memory.dmpFilesize
40KB
-
memory/312-5128-0x0000000000330000-0x000000000033A000-memory.dmpFilesize
40KB
-
memory/312-5129-0x0000000000330000-0x000000000033A000-memory.dmpFilesize
40KB
-
memory/716-5145-0x00000000001C0000-0x00000000001CA000-memory.dmpFilesize
40KB
-
memory/716-6031-0x00000000001C0000-0x00000000001CA000-memory.dmpFilesize
40KB
-
memory/716-5312-0x00000000001A0000-0x00000000001AA000-memory.dmpFilesize
40KB
-
memory/716-5311-0x00000000001A0000-0x00000000001AA000-memory.dmpFilesize
40KB
-
memory/716-5119-0x00000000001A0000-0x00000000001AA000-memory.dmpFilesize
40KB
-
memory/716-5144-0x00000000001C0000-0x00000000001CA000-memory.dmpFilesize
40KB
-
memory/716-5118-0x00000000001A0000-0x00000000001AA000-memory.dmpFilesize
40KB
-
memory/2172-5166-0x0000000002F00000-0x0000000002F4C000-memory.dmpFilesize
304KB
-
memory/2932-6089-0x0000000000090000-0x00000000000E0000-memory.dmpFilesize
320KB
-
memory/2932-6088-0x0000000000090000-0x00000000000E0000-memory.dmpFilesize
320KB
-
memory/2932-6090-0x0000000000090000-0x00000000000E0000-memory.dmpFilesize
320KB