Resubmissions
12-08-2024 15:01
240812-sd558s1apb 1011-08-2024 12:42
240811-pxewlstgrh 1011-08-2024 03:59
240811-ekb9vayanf 6Analysis
-
max time kernel
359s -
max time network
362s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
11-08-2024 12:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
Resource
win7-20240729-en
Behavioral task
behavioral3
Sample
https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
Resource
win11-20240802-en
General
-
Target
https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
Malware Config
Signatures
-
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4008-5792-0x0000000000400000-0x00000000004C6000-memory.dmp family_sectoprat -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE 10 IoCs
Processes:
python_x86_Lib.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exeRmmService.exeRmmService.exeRmmService.exeRmmService.exeAutoIt3.exepid process 2448 python_x86_Lib.exe 4928 ITSMService.exe 2888 ITSMAgent.exe 4992 ITSMAgent.exe 3512 ITSMAgent.exe 3524 RmmService.exe 364 RmmService.exe 4880 RmmService.exe 4252 RmmService.exe 1920 AutoIt3.exe -
Loads dropped DLL 64 IoCs
Processes:
MsiExec.exeMsiExec.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exepid process 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 4132 MsiExec.exe 948 MsiExec.exe 948 MsiExec.exe 948 MsiExec.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 4992 ITSMAgent.exe 4992 ITSMAgent.exe 4992 ITSMAgent.exe 4992 ITSMAgent.exe 2888 ITSMAgent.exe 4992 ITSMAgent.exe 4992 ITSMAgent.exe 4992 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 3512 ITSMAgent.exe 3512 ITSMAgent.exe 3512 ITSMAgent.exe 3512 ITSMAgent.exe 3512 ITSMAgent.exe 3512 ITSMAgent.exe 3512 ITSMAgent.exe 3512 ITSMAgent.exe 3512 ITSMAgent.exe 948 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe" msiexec.exe -
Blocklisted process makes network request 2 IoCs
Processes:
msiexec.exeflow pid process 57 1316 msiexec.exe 58 1316 msiexec.exe -
Checks for any installed AV software in registry 1 TTPs 8 IoCs
Processes:
ITSMService.exedescription ioc process Delete value \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity ITSMService.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity ITSMService.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm ITSMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm ITSMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS ITSMService.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS ITSMService.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm ITSMService.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\ ITSMService.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs
Using AutoIT for possible automate script.
-
Drops file in System32 directory 6 IoCs
Processes:
ITSMService.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ITSMService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E455012CBF4BA8A2AC67618C00590908 ITSMService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ITSMService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ITSMService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ITSMService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E455012CBF4BA8A2AC67618C00590908 ITSMService.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
AutoIt3.exedescription pid process target process PID 1920 set thread context of 4008 1920 AutoIt3.exe RegAsm.exe -
Drops file in Program Files directory 64 IoCs
Processes:
python_x86_Lib.exemsiexec.exedescription ioc process File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\user.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8 python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\bsddb\dbtables.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\Icons\python.gif python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixer_base.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\treewalkers\genshistream.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Chile\EasterIsland python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples\STList3.tcl python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\dialog.tcl python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\filters\__init__.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\es_do.msg python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Singapore python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\US\Indiana-Starke python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\es_pr.msg python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Khartoum python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Gibraltar python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Mexico\BajaSur python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\pgen2\parse.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\pdb.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT+5 python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Mexico\BajaSur python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\dde1.3 python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\re-vendor.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\mr_in.msg python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Amsterdam python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Canada python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\iso8859_4.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\compat\dictconfig.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\treebuilders\dom.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Mexico\BajaNorte python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\ttkprogress.tcl python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\Icons\openfolder.gif python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\plugindlls\MaintenanceWindowPlugin.dll msiexec.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\iso8859_3.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\filters\alphabeticalattributes.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\command\build_scripts.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\hr.msg python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Timbuktu python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Indiana\Marengo python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Aden python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Bangkok python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Pacific\Galapagos python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Pacific\Samoa python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\compiler\ast.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\email\mime\nonmultipart.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\aboutDialog.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_isinstance.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\logging\config.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Swift_Current python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\xml\sax\handler.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\utils.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\zh_sg.msg python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tclIndex python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\command\sdist.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp437.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\StringIO.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Santarem python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT-0 python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\wsgiref\util.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\reg1.2\pkgIndex.tcl python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Guayaquil python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Kiev python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\WmDefault.tcl python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\ttkmenu.tcl python_x86_Lib.exe -
Drops file in Windows directory 24 IoCs
Processes:
MicrosoftEdge.exemsiexec.exeMsiExec.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI5666.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8680.tmp msiexec.exe File created C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSI4C6C.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI5057.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI50A6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI55E8.tmp msiexec.exe File created C:\Windows\Installer\e5a49ed.msi msiexec.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File opened for modification C:\Windows\Installer\e5a49eb.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI4D67.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5027.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\Installer\e5a49eb.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503} msiexec.exe File created C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico msiexec.exe File opened for modification C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI6858.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ITSMService.exeITSMAgent.exeITSMAgent.exeRmmService.exeRmmService.execmd.exeRegAsm.exeMsiExec.execmd.execmd.exepython_x86_Lib.exeRmmService.execmd.exeMsiExec.exeRmmService.exeAutoIt3.exeITSMAgent.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITSMService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITSMAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITSMAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RmmService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RmmService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language python_x86_Lib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RmmService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RmmService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AutoIt3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITSMAgent.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AutoIt3.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AutoIt3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AutoIt3.exe -
Processes:
MicrosoftEdgeCP.exebrowser_broker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies data under HKEY_USERS 60 IoCs
Processes:
ITSMService.exepython_x86_Lib.exemsiexec.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs ITSMService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache ITSMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" python_x86_Lib.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs ITSMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" python_x86_Lib.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust ITSMService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53\Blob = 03000000010000001400000040cef3046c916ed7ae557f60e76842828b51de5314000000010000001400000017d9d6252767f931c24943d93036448c6ca94feb040000000100000010000000886ea78b530e0fd5bda4e12527ab6a2c0f00000001000000300000005d2164164eb6f3820b9b8d7a5601b60ebf70d832d2029c6c3c966db107dfcb1ba12a25700f26ca3d5b36e4a6cb576cfa19000000010000001000000092a08f142bb795a2197a0d3c7af066f55c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001d0600003082061930820401a0030201020210137d539caa7c31a9a433701968847a8d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a308195310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313d303b060355040313345365637469676f20525341204f7267616e697a6174696f6e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a02820101009c930246454a524892fc578df92dea53beb32cd5d8a8a5ec5b6903c01d10f65933defe0748a8e88c7a674af1f58dc33766d03291f7c49d0460c4b54ae2838ba7ae26d45d3a5ef8d11671bb8abd71a27dc8cea26024b052a03a4551de78936c6260f1e4569cb73bf73c55d8dfd57a317c357f125170e12cbe04accbfa4fe17c656ac040a7d97ca5638419e1f7caefaab4e8585ad999e326df8e12b2b8dc33b236da141d965842406e0b22851c5122aec4c806456d92e667b71923e4d8366b85d07fc752e3cfb07501e089b4a8bf8a364ea3e06ceb8441cea52f482213975062451e09a5cc9f6c57704006db20e81bd6f3938ba7329eb7441509d7affd7c011cdb0203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e0416041417d9d6252767f931c24943d93036448c6ca94feb300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020230500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201004e134096c9c3e66e5bc0e3baf417e1ae091fc9bfcb0c2516f27353b3761ab7ab4806d6cd007c204543456c165a1b1361d749baa402a4ace8cece2dc92a74a3dcdeaeabd06836f891af3c01f777d50bcf97abeb87e715a8fa305a617120b1c043c4b98f6d8a31eb153624fb62d50b9c8fe966bde661519793b61d87bdb0b56cfea6112906613431303d20277351d0de8583d37739204696daa7c65a162785b2cf4e0f4e8c5cbebe3800f84bf9727bd4f27ad7a22985d004bad3422c5188522ed13d246747ec55cc1bf4ca34ea26c1deddc42189f6ba7b321e8e965e844538cf80aa37698b6017741548919c6df04ea377ca1b1c48faf9cf49e85f4f850ae28f901bab704c9aebb7a63fb4ac5da45fcfe6d88a9690f74f268160765d0f247791b32a319f165ab25d8c1c29aa489c8e6fd3784070db77ecdde3d15705702de64998880584620570567686394ed3226f1dfe6df10eb362c43ccbc085b9611ebae1158059940cae05bb8c7f56be1cd25abf97f26a4cb0c67076b0908dc10b36b911d8d6285cea4ffe24b7180a9b0cd0c17c5cfb69bdcca24dc690bca64df2b1bad69a675b960252d082f9c40a5c0d28e03fc8fa959589d5a4be496c40b23ea86bb8d525b2c4fef1d3d7e7d6dc43017630fb3b8b5df74a897c9a35befccaf05701f08d3fa087327b475a974b82d266c2c42dea3f24f4a7f9a8b9e36ad91861a03b8c15 ITSMService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates ITSMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" python_x86_Lib.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs ITSMService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53 ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ python_x86_Lib.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" python_x86_Lib.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections ITSMService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E ITSMService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" ITSMService.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exemsiexec.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 23eb9905ecebda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings browser_broker.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{B4AF0288-BBC2-49F3-84E5-2105B2839E1 = 394da764ecebda01 browser_broker.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{B4AF0288-BBC2-49F3-84E5-2105B2839E1 = "8320" browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{B4AF0288-BBC2-49F3-84E5-2105B2839E1 browser_broker.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = da269505ecebda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = e0543a853909db01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content MicrosoftEdgeCP.exe -
NTFS ADS 1 IoCs
Processes:
browser_broker.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi.c14445f.partial:Zone.Identifier browser_broker.exe -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
Processes:
ITSMAgent.exeITSMAgent.exeITSMAgent.exepid process 2888 ITSMAgent.exe 4992 ITSMAgent.exe 3512 ITSMAgent.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msiexec.exeITSMService.exeRegAsm.exepid process 2380 msiexec.exe 2380 msiexec.exe 4928 ITSMService.exe 4928 ITSMService.exe 4008 RegAsm.exe 4008 RegAsm.exe 4008 RegAsm.exe 4008 RegAsm.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
MicrosoftEdgeCP.exepid process 2640 MicrosoftEdgeCP.exe 2640 MicrosoftEdgeCP.exe 2640 MicrosoftEdgeCP.exe 2640 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exemsiexec.exemsiexec.exevssvc.exedescription pid process Token: SeDebugPrivilege 4728 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4728 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4728 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4728 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2784 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2784 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 660 MicrosoftEdge.exe Token: SeDebugPrivilege 660 MicrosoftEdge.exe Token: SeShutdownPrivilege 1316 msiexec.exe Token: SeIncreaseQuotaPrivilege 1316 msiexec.exe Token: SeSecurityPrivilege 2380 msiexec.exe Token: SeCreateTokenPrivilege 1316 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1316 msiexec.exe Token: SeLockMemoryPrivilege 1316 msiexec.exe Token: SeIncreaseQuotaPrivilege 1316 msiexec.exe Token: SeMachineAccountPrivilege 1316 msiexec.exe Token: SeTcbPrivilege 1316 msiexec.exe Token: SeSecurityPrivilege 1316 msiexec.exe Token: SeTakeOwnershipPrivilege 1316 msiexec.exe Token: SeLoadDriverPrivilege 1316 msiexec.exe Token: SeSystemProfilePrivilege 1316 msiexec.exe Token: SeSystemtimePrivilege 1316 msiexec.exe Token: SeProfSingleProcessPrivilege 1316 msiexec.exe Token: SeIncBasePriorityPrivilege 1316 msiexec.exe Token: SeCreatePagefilePrivilege 1316 msiexec.exe Token: SeCreatePermanentPrivilege 1316 msiexec.exe Token: SeBackupPrivilege 1316 msiexec.exe Token: SeRestorePrivilege 1316 msiexec.exe Token: SeShutdownPrivilege 1316 msiexec.exe Token: SeDebugPrivilege 1316 msiexec.exe Token: SeAuditPrivilege 1316 msiexec.exe Token: SeSystemEnvironmentPrivilege 1316 msiexec.exe Token: SeChangeNotifyPrivilege 1316 msiexec.exe Token: SeRemoteShutdownPrivilege 1316 msiexec.exe Token: SeUndockPrivilege 1316 msiexec.exe Token: SeSyncAgentPrivilege 1316 msiexec.exe Token: SeEnableDelegationPrivilege 1316 msiexec.exe Token: SeManageVolumePrivilege 1316 msiexec.exe Token: SeImpersonatePrivilege 1316 msiexec.exe Token: SeCreateGlobalPrivilege 1316 msiexec.exe Token: SeBackupPrivilege 2664 vssvc.exe Token: SeRestorePrivilege 2664 vssvc.exe Token: SeAuditPrivilege 2664 vssvc.exe Token: SeBackupPrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeTakeOwnershipPrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeTakeOwnershipPrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeTakeOwnershipPrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeTakeOwnershipPrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeTakeOwnershipPrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeTakeOwnershipPrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeTakeOwnershipPrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeTakeOwnershipPrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe Token: SeTakeOwnershipPrivilege 2380 msiexec.exe Token: SeRestorePrivilege 2380 msiexec.exe -
Suspicious use of FindShellTrayWindow 22 IoCs
Processes:
msiexec.exeITSMAgent.exepid process 1316 msiexec.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 1316 msiexec.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe -
Suspicious use of SendNotifyMessage 20 IoCs
Processes:
ITSMAgent.exepid process 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe 2888 ITSMAgent.exe -
Suspicious use of SetWindowsHookEx 22 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exeRegAsm.exepid process 660 MicrosoftEdge.exe 2640 MicrosoftEdgeCP.exe 4728 MicrosoftEdgeCP.exe 2640 MicrosoftEdgeCP.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 2888 ITSMAgent.exe 4992 ITSMAgent.exe 4928 ITSMService.exe 3512 ITSMAgent.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4928 ITSMService.exe 4008 RegAsm.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
MicrosoftEdgeCP.exebrowser_broker.exemsiexec.exeMsiExec.execmd.exepython_x86_Lib.exeITSMService.exeRmmService.exeRmmService.execmd.execmd.exeAutoIt3.exedescription pid process target process PID 2640 wrote to memory of 68 2640 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2640 wrote to memory of 68 2640 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2640 wrote to memory of 68 2640 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2640 wrote to memory of 664 2640 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2640 wrote to memory of 664 2640 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2640 wrote to memory of 664 2640 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4604 wrote to memory of 1316 4604 browser_broker.exe msiexec.exe PID 4604 wrote to memory of 1316 4604 browser_broker.exe msiexec.exe PID 2380 wrote to memory of 4252 2380 msiexec.exe srtasks.exe PID 2380 wrote to memory of 4252 2380 msiexec.exe srtasks.exe PID 2380 wrote to memory of 4132 2380 msiexec.exe MsiExec.exe PID 2380 wrote to memory of 4132 2380 msiexec.exe MsiExec.exe PID 2380 wrote to memory of 4132 2380 msiexec.exe MsiExec.exe PID 2380 wrote to memory of 948 2380 msiexec.exe MsiExec.exe PID 2380 wrote to memory of 948 2380 msiexec.exe MsiExec.exe PID 2380 wrote to memory of 948 2380 msiexec.exe MsiExec.exe PID 948 wrote to memory of 4420 948 MsiExec.exe cmd.exe PID 948 wrote to memory of 4420 948 MsiExec.exe cmd.exe PID 948 wrote to memory of 4420 948 MsiExec.exe cmd.exe PID 4420 wrote to memory of 2448 4420 cmd.exe python_x86_Lib.exe PID 4420 wrote to memory of 2448 4420 cmd.exe python_x86_Lib.exe PID 4420 wrote to memory of 2448 4420 cmd.exe python_x86_Lib.exe PID 2448 wrote to memory of 3536 2448 python_x86_Lib.exe cmd.exe PID 2448 wrote to memory of 3536 2448 python_x86_Lib.exe cmd.exe PID 2448 wrote to memory of 3536 2448 python_x86_Lib.exe cmd.exe PID 4928 wrote to memory of 2888 4928 ITSMService.exe ITSMAgent.exe PID 4928 wrote to memory of 2888 4928 ITSMService.exe ITSMAgent.exe PID 4928 wrote to memory of 2888 4928 ITSMService.exe ITSMAgent.exe PID 4928 wrote to memory of 4992 4928 ITSMService.exe ITSMAgent.exe PID 4928 wrote to memory of 4992 4928 ITSMService.exe ITSMAgent.exe PID 4928 wrote to memory of 4992 4928 ITSMService.exe ITSMAgent.exe PID 4928 wrote to memory of 3512 4928 ITSMService.exe ITSMAgent.exe PID 4928 wrote to memory of 3512 4928 ITSMService.exe ITSMAgent.exe PID 4928 wrote to memory of 3512 4928 ITSMService.exe ITSMAgent.exe PID 4928 wrote to memory of 3524 4928 ITSMService.exe RmmService.exe PID 4928 wrote to memory of 3524 4928 ITSMService.exe RmmService.exe PID 4928 wrote to memory of 3524 4928 ITSMService.exe RmmService.exe PID 364 wrote to memory of 4880 364 RmmService.exe RmmService.exe PID 364 wrote to memory of 4880 364 RmmService.exe RmmService.exe PID 364 wrote to memory of 4880 364 RmmService.exe RmmService.exe PID 4880 wrote to memory of 3856 4880 RmmService.exe cmd.exe PID 4880 wrote to memory of 3856 4880 RmmService.exe cmd.exe PID 4880 wrote to memory of 3856 4880 RmmService.exe cmd.exe PID 3856 wrote to memory of 4252 3856 cmd.exe RmmService.exe PID 3856 wrote to memory of 4252 3856 cmd.exe RmmService.exe PID 3856 wrote to memory of 4252 3856 cmd.exe RmmService.exe PID 4880 wrote to memory of 3244 4880 RmmService.exe cmd.exe PID 4880 wrote to memory of 3244 4880 RmmService.exe cmd.exe PID 4880 wrote to memory of 3244 4880 RmmService.exe cmd.exe PID 3244 wrote to memory of 1920 3244 cmd.exe AutoIt3.exe PID 3244 wrote to memory of 1920 3244 cmd.exe AutoIt3.exe PID 3244 wrote to memory of 1920 3244 cmd.exe AutoIt3.exe PID 1920 wrote to memory of 4008 1920 AutoIt3.exe RegAsm.exe PID 1920 wrote to memory of 4008 1920 AutoIt3.exe RegAsm.exe PID 1920 wrote to memory of 4008 1920 AutoIt3.exe RegAsm.exe PID 1920 wrote to memory of 4008 1920 AutoIt3.exe RegAsm.exe PID 1920 wrote to memory of 4008 1920 AutoIt3.exe RegAsm.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi"1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi"2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B9DB5BE2FBED9945EF954736855797D52⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CCEE37E80282CABEE35BBE874D5F70BF E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --start2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --run_procedure --in Global\sharedInputMemory_1 --out Global\sharedOutputMemory_2 --err Global\sharedErrorMemory_32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe""3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Salome\AutoIt3.exe C:\Users\Admin\AppData\Local\Temp\Salome\script.a3x"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Salome\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\Salome\AutoIt3.exe C:\Users\Admin\AppData\Local\Temp\Salome\script.a3x4⤵
- Executes dropped EXE
- Command and Scripting Interpreter: AutoIT
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e5a49ec.rbsFilesize
709KB
MD50ae247144c117b5fe48be315f6ecd8a3
SHA11c06d4ce21c51ea2c53a59bac704d6a28fca9ee0
SHA256d787239724a999232fadc50f0aad0ef8277685f554ac4cae2bb23160624ee4ed
SHA51214d3d8f2f6f7ba32c8c91c5eca6e5066ef86c37a533633fb15eacd5b79c681110522ddfe0c41b274c130f6e64fd6eced092301380507dfdcb99ca6cd8056959f
-
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exeFilesize
3.0MB
MD5a5b010d5b518932fd78fcfb0cb0c7aeb
SHA1957fd0c136c9405aa984231a1ab1b59c9b1e904f
SHA2565a137bfe1f0e6fc8a7b6957d5e9f10df997c485e0869586706b566015ff36763
SHA512e0ca4b29f01f644ef64669ed5595965b853ae9eaa7c6c7d86df7634437041ef15ceb3c2d1ab9dec4171c80511684a7d7b06fc87b658e5a646699eb9523bc4994
-
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exeFilesize
8.4MB
MD56b4752088a02d0016156d9e778bb5349
SHA1bd13b1f7b04e0fe23db6b3e4bd0aa91c810e1745
SHA256f64f13bf19726624a9cbaedda03a156597737581d6bc025c24e80517f5cab011
SHA5120fe982b0b551238fc881511cdd0656ee71f22aca3a5e83ef7ce41b3adf603f1be17ba3e2c10797ee3dfb5e15ff1ac3e8cf4e05c657e7c047f302f50baa42ba2d
-
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safeFilesize
2B
MD581051bcc2cf1bedf378224b0a93e2877
SHA1ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA2567eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA5121b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
-
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Core.dllFilesize
5.1MB
MD59356330cdf731eea1e628b215e599ce5
SHA188645c60b3c931314354d763231137a9ec650f1b
SHA256ad045d1d084a88fe3f48c12aee48746b22cb3a579f9140840c54ae61f7af3478
SHA5123d9ab9b1cdecad6809be96d82df2d1b9b8c9e1a7cf0ac79a820a92b11c8fa079f5a2c3875ba0b733503742c6977d6239ce22acec023a22038b2e7ee1ebd62d90
-
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Widgets.dllFilesize
4.4MB
MD513f078d5c63cb192f68b45f5767a9e6f
SHA16149189a1553c2e0e6d715d3177c16c11af7d33a
SHA256b0abf95a23e1616f3542a8cb794aac5b7463dff3db8621e3cd719ab1dd7f6226
SHA512f3293fcdccb4901d4eb405706ad20da361140842a335e6f6a7ce54222fe028a1da2179be14ec40dbb5a1784ed5d33bd467174091606e6fcac12039dc0f48e52a
-
C:\Program Files (x86)\COMODO\Endpoint Manager\libssl-1_1.dllFilesize
533KB
MD5bf2cae7a6256b95e1ba1782e6a6c5015
SHA13fbdc3afa52673c7bdfab16b500bbe56f1db096b
SHA256352d2fd16675855e20cc525b6376734933539b76bc4b40d679d3069008fe4cfc
SHA51290755eb718ba404b0e48a6713d4680db252f8156328a58fc347e74d84b8bd53a7a6276755c672240c0e5d78200130e3ddf86990779ddd86c6d10cebf2bc02c9e
-
C:\Program Files (x86)\COMODO\Endpoint Manager\log4cplusU.dllFilesize
471KB
MD50b03f7123e8bc93a38d321a989448dcc
SHA1fc8bfdf092cdd6b9c1ec3b90389c035c37e50bd7
SHA256a7fbfdb3100c164f139e9d0ebcf47282308e5173ab610dcb20a05b6e0615b54b
SHA5126d00c65111c0f389ad189178705ed04712b2c6de8918f58de7c3747126a4b4e50b4a73525cc0993af02d35323b1430f34baf6f99712df822d6cdc63e24ed7ae5
-
C:\Program Files (x86)\COMODO\Endpoint Manager\proxy_settings.iniFilesize
101B
MD5273ec42863e3d9f999381f09c13d313b
SHA1008d1954b2a7d1c692a697c891f9692f41f10481
SHA2564dd2c699bbb8c398788067be6fc82edc68c8246b8f6765169776bb24ebd0c487
SHA512940df3f73592ccabc27bf2cc77de98eade7eb8988d30144060c817eda614085e36eadb699b02123c63774416e827194c269acd1267fad1d560b7df86a79ed89b
-
C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exeFilesize
7.2MB
MD5dcebee7bb4e8b046b229edc10ded037f
SHA1f9bdf0b478e21389800542165f721e5018d8eb29
SHA2562eb0eefab534217953744c2cc36de2e1a1ced6ea882734e7b1f4b34a0b19689b
SHA5129827600a19da5a816f1b0d93aa2629cb48f13f6e5fc42cd44bb1031ecd2e942854b34e7da44335acb85e42c44b1e720e9da8bc1d9ad23a9b1de0190f026f4d30
-
C:\Program Files (x86)\COMODO\Endpoint Manager\qdjango-db0.dllFilesize
132KB
MD5342249e8c50e8849b62c4c7f83c81821
SHA1618aa180b34c50e243aefbf36bb6f69e36587feb
SHA25607bc6eb017005500d39e2c346824eef79b3e06f60c46fb11572f98d4fe4083c5
SHA51232a44252926881edf916ac517cb55d53b0b1b5adcc5952a674d1707d2c1431a68b27e593b4c4fcab0648e3cbeddf3d4e8024ff2a3385af9dbd2b2244e518340a
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1Filesize
33KB
MD55e19262f24aa33e8a60a1a7bf5264c3b
SHA1bc44ce4d763c4ee0e4fadf40a343e8af4dc54b62
SHA25649765661f92d0834bb07fba90db52ff9686438ba04c6c6250a38dc3ec3b373eb
SHA512c62af051898b9773c9185800c426720c414b4df67d1048deba94817776db9a123e20f8d060a7412d4f8eb9c3363096c764a4e17a2a3788f3836366c9891ef33f
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1Filesize
33KB
MD5a978d1fe6b0eed65da025368647db9de
SHA1f2794469113da03c808b28b26ec88e8627021cf9
SHA256926f96e02f760187025fc48ed4e13196a42aad34202c1b0ade8cc1512a5223b7
SHA512c56071318a90fca61a21af65ad6269e081fe474bb4eb4a9ab087fba74e4e2faf72b07e1a38185da22e82d003cbed10916b4bb0bd7adf5f483153558618a2f23d
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1Filesize
53KB
MD585afad51257f3c20094338cd56e38f9b
SHA14d948012f81517218a4bcfd75f9bbb25c7b3f439
SHA256319fa507817b380c4d4477106187c41904e3e52f83b96406360a24e6046c5b56
SHA5120c05d28da6b354a82feb8bf5dad925063fda0513f20c84d711c8aef83be3438a06faaea1380fb00631a3425d43dd85c1306420bf8f87e0cb228e0dd1404fe7be
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
32KB
MD5645917e62d9f21c00d54a4c0168413e2
SHA14b14367acdc22a13daa44a296109e6f8f82e3542
SHA256713bf7d93a627205c3b5b2e27ad591295ec7d8bc6c626066c260f9af287f1723
SHA512d83994917841ab99e06803aaae65245d146f3ed1daf65faf992d77ded1ffb8013e632bd3adf7161fa4ee9af6186aa5c2a5f72b2f8923ab90826c3671efd47f17
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5069f8f457ba165dd3d6dd89a2a850535
SHA1778d154c79f07c21091170c60950ef634e004be9
SHA2561445b90447ac4e0acac4838169bcffbec72ebec99f54f71faf850c4e18faf894
SHA512a84d19331285c6c64411fac218fad473c6a4e1abf8d505a38aa070d53b971b47ca084d8ab1b26a4771795edafa9965baeedd7b42fdeb7adb6f3736bb3213f380
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5c11d8d893b442be99da8e4f8f82ebb23
SHA122228d041f975687c60302a272b48f3e2f4e2322
SHA256c231f2c3654d2bf86c40dc19db4810d8a443af05ec31927355be83ab040ff872
SHA512223af6e5161a03c99e27f2280d648dc5d3311db10d02376ffdc6b0ccade4470b1d1bf3a18cf77547d5506c1c54cb240801a20a9deca4f83842424ee5e588b838
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD59e22e25401592f97160b828b2ec13cb4
SHA195e85d14bec458422dd170c58c53cafc8729d894
SHA2562b43e4424590fbe11ef7b16f73a729c70264f99fb1fe334e01987e913ef1b01f
SHA512da4158aad41f75120064a2eac43696968fadba5f04a1b70541bdf9e5faf19ffa49dbfea77a38efb199111a2e5be7dc19cf60dab1c5f2044d57f1661acd567052
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD53d6dc77df253527f1c15d67c44bec6da
SHA1514bec0e5b3c4b85d405365485fed623add4e273
SHA2565967e894f10aed81eb402bd34e0db747399680ad4eb37cf616041932a0f03c63
SHA512edb3c6c0acb4232e67c2958730f7cb50c94dabf3fab2398218331b01b0b0993ed9471bc80a4f37aecb0e8e0c78d4e70c30148c88b1d9c75c50291734fb937c74
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
31KB
MD5188b5c73adab04a2e298cd3d980b332b
SHA17b5e9d76548eb07da7efe437bef354f1c8b387ba
SHA256fabc7c441df0b85352ac059cd7c9fbd5583855cb219d194090fcbe62d5a90060
SHA512858a192fdf8fd6cc62503ed28d689e442e02a25c8543a437e4cf5969f7f53bb905aa11a7b2eecbffc1e32db063af3950d17b335e1b82f2f19cb2c2d8058c7156
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
34KB
MD5ec0a7ab76df1849f78921297e9d64a21
SHA159b3649706a4ebf8e865ac4a1f67aa1f7dbfd52e
SHA25699a7f9ff9a72568afc9224e4dc99b614348cd206c68a4549fee8151580ae082b
SHA5128eee35c57fe7bd74f9a732aa33cb702dbf4b57d1f167c171f7c9eb91b11ab4340a2ad4bdbb8b8defc8981003a6ccf87defbde7f151115cfd2e6b2d3cca12327a
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5368a8ae2d4db9500e1b0f6a7036e9be7
SHA1781cfb9802c6872fa888e695c9bbbccdbb16b0ce
SHA2563b0882320b745c338314f6ab0a62d251f64cbf02a601418b9b96004de5679e6a
SHA512b7c6e2dae46c8711efd9a377b9d029ca1d76a8073e85ac3720c9eb45b6a912e486c1de519ff403d055ae8d61afd500661da4046a6d120ad733cd62ec42a645fa
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD57cbc89b11862f0c03e6e63b5f1ee9cae
SHA1e3af52ee3453bfc8e60e3edc84a4035f2422c050
SHA256f8185791016a1629cfee827a8bcde035f0a3602e90519de57ce6e9ad238affed
SHA512fa54ce1ab8f190220ae8d3f8674e007108ef40cb29bca32c95771291e313edb096ca495fd4a3ff01362929e550e320e38a2bd49231ea4f69ca259857673bbe41
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD532476fae55621c73e441615e8add86cb
SHA18472b49b0964ac17a9a5cdc4207fe4793b2a5f4f
SHA256268803d4ffa4c5c5e49e408fb73732a49934ca382d102a994196fdd5f1843231
SHA512e27d90c020f4b0e489c539791099e381e2f537649320415c91b2afaa31dbe9bdec81ec56fb7a7adc0318c38f06e4779f9e0628d8cd2e4899f22e2ad1afb2fc35
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5e217dea1aefb7008f944e00c702d778b
SHA1318a9d2ea4085659b6815391aee03f1a07161a14
SHA256429df743d2ae1fbc89701187830df24e6588e727b08008ebae41f6264213acd3
SHA5120758b4afca37bc4eede3706a0e382afce157dad19ec8d625d52bcb702ea3f24ad72112eb103ad002922567a8c886c567f75d75503db03a8efa847845df2488c6
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
17KB
MD5a2e7179a4856c1112d9142d0dc74e07a
SHA111afcf04c8ccc87aca7ba0b4e56ee94d61b3d77e
SHA25660d731a8623e29b87faf751c92071b055b38e7d5b3c51e6b5464b973fd79259c
SHA51282a3d12dd1609c2acdfb02828ee9ef844ea8bc7eefdb807017f1d857abe1bdcf0d7fd39ed5e7db6e8bad86eebf824d57073912a8f81e949967547cc5c908e74d
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD573b7e01cb81d8d8f00b7a3b0188df963
SHA16162568bb42895f79337f16a495f727fdd1d3a0f
SHA25600ca00f03fa413108c5d47462f01fbf0a70b5acf5b46cd2f48c5235fe3e243c2
SHA512a2aeb8b3903f90a7ebba7c506c2cb41917d76be580a7ca5ae5e2ff8757a05664d29240440484c3c60488301c0f11acd16a199d3386242d956a8dc5672bd4f967
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5849888df369f0269e5f8feda259ddd45
SHA13ba18edf511fd74a24ddabf8056472e3a0aecabb
SHA25636757410e2422940140aa78bdc7e18c33924213d70ed9b7cc750db4ec261e213
SHA512a391758bb7bdb93a6c8d4fe4d0889206aea6eb9db8b797082d9334624bed2a8d55a6702b30ebd8c42e47560d07b174c0072e727cf6ea369a0581a4b0d3ded7b3
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD52fd022384d7829760e9858db26b6126d
SHA113f3ea6e0f2cd63f3a0dbb78846e8d74cbe46475
SHA2560d87ba8d891c93dee2388554f1fde1defadb77d978e725381a3b1e04d12decff
SHA512bc31c3e6faaebc090682ec87710aaa551cf60ed6c7877873b76df8ef98b81727498543d5589101138debebae6095d2965aa63024dfc977b72635bfcef9587404
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD50ec2d8c0e697591245ec9ce895a2852f
SHA1c2ced0dc2a19f91b84a4425fb6141dab858dc9c0
SHA2564bc122388bb5cc491e281bab6e2248ff886e78c0a71b841ed47fbd57a1227c3d
SHA5129032eb732b985d1c43bf4b69f4e718cb0263b17ada02159a5077b7b133b29ea9c7b36c6e54957ecb3c3886246e6f7ff95e57613a850340b1cd4714883318b451
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5bc539159069bdf91fb6d919bffdf2545
SHA1f406263a2e42eb2b6c99da8ce3ccfca9f4bb12f0
SHA2564cd83e9b93ee164209c8a44c7e8ec5678388d247ac9b396e42e8dcdabccd9daf
SHA512955151e9178461c9478de7aa7b942350b270670b7965eb5ed32801b2dea07fb0b9d9dc7ab0e880e755f159ef658a5a5798c846a087e41dd6b68d3e58f57df78d
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD50cfcc5f4714c4e7a4a9b6648b32c035b
SHA1e093f9a5e06dec0d160b32cbae207f61c9ac753f
SHA2565639f531ba0dcdd50c0eadead9703d13a17b73aee465e75a4d1e41af2b32829c
SHA512c959e595a379478027f72f033518176c9c40b40ff68be3fa80a81f0862b2999eaa496903b26d4abffa80d3649ec2a89ec0bbc5588450552b9ba979a53148e11b
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5613d2210b0d99cdde7c0f6fc0ddc0cdb
SHA180afb535c8ea380bb71e74571a88cdd8b15caff8
SHA2561d7cb1bd3c714bc3d0f79b03fd80cb1ee2551115d51a4f132ac370ea1f9fb726
SHA512959a5281b3f21b3c688592ddc5e053dd036546e9747bffdbd64c6eb25332f8746abe22596b769e5834725231d14a2b2710ff28a972cc1b7b5676cb0d1f9a4a5e
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
48KB
MD51dc1d57672ab3e68000d618698c79e0b
SHA181e1b337bfe7b255f49e876478e20e32b652c22c
SHA256517c9abbc4ef22cc4025b1258bf9d53750427d35ba9fca48ca6b17a78430e50e
SHA512ba3b5adac63eb270fa0281d4002803132f60363532f99e3a5511049ace3bcae9f1164ce6b57e2102153202238ea95fe5073aa73a4c3f08fed86f7b6c22e6b34c
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5c43bc66b1a19e1616a47bbb5f72ce95a
SHA19d237b63f128f8e38c81b70906ef67106335aeaf
SHA256b784d73082c86ef6ea0c39a983552bf6ba33691120ce0018e3ec9d33a1052643
SHA512b7e9e35d6f71f9825fc1ca447ea6d5f3fbb765459a92df3f49379c19b4992b2341dcb141f0c2a403726ce40194fb5d5e8f6dad6ba8a6e1253dc756cbaba74697
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD53b8c808bb7a2c1933fbee7cf5db473e5
SHA1fb3cc75558ad187164434f4b73b5dd22316cff00
SHA2564ed93f76c68037423ad5de2aa64addb46599384013ecb7ce64793f92b296f6bf
SHA5121dab25ae3b3bb4db7c339d8cd184765d31cdcef7dff9507f3f4338c0072de086220cc2f33f9e734cc8267b594736ac987d9c2d830c9d4bf2d8c1b5028c0e026b
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD59bb52f3b82aca27e3dfe499aa06d7fe8
SHA19814b7637026a73836e142cf43657fac841def28
SHA25611cb416fd00215ab86acee7d0d131dac447307f5126d12cc410aae38dd9aaa54
SHA5124c1a0a70b905c80180550a3e363961ab7f73ed2afe3f165297c632c8b3ec53f02b502757ef30ef3cb9f4a0ef33cca3977062a81146fd3f07ebc78cc15d782250
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmproxy.dllFilesize
154KB
MD584c848ca734892ea2e8ab90d84317ee3
SHA1a1b38d4f1b466061481bdfde7628139c908f7ee5
SHA25601c53abd5585992f9d62de40f4750899829b9e7e4a026b8d9f5d1cb1748a3fa9
SHA512cec124435d6d4c76497e7886ca317a0c12a9d8e77200ba94cf6a699b318b91cb4db886eba5a5161941a7dd349f827cd3694abb864d6e37a9084a208276bee7df
-
C:\Program Files (x86)\COMODO\Endpoint Manager\sqldrivers\qsqlite.dllFilesize
1.1MB
MD5d9d7b0d7386cd57e4301d57cb7294b4b
SHA1dcf385b8d3f9f99a07e1b7757508e5e4080f336c
SHA256a4ee1bc55369a13b3e721aa48e44de31c6f00439838e923ab7a66438fbab4002
SHA512e1568ce01edd46aabc795dd4eacab565ffc8dc0271129b5aa770f3763fba756a5de59aa4329510e65282bb19537874c6f307712a7fa2b6971f50dbee7b2664d7
-
C:\Program Files (x86)\COMODO\Endpoint Manager\token.iniFilesize
8B
MD5d670af02f76ed1e12dd15cf82fc09d78
SHA182027d68f22401cfe2b78f332d557703f899d4cb
SHA256daca7d7ac8f6abf57f3c7bb3759be5daafea8268485293964677a56f4a887d40
SHA512bb74387b7ff190779a8182e3a8948057ed07fbb46ceda4b4d6fcf1abef82451e4c10389bd64bc0a3eb826e8f79ba31fd36489bbb0371a8f296f3bb1bb1d9fa3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013Filesize
765B
MD5fff2cc217cec93b9b4e91ea34e23efaa
SHA1c6a7f0e18796e1c6b789ec9fb7e98fbc639bc1df
SHA2569bd2f914e637e30ba764c0af86102be829546122e443b30588e5e9723a15873b
SHA512f426e383b51806458533ddd15e4aec6cddde1acf497b8a84542818c4dffa3b5c21093a075a79a8e46ce5ddf6d16be9ed66c339724c63f76c6be7bd048cef5a3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784Filesize
637B
MD5f29448db915ce12024c00f8db2735a37
SHA18c42cc59bf9684c8913d77b6481d6f9a35291fe2
SHA2561220fbb03d07705373e10fff29e767a41a523ff3bbd1280f1e6c313421bd6930
SHA512932aa9847dc8630259827605dbf4cca4a778fda7ae164b814d6d552086812395441389179094c01c0225477aafdf9f3e2daa235e5884cf6eba01d32ee54b6b01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225FFilesize
1KB
MD58991f83c49d2736793a0c917c3d8ae4d
SHA171752a06511633fcb9d2df14b507e555e4d1b17a
SHA256a94ee10e4836486a24b1020e70055b440e46b52913a6e9cd66d0cae467276990
SHA5126fedbb05506b87ca954be1e413a1ca2824ae3b060242e89a1002a06d6549838f2d9e09768a878211a1929ef9cd260415bb061a8a28d16ee6e647780fc7e8b3cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013Filesize
484B
MD54e23b0881f6e38c7c1a346f24ee65286
SHA11e56c037cc2b3d85ff64c6f856e8129d1fa544c8
SHA256f84477b58c351ed0a9df347b749afe6107ed93076df0500a21a2fc0be94b219a
SHA51288cc7db4d52c670b2073c32343a32366deb9e888b06360969e95558eb6f0a5318e093915927be05fa77f631a2b66ef9e7d126e67c1c56f3f82a70457aaee4f6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784Filesize
480B
MD5245ff46d75344c8125b7e310ff6e55bc
SHA18e642464e758b62e5d122580afe376adbf334cf0
SHA25650a391d8334ad3b9451d10f03514525e6eeadbf38cab527c95d6f18b9162d8bc
SHA51242d390acda81b3c5a82deb1ed3c08461038f65214349c48cc35f3ac97fb18c3fa1b7b83d2b777cad6bd09d172757d96065776351317169b8a472a2f2e551269c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225FFilesize
482B
MD5fb7785a617860cc4733c8ca40eb82c95
SHA1fe311ec3ede3ba77bf4cae015f55fcf0ffda3bcd
SHA256558abe34eb4f8dda0a7da6c3bdad9cee439a93c98886cec7146761dafdb5c580
SHA512708e02be9e2acf774863a52bdb2c561f840fce3329a6c3b7eaf0c7e80e5388d76b627a62b16809c5ccb461e0fa25f2d7958757a0d2c3392cc1a5fc6f0a1c928b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XCFODRP5\edgecompatviewlist[1].xmlFilesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\FFUBHLLC\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5W0ULC6J\Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64[1].msiFilesize
79KB
MD5bda99f1af25194c9e87cc002ffcac404
SHA142e1bef02507042a4714e5ba8f1689ba81723b5f
SHA2563c1d0f5aa810a0bafa1e56a5b4b80b2ab16258631f0ee322fc65e489c19d8448
SHA5124b170857ed9213c055be647566eac55d65b9a9cc9ae817f5ef8e97614f7e3a912e595991e1fe115285bc819618d88b002ff4d9c3b79119ed249b76c0b5f8d913
-
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmdFilesize
226B
MD5feceaa82323f9de4d3578592d22f857d
SHA14c55c509e6d16466d1d4c31a0687ededf2eabc9a
SHA25661480b43136b02965f59e3256b8de1bf35caa7c084a7bcb3ed5f4236451d4484
SHA51282dac003d30eed4fc4e06ab4a426c9b7f355d777c243b710c5c0d3afc4c26d93874af2d0a542fca4a2038050b0d0fa8f63ed82e5f2771ae8a4de0f3b08d56d45
-
C:\Users\Admin\AppData\Local\Temp\tmpE14B.tmpFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\Windows\Installer\MSI4C6C.tmpFilesize
285KB
MD582d54afa53f6733d6529e4495700cdd8
SHA1b3e578b9edde7aaaacca66169db4f251ee1f06b3
SHA2568f4894b9d19bfe5d8e54b5e120cef6c69abea8958db066cdd4905cc78ecd58b6
SHA51222476e0f001b6cf37d26e15dfb91c826c4197603ea6e1fbb9143c81392e41f18fa10a2d2d1e25425baaf754bff7fd179ef1df34966c10985e16d9da12a445150
-
C:\Windows\Installer\MSI4D67.tmpFilesize
203KB
MD5d53b2b818b8c6a2b2bae3a39e988af10
SHA1ee57ec919035cf8125ee0f72bd84a8dd9e879959
SHA2562a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2
SHA5123aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
26.0MB
MD5025e98cbda639b2bb7f0bf340d56e2bb
SHA1ddd137e2913fd6dde3e3db2b7c67118ee1be0bd0
SHA25621c0963b02221a58760bb12984d7295911d2faf335b19b977c8ac4a4e62a60f3
SHA5128f2d1173dc9911d9b167fd35f969b949863ee33ca08742c2d3eb57b522c5d90bbb161a513c4824489eec6d54038dc7d170911c3104602cf41204df3ccefdd62e
-
\??\Volume{38fd360b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8695d791-bcf3-47e9-8550-f13b5b531f4f}_OnDiskSnapshotPropFilesize
5KB
MD57ebe294fd9a450150a2c5d2683b7ca09
SHA134a29714d4afc8a5f153560972996ed199f13cd3
SHA256120ede31d4422dabc567fd5ebfd7f71796407c1e47ceeb3d5785263365b1066b
SHA512b87c4f29e0cb5759471487651b01780447b66fce1aa044ee9c28c870a0b1cb28d842d40d37ab57ac3d827987076151df3fa714f2ed5c6b9077cf70880a2668a0
-
\Program Files (x86)\COMODO\Endpoint Manager\ApplicationManagement.dllFilesize
87KB
MD525c603e78d833ff781442886c4a01fe6
SHA16808adc90eb5db03163103ec91f7bc58ee8aa6d0
SHA25694afd301c1baa84b18e3b72d017b6a009145c16c6592891c92f50c127e55169e
SHA51284e33be97d97ae341d74fc8273d191df519616f12bec8ac2f89454897c30a5f7bf9115f208c8dae78da83f0ca7bf9e5f07544d37d87b07f63408fbc91e449d54
-
\Program Files (x86)\COMODO\Endpoint Manager\Qt5Network.dllFilesize
1015KB
MD5de150de21f1a2b72534eaa4aa4f03202
SHA139ed224cced1266d4adc5e68f6516979b8f52b33
SHA25603871db7d626d14e84d8ebf007139aa2c08038cd3403ac6259f1a2eb01ae1477
SHA51230eff193620724cda86e6de31c430f9d4426e677a553c7918f9b85dbfc67687acdecc2a29e45473666c01ce311b73833d9f79db8a93e80570c7ace8837ca531a
-
\Program Files (x86)\COMODO\Endpoint Manager\Qt5Sql.dllFilesize
174KB
MD588aeafdcc3f3fa04b9b20022906745b0
SHA19dc03428234000d19bbc3cb437d370b8e1863329
SHA256cd84c9c486c3e967ddd061718893ef5ee48eca24f77e3366b8fd3d2dd21f477f
SHA5125ea87730f26b16215eb2b892a6da689524546ef6cfaf4e6c1f4e0afa083ceec3e8f00c9259d316d84ef4cb05b01023a1362b4a676d10b55e06ee365557ab7986
-
\Program Files (x86)\COMODO\Endpoint Manager\Qt5Xml.dllFilesize
163KB
MD54bac5e44b4b2f138f6608c661330dad0
SHA1b08ff311b24d9bbc48d4014d7a0cd0de129a19e7
SHA25659ba9deba38b1e652a046fd6b58847a58883f2d8c5c1e81acfa78d2daad98a1c
SHA51274871aaaf8dc3fc006f7a1fdc42eabf5a86e34674d34362b2b00bdebe023d78fa0e6a5ef4676dc038178a6eeb01a0ba1676f68a1cc6828ac8d4ece550106ee0a
-
\Program Files (x86)\COMODO\Endpoint Manager\Qt5XmlPatterns.dllFilesize
2.2MB
MD5e2749ff4266d5a933feb7685dfe375b2
SHA1f09a432c67f45fc2ed27c762db4176b7dd47e908
SHA256e4ee537b6a585ec7656afd9fc6fd3f655ff44bec6ff8ec291fc3e868caade27c
SHA5124efc6b0b8d39b47d9c415fc3bc7460e4f738e3694fac691bf94569549569a8d65270a54488af3ae49de9fabdbe518250ceee83f6633e1da407636e6e02bac8bb
-
\Program Files (x86)\COMODO\Endpoint Manager\libcrypto-1_1.dllFilesize
2.5MB
MD58f4ccd26ddd75c67e79ac60afa0c711f
SHA16a8b00598ac4690c194737a8ce27d1d90482bd8b
SHA256ab7af6f3f78cf4d5ed4a2b498ef542a7efe168059b4a1077230a925b1c076a27
SHA5129a52ac91876eea1d8d243c309dadb00dfae7f16705bde51aa22e3c16d99ccf7cc5d10b262a96cfbb3312981ac632b63a3787e8f1de27c9bb961b5be6ff2ba9f4
-
\Program Files (x86)\COMODO\Endpoint Manager\msvcp140.dllFilesize
426KB
MD58ff1898897f3f4391803c7253366a87b
SHA19bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA25651398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
SHA512cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03
-
\Program Files (x86)\COMODO\Endpoint Manager\vcruntime140.dllFilesize
74KB
MD51a84957b6e681fca057160cd04e26b27
SHA18d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA2569faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA5125f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
-
memory/68-62-0x000001D9DB030000-0x000001D9DB032000-memory.dmpFilesize
8KB
-
memory/68-65-0x000001D9DB060000-0x000001D9DB062000-memory.dmpFilesize
8KB
-
memory/68-67-0x000001D9DB080000-0x000001D9DB082000-memory.dmpFilesize
8KB
-
memory/68-58-0x000001D9CAEA0000-0x000001D9CAFA0000-memory.dmpFilesize
1024KB
-
memory/660-17-0x00000268F7E30000-0x00000268F7E40000-memory.dmpFilesize
64KB
-
memory/660-0-0x00000268F7D20000-0x00000268F7D30000-memory.dmpFilesize
64KB
-
memory/660-70-0x00000268FE400000-0x00000268FE401000-memory.dmpFilesize
4KB
-
memory/660-35-0x00000268F6E70000-0x00000268F6E72000-memory.dmpFilesize
8KB
-
memory/660-69-0x00000268FE3F0000-0x00000268FE3F1000-memory.dmpFilesize
4KB
-
memory/664-78-0x0000027603800000-0x0000027603900000-memory.dmpFilesize
1024KB
-
memory/4008-5795-0x0000000005FD0000-0x0000000006192000-memory.dmpFilesize
1.8MB
-
memory/4008-5799-0x00000000066D0000-0x0000000006BFC000-memory.dmpFilesize
5.2MB
-
memory/4008-5792-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/4008-5789-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/4008-5796-0x00000000055D0000-0x0000000005646000-memory.dmpFilesize
472KB
-
memory/4008-5797-0x0000000005650000-0x00000000056A0000-memory.dmpFilesize
320KB
-
memory/4008-5798-0x00000000054B0000-0x00000000054BA000-memory.dmpFilesize
40KB
-
memory/4008-5793-0x0000000005530000-0x00000000055C2000-memory.dmpFilesize
584KB
-
memory/4008-5800-0x0000000005AB0000-0x0000000005ACE000-memory.dmpFilesize
120KB
-
memory/4008-5805-0x0000000006260000-0x00000000062C6000-memory.dmpFilesize
408KB
-
memory/4008-5794-0x0000000005AD0000-0x0000000005FCE000-memory.dmpFilesize
5.0MB
-
memory/4008-5843-0x00000000081C0000-0x00000000081CA000-memory.dmpFilesize
40KB
-
memory/4008-5860-0x0000000005700000-0x0000000005712000-memory.dmpFilesize
72KB
-
memory/4008-5861-0x00000000057B0000-0x00000000057EE000-memory.dmpFilesize
248KB