f4d1b970bc9e5d319c5432be9e3863b5a20bf26e557c8cea6f3949df0012cf01

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2024 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

em_Kia5weA1_installer_Win7-Win11_x86_x64.msi
Size

93.9MB
MD5

a295cf96ebabdfa1d30424e72ed6d4df
SHA1

7d5fb6b88051115b59f47dadb49ea8114cdf5c4b
SHA256

f4d1b970bc9e5d319c5432be9e3863b5a20bf26e557c8cea6f3949df0012cf01
SHA512

b098929b66bdfa26e26e7965f6166cc5f008d09bf913d172c84aed2b631b9b6a2aa71739d36705509343d644c69b71d91dfd9ccabc948b858377ebe5a36d80e9
SSDEEP

1572864:ofSCYWHh+jXJ16YaOPnGJ52t8/MdYs3iR7cGY+v5mK//pHKH3LgjmWDCZT3V5cR+:kSC/B+7L68nGJ5GLdn3Mh/pHeUj7DCpt

Score

6^/10

persistence privilege_escalation

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\ITarian\\Endpoint Manager\\ITSMAgent.exe"	msiexec.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	3848	msiexec.exe
9	3848	msiexec.exe
11	3848	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib-tk\SimpleDialog.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\xmlrpclib.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\bitmaps\plus.xbm	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\CatUninstaller.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\distutils\command\check.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\mimetypes.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\posixpath.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib2to3\fixes\fix_urllib.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\_vendor\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Yakutsk	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Sofia	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Toronto	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\Victoria	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\encodings\cp1026.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib2to3\fixes\fix_dict.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\msgs\es.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\msgs\hi_in.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib-tk\tkSimpleDialog.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\msgs\es_do.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Monterrey	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\filters\alphabeticalattributes.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\Lindeman	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\json\tool.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\md5.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\El_Salvador	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\_vendor\colorama\ansi.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\setuptools\command\test.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Nipigon	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Oral	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\contextlib.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\ctypes\macholib\dyld.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\encodings\ascii.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\encodings\mbcs.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Pacific\Tarawa	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\generator\ninja_test.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\METADATA	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Mexico\General	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib2to3\patcomp.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Antarctica\South_Pole	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\demos\knightstour.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\ChkList.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\demos\samples\CmpImg1.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\nturl2path.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tarfile.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Eirunepe	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Japan	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Lagos	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\_MozillaCookieJar.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\distutils\command\install.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\popen2.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\msgs\eo.msg	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Gaborone	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\Rio_Gallegos	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\network.xpm	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\distutils\dir_util.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib-tk\tkCommonDialog.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\_vendor\packaging\_structures.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\msgs\en_ie.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\images\logoLarge.gif	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\generator\gypsh.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pkg_resources\_vendor\packaging\_structures.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Cuiaba	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\Init.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Mendoza	python_x86_Lib.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI99DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{CA6B5E30-616B-4A5E-BC20-52629865CC0A}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14F9.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8479.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{CA6B5E30-616B-4A5E-BC20-52629865CC0A}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F0A.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CA6B5E30-616B-4A5E-BC20-52629865CC0A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI891E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE55C.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{CA6B5E30-616B-4A5E-BC20-52629865CC0A}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e597843.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI89CB.tmp	msiexec.exe
File created	C:\Windows\Installer\e597845.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e597843.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A58.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9517.tmp	msiexec.exe

Executes dropped EXE 5 IoCs

pid	Process
2392	python_x86_Lib.exe
3824	ITSMService.exe
532	ITSMAgent.exe
4696	ITSMAgent.exe
3248	ITSMAgent.exe

Loads dropped DLL 61 IoCs

pid	Process
3232	MsiExec.exe
3232	MsiExec.exe
3232	MsiExec.exe
3232	MsiExec.exe
4404	MsiExec.exe
4404	MsiExec.exe
4404	MsiExec.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
4696	ITSMAgent.exe
4696	ITSMAgent.exe
4696	ITSMAgent.exe
4696	ITSMAgent.exe
4696	ITSMAgent.exe
4696	ITSMAgent.exe
532	ITSMAgent.exe
4696	ITSMAgent.exe
4404	MsiExec.exe
3248	ITSMAgent.exe
3248	ITSMAgent.exe
3248	ITSMAgent.exe
3248	ITSMAgent.exe
3248	ITSMAgent.exe
3248	ITSMAgent.exe
3248	ITSMAgent.exe
3248	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
3248	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

pid	Process
3848	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064efbbd21686319b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000064efbbd20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090064efbbd2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d64efbbd2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000064efbbd200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	python_x86_Lib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	python_x86_Lib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	python_x86_Lib.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\03E5B6ACB616E5A4CB0225268956CCA0\DefaultFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\ProductName = "Endpoint Manager Communication Client"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\PackageCode = "DFFE6588FCABA52429605389FCB2DC8B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\ProductIcon = "C:\\Windows\\Installer\\{CA6B5E30-616B-4A5E-BC20-52629865CC0A}\\icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\03E5B6ACB616E5A4CB0225268956CCA0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\PackageName = "em_Kia5weA1_installer_Win7-Win11_x86_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\03E5B6ACB616E5A4CB0225268956CCA0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\Version = "134527975"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\03E5B6ACB616E5A4CB0225268956CCA0\DeploymentFlags = "3"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
532	ITSMAgent.exe
4696	ITSMAgent.exe
3248	ITSMAgent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1756	msiexec.exe
1756	msiexec.exe
3824	ITSMService.exe
3824	ITSMService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3848	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3848	msiexec.exe
Token: SeSecurityPrivilege	1756	msiexec.exe
Token: SeCreateTokenPrivilege	3848	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3848	msiexec.exe
Token: SeLockMemoryPrivilege	3848	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3848	msiexec.exe
Token: SeMachineAccountPrivilege	3848	msiexec.exe
Token: SeTcbPrivilege	3848	msiexec.exe
Token: SeSecurityPrivilege	3848	msiexec.exe
Token: SeTakeOwnershipPrivilege	3848	msiexec.exe
Token: SeLoadDriverPrivilege	3848	msiexec.exe
Token: SeSystemProfilePrivilege	3848	msiexec.exe
Token: SeSystemtimePrivilege	3848	msiexec.exe
Token: SeProfSingleProcessPrivilege	3848	msiexec.exe
Token: SeIncBasePriorityPrivilege	3848	msiexec.exe
Token: SeCreatePagefilePrivilege	3848	msiexec.exe
Token: SeCreatePermanentPrivilege	3848	msiexec.exe
Token: SeBackupPrivilege	3848	msiexec.exe
Token: SeRestorePrivilege	3848	msiexec.exe
Token: SeShutdownPrivilege	3848	msiexec.exe
Token: SeDebugPrivilege	3848	msiexec.exe
Token: SeAuditPrivilege	3848	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3848	msiexec.exe
Token: SeChangeNotifyPrivilege	3848	msiexec.exe
Token: SeRemoteShutdownPrivilege	3848	msiexec.exe
Token: SeUndockPrivilege	3848	msiexec.exe
Token: SeSyncAgentPrivilege	3848	msiexec.exe
Token: SeEnableDelegationPrivilege	3848	msiexec.exe
Token: SeManageVolumePrivilege	3848	msiexec.exe
Token: SeImpersonatePrivilege	3848	msiexec.exe
Token: SeCreateGlobalPrivilege	3848	msiexec.exe
Token: SeBackupPrivilege	3560	vssvc.exe
Token: SeRestorePrivilege	3560	vssvc.exe
Token: SeAuditPrivilege	3560	vssvc.exe
Token: SeBackupPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeBackupPrivilege	4108	srtasks.exe
Token: SeRestorePrivilege	4108	srtasks.exe
Token: SeSecurityPrivilege	4108	srtasks.exe
Token: SeTakeOwnershipPrivilege	4108	srtasks.exe
Token: SeBackupPrivilege	4108	srtasks.exe
Token: SeRestorePrivilege	4108	srtasks.exe
Token: SeSecurityPrivilege	4108	srtasks.exe
Token: SeTakeOwnershipPrivilege	4108	srtasks.exe
Token: SeRestorePrivilege	1756	msiexec.exe
Token: SeTakeOwnershipPrivilege	1756	msiexec.exe
Token: SeShutdownPrivilege	4404	MsiExec.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
3848	msiexec.exe
3848	msiexec.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe
532	ITSMAgent.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
3824	ITSMService.exe
4696	ITSMAgent.exe
532	ITSMAgent.exe
3824	ITSMService.exe
3248	ITSMAgent.exe
3824	ITSMService.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 4108	1756	msiexec.exe	105
PID 1756 wrote to memory of 4108	1756	msiexec.exe	105
PID 1756 wrote to memory of 3232	1756	msiexec.exe	107
PID 1756 wrote to memory of 3232	1756	msiexec.exe	107
PID 1756 wrote to memory of 3232	1756	msiexec.exe	107
PID 1756 wrote to memory of 4404	1756	msiexec.exe	108
PID 1756 wrote to memory of 4404	1756	msiexec.exe	108
PID 1756 wrote to memory of 4404	1756	msiexec.exe	108
PID 4404 wrote to memory of 2336	4404	MsiExec.exe	109
PID 4404 wrote to memory of 2336	4404	MsiExec.exe	109
PID 4404 wrote to memory of 2336	4404	MsiExec.exe	109
PID 2336 wrote to memory of 2392	2336	cmd.exe	111
PID 2336 wrote to memory of 2392	2336	cmd.exe	111
PID 2336 wrote to memory of 2392	2336	cmd.exe	111
PID 2392 wrote to memory of 1772	2392	python_x86_Lib.exe	112
PID 2392 wrote to memory of 1772	2392	python_x86_Lib.exe	112
PID 2392 wrote to memory of 1772	2392	python_x86_Lib.exe	112
PID 3824 wrote to memory of 532	3824	ITSMService.exe	117
PID 3824 wrote to memory of 532	3824	ITSMService.exe	117
PID 3824 wrote to memory of 532	3824	ITSMService.exe	117
PID 3824 wrote to memory of 4696	3824	ITSMService.exe	118
PID 3824 wrote to memory of 4696	3824	ITSMService.exe	118
PID 3824 wrote to memory of 4696	3824	ITSMService.exe	118
PID 3824 wrote to memory of 3248	3824	ITSMService.exe	120
PID 3824 wrote to memory of 3248	3824	ITSMService.exe	120
PID 3824 wrote to memory of 3248	3824	ITSMService.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\em_Kia5weA1_installer_Win7-Win11_x86_x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3848

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5947589E5251852F2445CDF14EA2CD42
  2⤵
  - Loads dropped DLL
  PID:3232
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 23F68ED1643FA527DD62421E5F481BFB E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\ITarian\Endpoint Manager\" && "C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe
      "C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe"
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2392
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        5⤵
        
        PID:1772

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:5040

C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe
"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:532
- C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe" noui
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4696
- C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e597844.rbs

Filesize
709KB

MD5
391e978fafcf4335a8653fad8c0ec610

SHA1
b8e1dd97d6aa48dcddac1d03ba3e9a2baef79a02

SHA256
e6fc175da5e773c8ae99cf94b623321d5bd29b5a8551dcf8919a0a6c8850eb53

SHA512
84728a6c58c85e02e95fab95f83d75e15bea70926e39d0004e2760ad36e27336fd751b5ecdd212b8b91779ccbce1f9456e61509725b4f6848bf4edf8e33962bf

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\ApplicationManagement.dll

Filesize
87KB

MD5
c4988f5cb047ac689f30bae61ababe53

SHA1
f06ba7ffd589f3cd2f9f5ba697c2c70c7bca571a

SHA256
561f9863042d00d7e04463a162b4706cb57aebb5eb0f457f0a93c8ec4d02b368

SHA512
86a008bac947d3cf7522fcb68dbddac093bcb26c0b978c5e26de30460d836f170cd85b478bf605d09b938712eb2cf2d3f533ec13697dc7c248fe16a00f45746a

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe

Filesize
2.9MB

MD5
a223cbdc0a058b5158a7b46cd2c5d06c

SHA1
3376c1f6a9d28791c259623846604979ddfc70dd

SHA256
8382bea9ebf7638cd1c5170444330cf27e89eb5e96f76d7a89b47b3ae21425e3

SHA512
ea26b077355dd4000dfb698c1a6d68eea93bc96afd4b1d9e98c3ce6fc597afa7ec436b903b419f872dc2c0d082dee0f75b42b2a776321f26bb6f27883086d5f3

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe

Filesize
8.4MB

MD5
38c0aeef07c40a5ca17923cd91863019

SHA1
d9e349796dfe589e6e9f68f5a64eab989a62a923

SHA256
b0e21d8ec7942126ffff069640f2918f45ab8ecb0f42bf129efe87a9539bc61b

SHA512
756502a96a6408b48bddb625d8b80fc98c914cc7d1aa4adc5e0f153d122dfca19cc7780e9e2cd5b94aedcd1d876ddbfb76426a16c262406daad0755ebf8c2b5e

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Core.dll

Filesize
5.1MB

MD5
8cd5e1ce2ea4ec1364a475b4a12d9876

SHA1
512de2edb4fb01c1a2b0c714b351f11b7d064c80

SHA256
b61b0c785b9d6cdeb8dc66001faf7a7678e608c1afcc8fd113ff72d630f5ef69

SHA512
e66bc16ae9c5483f05adc4bbf9c05a8f679b83bb50bc448f932feaa102fe8f186bc9ee65f5c811082a1529ca02df16a00503246c07a0d0a5e1c749bb9a65b10d

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Gui.dll

Filesize
5.2MB

MD5
57ea01a6d60d00cb0aeaef9fa95d9448

SHA1
a3145de70923c2b12b318cf7308157287ef1a600

SHA256
a92dde025a2396649b35196cbb512ddff509f8088092f950022ce2e74164435c

SHA512
0e3aba0f0c35966b1d9e1436aa135810ee25791bb2a0799b6edaed9b3451360bf33763047b2eca1a5b1bfa8e3caab802213a4f67ad3c128bcd51f5bcc6408fdb

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Network.dll

Filesize
1015KB

MD5
9f59b04aa22b0337dd679dc0d8a74f24

SHA1
483adf99e88971391c9dafe09ecae370c1ffb711

SHA256
9069fc1fdf33f9a593c01d13dfb4f06c73831ec3c70eb29ce677dce11f43a47e

SHA512
47d30e3feec3acc50b61d708254cc6b55227037232327791226536a7bb0de7f1cb8186ca5fb0ad2789fd300a8eaa47d209e7a10fd770bbfe0542ef0b4dfa1743

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Sql.dll

Filesize
173KB

MD5
1c0211f848868243be3c20e064d4dddb

SHA1
b4c2ccbb50db60dfcb09693c5428ce52ecf2eb59

SHA256
32689f42510ba19bb52b77a0fb389a953b463a9bde09068813bf10c975f512f8

SHA512
f776f689f693f09f5e200ba821b8174589222cbbcd0d4c6a9fd39babd501a58adb5dbe97eaa5746dda2826c5bfc3ba7fe738c23dce3695828248ab62690f9ab2

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Widgets.dll

Filesize
4.4MB

MD5
7c02d51e3a882824de78912bfb3c4247

SHA1
6bb154641a631f98f007ce82de8074cf8ef3b742

SHA256
97cab1d7126f585c9e02108f44e854c813bdd9f18d5e29c6489eff9ad5ebf930

SHA512
0a122fbaf6492fea7015aac1dc645cd00a6aa9f33081c15ee239341efa80a3f0e1416f610e1ab10fe67146f6f01728ba1135ddd3a72689b96bd7d7e30e1c8a2f

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Xml.dll

Filesize
163KB

MD5
ec6df57475693752294b66ca7b78d78d

SHA1
d9df943034823ad38e95adfe06cc853d88b56850

SHA256
38cd696f5b3b5046ca1c8949c9562f5cb9bfd3f879ce903d3ef3621ff90fc9af

SHA512
1247237e04fdcd769876cd7ea146886b5e7cfd537d86f32c5c4f05c357f542279628ea1fdf1407096d86ff3536576890a345d75dfce4239b22f0f71ca75b0a38

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5XmlPatterns.dll

Filesize
2.2MB

MD5
38232ee54a27898b3b6b559adb682a44

SHA1
c61f3e6410683b9dadaa4ae02d473321bb2f09ff

SHA256
339ad3b2fa0a1f5dbc2c5763e55230b145c202c691ef86dbfe5069f7e9edc9f3

SHA512
24eb2a4a463316ffe6c88f7f2bf87987673f0467a8fd608c2bdc514231e49351abdffa5eaafa69024f668f48c369eba25980688cb8dc1d6f2a222cd8c1012b46

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\libcrypto-1_1.dll

Filesize
2.5MB

MD5
fbbd50790fdb30a604c481081b1b6f82

SHA1
4dbbce6aa15f030dd34cfc9b285b1f989de0c234

SHA256
e16f098fef8cffd1ea507d0d20ac827042d79e23db12cf906369a537e5201cd4

SHA512
448476a037de017ed58cc916347f0ed7a8e669bdf08c50c7e432dcf5d5680ce1299bc05361501ca05bf3c16d8adbdb6017a6a4a41c2e8d58d15bb4f88bb90e6d

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\libssl-1_1.dll

Filesize
535KB

MD5
86541e42a9c0ba190c51b5bfb03bdc84

SHA1
0e7b7f308d2c3a4695664f900e73990b9268440d

SHA256
73a54e0fb202b6c1322ef9bf1d44652c8dad176851d6952a42e26b5e293af54d

SHA512
7420125a90fd9e1943aa680cc842d32211086c17cea7b619c1fdb792eac0a7e312ba660f90a46d1ab4713be48a7c19e219d664aaa52def54343ebbee882e005f

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\log4cplusU.dll

Filesize
471KB

MD5
deb3f322eb7ca3c0b6daf4090029c9b8

SHA1
32cdfabfe95fc0a9c4b978574ef9445522cd0184

SHA256
658079c48d9b4b953c7076f3f77aeddf7f2b7433c42b35e69b1f510e3bee7c8d

SHA512
3657b9f0749afebc20bcdc79122afe875ad4b8f19e505d53c4e1a974d0bce580785a8b8de6e4383f0f8f80ddfa4ee6259c7b7feab336cea581627b5db9c8bae6

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\msvcp140.dll

Filesize
426KB

MD5
8ff1898897f3f4391803c7253366a87b

SHA1
9bdbeed8f75a892b6b630ef9e634667f4c620fa0

SHA256
51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

SHA512
cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\proxy_settings.ini

Filesize
101B

MD5
273ec42863e3d9f999381f09c13d313b

SHA1
008d1954b2a7d1c692a697c891f9692f41f10481

SHA256
4dd2c699bbb8c398788067be6fc82edc68c8246b8f6765169776bb24ebd0c487

SHA512
940df3f73592ccabc27bf2cc77de98eade7eb8988d30144060c817eda614085e36eadb699b02123c63774416e827194c269acd1267fad1d560b7df86a79ed89b

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe

Filesize
7.2MB

MD5
5c6bb7660240850918b681d7db03d537

SHA1
b0eafb948aef588bffdc04698e13a621bcfa4026

SHA256
746ca047811f552dbca21660310513b3a53181bcd8400c24743f72669b1988ac

SHA512
b1ae5b3cedf3f5b92a771134c2eb13d0f7ae945f6088d4ae52b245456f644ac73539f9d8374be96e9642c56415244c3ac4eac06882115dcec293a085d323496f

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\qdjango-db0.dll

Filesize
132KB

MD5
3c36f2c0d7523c46db6c02784a0647ba

SHA1
a961e775e24e00f4ef18a612a776d0f78d4ddb0e

SHA256
9fc3bc818d0edbbd3fc3346c3c53cb4e83a3cd3a37050ad9f2598bcd746caf2e

SHA512
478ebc5a1c4b47fa7c4c6a2784881f1a1623caa79daa593fcbabb6a29466931af725b38a0af97a13e9ecdcc278255f0185cc323cad873594a0edc085487a0dd8

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\rmmproxy.dll

Filesize
153KB

MD5
8f4367738be84d092d667a7851c541d4

SHA1
174b6b7e45aecda80fbbf80207a159040d8ad638

SHA256
6c6a4d511f5e71dd87f1d51dc3ae94c04d64be50f10b62ae4dba6d00668061e1

SHA512
8ca340fad533abb4d9d21e201e876afc2fae96fc27a34d7b658ac53be18ecd48c91b6c194e9e06228b770a4f87c6a709438017bf93558d0a62d0a0d9c80eee03

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\sqldrivers\qsqlite.dll

Filesize
1.1MB

MD5
9676f2612e9f869e9699b98f86741ff3

SHA1
034245da2c1ba8d99db80f56abeb00e7194ab755

SHA256
39256398ac50b2907cd299bbe8419176e085589ef7d89821572eb48199ce5eb9

SHA512
3bed475a6f7a1d7067fef17402927dea44b468995c912d206ed3c39c713e46dc96b220ef665f0595ef567c0475c0230a9ff6262c98ae8a1f80a58424781bbb2f

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\token.ini

Filesize
8B

MD5
7a31c29d79864ec61665920f91658d66

SHA1
352bd65200fe04dfd40298341ac029c5532b4d24

SHA256
ffcd9266e06fa662fcb762b2126574229adaba78d4f766d5817787dc2c9a75b6

SHA512
2f0882fe3ad2e8e1edd6ca0d427e13d71e80e13549259c9d9edec0a614942e54d4c11a8acd2333faf4db21614ee8ed86feb2d23c4f270777f8d324cbf5b53a99

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\vcruntime140.dll

Filesize
74KB

MD5
1a84957b6e681fca057160cd04e26b27

SHA1
8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

SHA256
9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

SHA512
5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Filesize
765B

MD5
32c5aeda7947edb5499aa47ce4ac2209

SHA1
74fe8c913c673a9116e865e1b7c8fd8260595a14

SHA256
5187d064a80dfcdec144dfc65e70fd756e947a0e592ad9ea837708955d7b9672

SHA512
c7b7352ffd272a9da80d643e8657e0a77470342b04100ace52a8d3bbe4dcbb18a55ecedd3cbf3037eefece30d5b303783cb4c10f54fb27168f7c381d82ea0826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_8627E3B7B7F53AEB154CA2955D073D2F

Filesize
638B

MD5
eb7b71ae4505ba0a269d0555a84fd51f

SHA1
e7aa27cbd7795961b8d1af849cba8c315d2ff79c

SHA256
7689034bc1b374ed6cb85f427594ec47fe5e0e2fa821ca68df23034fe655f2d0

SHA512
31b2d96c7e46567a33c0d0f7f122816abe9a1866620d9e26da23d8f4283632720fdb02f5107012191480e88a1ff3efcfadd668b4dba3279ae72743c0557a4454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
1KB

MD5
3c99ea206fb3c3f6bf159adb02cf4737

SHA1
f07b0dab096cbe14a972fa6eca3a34a062c6c203

SHA256
396730735f20969ab9e2b0de8b01e2fddf5d92c5237e8aa915407613e05c2e76

SHA512
82eabc2a8ae85e8ff114a99de82d9cf60be3e2a50f123510157fbcadd275159df4b4db700a9c3b0776920c2d9fc019b57355be369cfd31f744f26107d5e3ef8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Filesize
484B

MD5
0154bcec7fb55c66dfce1d8561b6e895

SHA1
3d14dd283029c80b1f037eaa0ad44e5394f670ae

SHA256
1d5725c11aee011b6c0173d89805c2b5238821efa798691261f800a0d5caddae

SHA512
e0c6f9ccd53f2d672f426691d59a084a420c542e862329be9e5ebfb6ee0d57cbf2f25962041844e5ae6b23dc100d8e47aa4a82a3185b5cd173aed5f8b30f2c69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_8627E3B7B7F53AEB154CA2955D073D2F

Filesize
484B

MD5
8c71ad68870b3b0010f98b776fa179ec

SHA1
beac492a277c4bd8ab37ca08d0dd107694cbbc9c

SHA256
0f9d5fde876f735440cb4b997dae7d2e2249384738301e68f62650a625b8898e

SHA512
1960db1691b719bda154de4a98b835ecb8618423e5ead595333c69d4000279ef2519bbafae3083fa36975bfa337c27d44e0911fc31fee9ab0a1804a8024ae5a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
482B

MD5
6d73c5434aa16b01febd001369e0f1b6

SHA1
687f2c8cec4723c7603acc3e1a6715b9d0469010

SHA256
b6d067f7caab285f85ede78dc72c32c75abd8f821f3e4e6e6cf1ec11ca752a03

SHA512
36293c7957c3422a1881ed5c7e05452ee99c09071e6c618cccff38e77ce47c0a6a78c421dde3501db777c9c055bd8dddd0be13cba6e5b9ec82bb2026eb37c5bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
228B

MD5
8f45e0ea664b30edd40e277c6eb8fc89

SHA1
9742d05a0eabe8c4960d80bcb24e51514e77a803

SHA256
e2cdd1993e117f75ecd7833a86becccc3ecee73d8afd7197971acac88408c4d3

SHA512
6dec7f7a59cff0533eee2f50c44eefff880f1486d8cc0c3fa2884bb222d837dde26d7a21f4879b3ed2e4081dee6580529bbd3f23b93efd2e80609bb37b85f00d

Download Submit
C:\Windows\Installer\MSI7F0A.tmp

Filesize
284KB

MD5
8d992a2126c1d93fe274057e6d4fb1d0

SHA1
bab132d4923c48b88b746f48114564cfae8184a5

SHA256
6c435a95b9ded21a2c27bfdfb096de2367a9e4f8e002a3dbb6aa6f52b6409276

SHA512
136babf8a8f2053e0c4d1d10c345b4b47dde10f15e230a4e914f3c72eb1144ccded421b2d47ad428a02c4273ac124a86e3e32222b0f1b24f69e22a221001869d

Download Submit
C:\Windows\Installer\MSI8479.tmp

Filesize
203KB

MD5
d53b2b818b8c6a2b2bae3a39e988af10

SHA1
ee57ec919035cf8125ee0f72bd84a8dd9e879959

SHA256
2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2

SHA512
3aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
b775df49917d58d6a4961775996a1c6f

SHA1
683cd96ecee5c6e4f2242e02f3d4433eb769ad72

SHA256
8befbc2ef1d153307d1c6485edbf8bc5363eb5bfad01d2a3bf28ffdaf193679e

SHA512
3f748aa0b5558cab6149642c31d41a744a42d1dee53920a2d69986b7423e9da039ab1b842cffeeaad4780aead1d3af50e0215f47ce7a4b5bf371cd3d25195af6

Download Submit
\??\Volume{d2bbef64-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2984862e-786d-40cf-9dc0-ab550e5668bd}_OnDiskSnapshotProp

Filesize
6KB

MD5
590b62dc4c1a98c73d9cfd88124cad93

SHA1
81c85f86ea6f5d1abb2608f79a0b3a090c66f137

SHA256
0d97a2a19d09cd926ac33341b6e97a57e7a86da472c32b64334674e0c7c9c31c

SHA512
9712e7633aa447480272f185d7f871174b8c570bc4e4486ca5bc628fcae13e2c6e7232e5ca4eff183365cea6d55ad7226ab7402c1734f8efb27a10fc36f3b29c

Download Submit