Analysis
-
max time kernel
1199s -
max time network
1173s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
11-08-2024 15:36
Static task
static1
Behavioral task
behavioral1
Sample
em_wh1U8LEO_installer_Win7-Win11_x86_x64.msi
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
em_wh1U8LEO_installer_Win7-Win11_x86_x64.msi
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
em_wh1U8LEO_installer_Win7-Win11_x86_x64.msi
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
em_wh1U8LEO_installer_Win7-Win11_x86_x64.msi
Resource
win11-20240802-en
General
-
Target
em_wh1U8LEO_installer_Win7-Win11_x86_x64.msi
-
Size
94.2MB
-
MD5
f740670bd608f6a564366606e0bba8da
-
SHA1
c635e8453bf0f06c34d41d3319670e5dc966a5f4
-
SHA256
ba3cdc5190b44da96e5ecb5f39e2cbe3713984dc8062cdab679c759de51500b1
-
SHA512
88f1e800265e4e72f914e50240a6a7cca630ea4bcd6981be13237cc6f42b182741542b907737490a367453c179ace55fb64c3e0fb2cb6ecf1bace7a442458e0e
-
SSDEEP
1572864:SX+lBWb7cVOxi2CDRq/SUx6EIL2CjmFkm+pF7Vxo81MOL9vh12epl37cTLiAhRLh:nLYxsRq/76L2CjmCZpRXouxvD6LbhRHJ
Malware Config
Extracted
lumma
https://swinngydisaosp.shop/api
https://writerospzm.shop/api
https://deallerospfosu.shop/api
https://bassizcellskz.shop/api
https://mennyudosirso.shop/api
https://languagedscie.shop/api
https://complaintsipzzx.shop/api
https://quialitsuzoxm.shop/api
https://tenntysjuxmz.shop/api
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe" msiexec.exe -
Blocklisted process makes network request 3 IoCs
Processes:
msiexec.exeflow pid process 2 600 msiexec.exe 5 600 msiexec.exe 7 600 msiexec.exe -
Checks for any installed AV software in registry 1 TTPs 8 IoCs
Processes:
ITSMService.exedescription ioc process Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS ITSMService.exe Key queried \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm ITSMService.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\ ITSMService.exe Delete value \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity ITSMService.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity ITSMService.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm ITSMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm ITSMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS ITSMService.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs
Using AutoIT for possible automate script.
-
Drops file in System32 directory 6 IoCs
Processes:
ITSMService.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ITSMService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E455012CBF4BA8A2AC67618C00590908 ITSMService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ITSMService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ITSMService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ITSMService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E455012CBF4BA8A2AC67618C00590908 ITSMService.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
AutoIt3.exedescription pid process target process PID 5076 set thread context of 2356 5076 AutoIt3.exe GoogleUpdateCore.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
python_x86_Lib.exemsiexec.exeMsiExec.exedescription ioc process File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\AutoExpand.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\distlib\_backport\misc.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\install_lib.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\justify.xbm python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\bsddb\dbrecio.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\trie\__init__.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Maseru python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT-9 python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\bitmap.tcl python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\xmfbox.tcl python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\xml\sax\handler.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\distlib\wheel.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\New_York python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\Victoria python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\Variable.tcl python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Omsk python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Brussels python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\resize2.xbm python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\DLLs\unicodedata.pyd python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\rfc822.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\hebrewprober.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\macJapan.enc python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\hotshot\stats.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\mbcharsetprober.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\sbcsgroupprober.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\version.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Algiers python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\edr-plugin.dll msiexec.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\token.ini MsiExec.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\copy_reg.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\generator\msvs_test.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\poplib.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Antarctica\Syowa python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\compiler\ast.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\sanitizer.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\North_Dakota python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\symtable.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\nl_be.msg python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Los_Angeles python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Manaus python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip-7.1.2.dist-info\RECORD python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\mk.msg python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Vladivostok python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\xml\dom\xmlbuilder.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util\connection.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\cp1254.enc python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\da.msg python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\Lord_Howe python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\contextlib.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\email\mime\text.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp865.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\macosxSupport.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Samara python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\filebox.xbm python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\images\face.xbm python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\images\README python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\_strptime.py python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\install_egg_info.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\site-patch.py python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\id.msg python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Antigua python_x86_Lib.exe File opened for modification C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\README.txt python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Ulaanbaatar python_x86_Lib.exe File created C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\images\tai-ku.gif python_x86_Lib.exe -
Drops file in Windows directory 19 IoCs
Processes:
msiexec.exeMsiExec.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI959A.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503} msiexec.exe File opened for modification C:\Windows\Installer\MSI97AE.tmp msiexec.exe File opened for modification C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIB908.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5792e9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI94DD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI98AA.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI9DFB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9E5A.tmp msiexec.exe File created C:\Windows\Installer\e5792e9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI983C.tmp msiexec.exe File created C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIAC07.tmp msiexec.exe File created C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e5792eb.msi msiexec.exe -
Executes dropped EXE 9 IoCs
Processes:
python_x86_Lib.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exeRmmService.exeRmmService.exeRmmService.exeAutoIt3.exepid process 1628 python_x86_Lib.exe 4344 ITSMService.exe 1032 ITSMAgent.exe 3952 ITSMAgent.exe 1112 ITSMAgent.exe 2732 RmmService.exe 3428 RmmService.exe 2752 RmmService.exe 5076 AutoIt3.exe -
Loads dropped DLL 64 IoCs
Processes:
MsiExec.exeMsiExec.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exepid process 4808 MsiExec.exe 4808 MsiExec.exe 4808 MsiExec.exe 4808 MsiExec.exe 2264 MsiExec.exe 2264 MsiExec.exe 2264 MsiExec.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 3952 ITSMAgent.exe 3952 ITSMAgent.exe 3952 ITSMAgent.exe 3952 ITSMAgent.exe 3952 ITSMAgent.exe 3952 ITSMAgent.exe 3952 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 2264 MsiExec.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1112 ITSMAgent.exe 1112 ITSMAgent.exe 1112 ITSMAgent.exe 1112 ITSMAgent.exe 1112 ITSMAgent.exe 1112 ITSMAgent.exe 1112 ITSMAgent.exe 1112 ITSMAgent.exe 1112 ITSMAgent.exe 1112 ITSMAgent.exe 1112 ITSMAgent.exe 1112 ITSMAgent.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
python_x86_Lib.exeITSMAgent.exeRmmService.exeMsiExec.execmd.exeITSMService.exeRmmService.exeAutoIt3.exeGoogleUpdateCore.exeMsiExec.exeITSMAgent.exeITSMAgent.execmd.exeRmmService.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language python_x86_Lib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITSMAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RmmService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITSMService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RmmService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AutoIt3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdateCore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITSMAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITSMAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RmmService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AutoIt3.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AutoIt3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AutoIt3.exe -
Modifies data under HKEY_USERS 60 IoCs
Processes:
python_x86_Lib.exeITSMService.exesvchost.exemsiexec.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" python_x86_Lib.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" python_x86_Lib.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs ITSMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" python_x86_Lib.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT ITSMService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs ITSMService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs ITSMService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 ITSMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" python_x86_Lib.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ python_x86_Lib.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53 ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust ITSMService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs ITSMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople ITSMService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53\Blob = 03000000010000001400000040cef3046c916ed7ae557f60e76842828b51de5314000000010000001400000017d9d6252767f931c24943d93036448c6ca94feb040000000100000010000000886ea78b530e0fd5bda4e12527ab6a2c0f00000001000000300000005d2164164eb6f3820b9b8d7a5601b60ebf70d832d2029c6c3c966db107dfcb1ba12a25700f26ca3d5b36e4a6cb576cfa19000000010000001000000092a08f142bb795a2197a0d3c7af066f55c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001d0600003082061930820401a0030201020210137d539caa7c31a9a433701968847a8d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a308195310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313d303b060355040313345365637469676f20525341204f7267616e697a6174696f6e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a02820101009c930246454a524892fc578df92dea53beb32cd5d8a8a5ec5b6903c01d10f65933defe0748a8e88c7a674af1f58dc33766d03291f7c49d0460c4b54ae2838ba7ae26d45d3a5ef8d11671bb8abd71a27dc8cea26024b052a03a4551de78936c6260f1e4569cb73bf73c55d8dfd57a317c357f125170e12cbe04accbfa4fe17c656ac040a7d97ca5638419e1f7caefaab4e8585ad999e326df8e12b2b8dc33b236da141d965842406e0b22851c5122aec4c806456d92e667b71923e4d8366b85d07fc752e3cfb07501e089b4a8bf8a364ea3e06ceb8441cea52f482213975062451e09a5cc9f6c57704006db20e81bd6f3938ba7329eb7441509d7affd7c011cdb0203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e0416041417d9d6252767f931c24943d93036448c6ca94feb300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020230500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201004e134096c9c3e66e5bc0e3baf417e1ae091fc9bfcb0c2516f27353b3761ab7ab4806d6cd007c204543456c165a1b1361d749baa402a4ace8cece2dc92a74a3dcdeaeabd06836f891af3c01f777d50bcf97abeb87e715a8fa305a617120b1c043c4b98f6d8a31eb153624fb62d50b9c8fe966bde661519793b61d87bdb0b56cfea6112906613431303d20277351d0de8583d37739204696daa7c65a162785b2cf4e0f4e8c5cbebe3800f84bf9727bd4f27ad7a22985d004bad3422c5188522ed13d246747ec55cc1bf4ca34ea26c1deddc42189f6ba7b321e8e965e844538cf80aa37698b6017741548919c6df04ea377ca1b1c48faf9cf49e85f4f850ae28f901bab704c9aebb7a63fb4ac5da45fcfe6d88a9690f74f268160765d0f247791b32a319f165ab25d8c1c29aa489c8e6fd3784070db77ecdde3d15705702de64998880584620570567686394ed3226f1dfe6df10eb362c43ccbc085b9611ebae1158059940cae05bb8c7f56be1cd25abf97f26a4cb0c67076b0908dc10b36b911d8d6285cea4ffe24b7180a9b0cd0c17c5cfb69bdcca24dc690bca64df2b1bad69a675b960252d082f9c40a5c0d28e03fc8fa959589d5a4be496c40b23ea86bb8d525b2c4fef1d3d7e7d6dc43017630fb3b8b5df74a897c9a35befccaf05701f08d3fa087327b475a974b82d266c2c42dea3f24f4a7f9a8b9e36ad91861a03b8c15 ITSMService.exe -
Modifies registry class 25 IoCs
Processes:
msiexec.exeITSMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CDM\proxy = "false" ITSMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductIcon = "C:\\Windows\\Installer\\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\\icon.ico" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Version = "151109272" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\DeploymentFlags = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CDM ITSMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\07EFF3737FF5D2942A4FC0A6518D5D30 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\PackageName = "em_wh1U8LEO_installer_Win7-Win11_x86_x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\PackageCode = "D7076E96D3235814DB26ACC95D2BAD84" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductName = "Endpoint Manager Communication Client" msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
Processes:
ITSMAgent.exeITSMAgent.exeITSMAgent.exepid process 1032 ITSMAgent.exe 3952 ITSMAgent.exe 1112 ITSMAgent.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
msiexec.exeITSMService.exepid process 1484 msiexec.exe 1484 msiexec.exe 4344 ITSMService.exe 4344 ITSMService.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exesrtasks.exedescription pid process Token: SeShutdownPrivilege 600 msiexec.exe Token: SeIncreaseQuotaPrivilege 600 msiexec.exe Token: SeSecurityPrivilege 1484 msiexec.exe Token: SeCreateTokenPrivilege 600 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 600 msiexec.exe Token: SeLockMemoryPrivilege 600 msiexec.exe Token: SeIncreaseQuotaPrivilege 600 msiexec.exe Token: SeMachineAccountPrivilege 600 msiexec.exe Token: SeTcbPrivilege 600 msiexec.exe Token: SeSecurityPrivilege 600 msiexec.exe Token: SeTakeOwnershipPrivilege 600 msiexec.exe Token: SeLoadDriverPrivilege 600 msiexec.exe Token: SeSystemProfilePrivilege 600 msiexec.exe Token: SeSystemtimePrivilege 600 msiexec.exe Token: SeProfSingleProcessPrivilege 600 msiexec.exe Token: SeIncBasePriorityPrivilege 600 msiexec.exe Token: SeCreatePagefilePrivilege 600 msiexec.exe Token: SeCreatePermanentPrivilege 600 msiexec.exe Token: SeBackupPrivilege 600 msiexec.exe Token: SeRestorePrivilege 600 msiexec.exe Token: SeShutdownPrivilege 600 msiexec.exe Token: SeDebugPrivilege 600 msiexec.exe Token: SeAuditPrivilege 600 msiexec.exe Token: SeSystemEnvironmentPrivilege 600 msiexec.exe Token: SeChangeNotifyPrivilege 600 msiexec.exe Token: SeRemoteShutdownPrivilege 600 msiexec.exe Token: SeUndockPrivilege 600 msiexec.exe Token: SeSyncAgentPrivilege 600 msiexec.exe Token: SeEnableDelegationPrivilege 600 msiexec.exe Token: SeManageVolumePrivilege 600 msiexec.exe Token: SeImpersonatePrivilege 600 msiexec.exe Token: SeCreateGlobalPrivilege 600 msiexec.exe Token: SeBackupPrivilege 4168 vssvc.exe Token: SeRestorePrivilege 4168 vssvc.exe Token: SeAuditPrivilege 4168 vssvc.exe Token: SeBackupPrivilege 1484 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeBackupPrivilege 1596 srtasks.exe Token: SeRestorePrivilege 1596 srtasks.exe Token: SeSecurityPrivilege 1596 srtasks.exe Token: SeTakeOwnershipPrivilege 1596 srtasks.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeBackupPrivilege 1596 srtasks.exe Token: SeRestorePrivilege 1596 srtasks.exe Token: SeSecurityPrivilege 1596 srtasks.exe Token: SeTakeOwnershipPrivilege 1596 srtasks.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe -
Suspicious use of FindShellTrayWindow 22 IoCs
Processes:
msiexec.exeITSMAgent.exepid process 600 msiexec.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 600 msiexec.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe -
Suspicious use of SendNotifyMessage 20 IoCs
Processes:
ITSMAgent.exepid process 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe 1032 ITSMAgent.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
ITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exepid process 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 1032 ITSMAgent.exe 3952 ITSMAgent.exe 4344 ITSMService.exe 1112 ITSMAgent.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe 4344 ITSMService.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
msiexec.exeMsiExec.execmd.exepython_x86_Lib.exeITSMService.exeRmmService.exeRmmService.execmd.exeAutoIt3.exedescription pid process target process PID 1484 wrote to memory of 1596 1484 msiexec.exe srtasks.exe PID 1484 wrote to memory of 1596 1484 msiexec.exe srtasks.exe PID 1484 wrote to memory of 4808 1484 msiexec.exe MsiExec.exe PID 1484 wrote to memory of 4808 1484 msiexec.exe MsiExec.exe PID 1484 wrote to memory of 4808 1484 msiexec.exe MsiExec.exe PID 1484 wrote to memory of 2264 1484 msiexec.exe MsiExec.exe PID 1484 wrote to memory of 2264 1484 msiexec.exe MsiExec.exe PID 1484 wrote to memory of 2264 1484 msiexec.exe MsiExec.exe PID 2264 wrote to memory of 2440 2264 MsiExec.exe cmd.exe PID 2264 wrote to memory of 2440 2264 MsiExec.exe cmd.exe PID 2264 wrote to memory of 2440 2264 MsiExec.exe cmd.exe PID 2440 wrote to memory of 1628 2440 cmd.exe python_x86_Lib.exe PID 2440 wrote to memory of 1628 2440 cmd.exe python_x86_Lib.exe PID 2440 wrote to memory of 1628 2440 cmd.exe python_x86_Lib.exe PID 1628 wrote to memory of 5080 1628 python_x86_Lib.exe cmd.exe PID 1628 wrote to memory of 5080 1628 python_x86_Lib.exe cmd.exe PID 1628 wrote to memory of 5080 1628 python_x86_Lib.exe cmd.exe PID 4344 wrote to memory of 1032 4344 ITSMService.exe ITSMAgent.exe PID 4344 wrote to memory of 1032 4344 ITSMService.exe ITSMAgent.exe PID 4344 wrote to memory of 1032 4344 ITSMService.exe ITSMAgent.exe PID 4344 wrote to memory of 3952 4344 ITSMService.exe ITSMAgent.exe PID 4344 wrote to memory of 3952 4344 ITSMService.exe ITSMAgent.exe PID 4344 wrote to memory of 3952 4344 ITSMService.exe ITSMAgent.exe PID 4344 wrote to memory of 1112 4344 ITSMService.exe ITSMAgent.exe PID 4344 wrote to memory of 1112 4344 ITSMService.exe ITSMAgent.exe PID 4344 wrote to memory of 1112 4344 ITSMService.exe ITSMAgent.exe PID 4344 wrote to memory of 2732 4344 ITSMService.exe RmmService.exe PID 4344 wrote to memory of 2732 4344 ITSMService.exe RmmService.exe PID 4344 wrote to memory of 2732 4344 ITSMService.exe RmmService.exe PID 3428 wrote to memory of 2752 3428 RmmService.exe RmmService.exe PID 3428 wrote to memory of 2752 3428 RmmService.exe RmmService.exe PID 3428 wrote to memory of 2752 3428 RmmService.exe RmmService.exe PID 2752 wrote to memory of 2256 2752 RmmService.exe cmd.exe PID 2752 wrote to memory of 2256 2752 RmmService.exe cmd.exe PID 2752 wrote to memory of 2256 2752 RmmService.exe cmd.exe PID 2256 wrote to memory of 5076 2256 cmd.exe AutoIt3.exe PID 2256 wrote to memory of 5076 2256 cmd.exe AutoIt3.exe PID 2256 wrote to memory of 5076 2256 cmd.exe AutoIt3.exe PID 5076 wrote to memory of 2356 5076 AutoIt3.exe GoogleUpdateCore.exe PID 5076 wrote to memory of 2356 5076 AutoIt3.exe GoogleUpdateCore.exe PID 5076 wrote to memory of 2356 5076 AutoIt3.exe GoogleUpdateCore.exe PID 5076 wrote to memory of 2356 5076 AutoIt3.exe GoogleUpdateCore.exe PID 5076 wrote to memory of 2356 5076 AutoIt3.exe GoogleUpdateCore.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\em_wh1U8LEO_installer_Win7-Win11_x86_x64.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:600
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 963C39A03ABE35E976C6B951E7BBA7062⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4808 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0B1F20B3CA74936C04A0537E30B7BAE0 E Global\MSI00002⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "5⤵
- System Location Discovery: System Language Discovery
PID:5080
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1692
-
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1032 -
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3952 -
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1112 -
C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --start2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2732
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1368
-
C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --run_procedure --in Global\sharedInputMemory_1 --out Global\sharedOutputMemory_2 --err Global\sharedErrorMemory_32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "AutoIt3.exe script.a3x"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\theistically\AutoIt3.exeAutoIt3.exe script.a3x4⤵
- Command and Scripting Interpreter: AutoIT
- Suspicious use of SetThreadContext
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe"C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe"5⤵
- System Location Discovery: System Language Discovery
PID:2356
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:736
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3904
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1288
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e5792ea.rbsFilesize
709KB
MD5a413fe93a83e5368e752a2d78cb8d931
SHA1cf834a10ce7f1b5f7dbde1fad8cfcb02c0f07b07
SHA2566169fe65e55c8484adc9a3542c5c19f505261a68559f01d74cdee4408cd76e54
SHA5127ed4fa33ab9ce0caf191e8113e579ac3bc645baf62d8cc357fe0b456c9fc9a133d0edfccda19ef5d01d7470f671cb0b2700890effee44d40c8708c15aeb85753
-
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exeFilesize
3.0MB
MD5a5b010d5b518932fd78fcfb0cb0c7aeb
SHA1957fd0c136c9405aa984231a1ab1b59c9b1e904f
SHA2565a137bfe1f0e6fc8a7b6957d5e9f10df997c485e0869586706b566015ff36763
SHA512e0ca4b29f01f644ef64669ed5595965b853ae9eaa7c6c7d86df7634437041ef15ceb3c2d1ab9dec4171c80511684a7d7b06fc87b658e5a646699eb9523bc4994
-
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exeFilesize
8.4MB
MD56b4752088a02d0016156d9e778bb5349
SHA1bd13b1f7b04e0fe23db6b3e4bd0aa91c810e1745
SHA256f64f13bf19726624a9cbaedda03a156597737581d6bc025c24e80517f5cab011
SHA5120fe982b0b551238fc881511cdd0656ee71f22aca3a5e83ef7ce41b3adf603f1be17ba3e2c10797ee3dfb5e15ff1ac3e8cf4e05c657e7c047f302f50baa42ba2d
-
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safeFilesize
2B
MD581051bcc2cf1bedf378224b0a93e2877
SHA1ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA2567eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA5121b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
-
C:\Program Files (x86)\COMODO\Endpoint Manager\MSVCP140.dllFilesize
426KB
MD58ff1898897f3f4391803c7253366a87b
SHA19bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA25651398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
SHA512cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03
-
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Core.dllFilesize
5.1MB
MD59356330cdf731eea1e628b215e599ce5
SHA188645c60b3c931314354d763231137a9ec650f1b
SHA256ad045d1d084a88fe3f48c12aee48746b22cb3a579f9140840c54ae61f7af3478
SHA5123d9ab9b1cdecad6809be96d82df2d1b9b8c9e1a7cf0ac79a820a92b11c8fa079f5a2c3875ba0b733503742c6977d6239ce22acec023a22038b2e7ee1ebd62d90
-
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Gui.dllFilesize
5.2MB
MD5d29d11da9f344f6d679a0de7b3174890
SHA1b4cac4aa9c6b82e8d2d0c43991e8073261c13089
SHA256079e3a248d169143a3d5da48d24dbcc0ce5fb8aaccbc02a6fce61c5fe2461b9f
SHA512b43f2ef86d6fe4beb28a10e19834a4f76dbaddd071d16353b2641b72f2faa552a3bdba33a606da71a34ebb932f57dd142758b4a0a240231022c8bed8ee97cad6
-
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Network.dllFilesize
1015KB
MD5de150de21f1a2b72534eaa4aa4f03202
SHA139ed224cced1266d4adc5e68f6516979b8f52b33
SHA25603871db7d626d14e84d8ebf007139aa2c08038cd3403ac6259f1a2eb01ae1477
SHA51230eff193620724cda86e6de31c430f9d4426e677a553c7918f9b85dbfc67687acdecc2a29e45473666c01ce311b73833d9f79db8a93e80570c7ace8837ca531a
-
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Sql.dllFilesize
174KB
MD588aeafdcc3f3fa04b9b20022906745b0
SHA19dc03428234000d19bbc3cb437d370b8e1863329
SHA256cd84c9c486c3e967ddd061718893ef5ee48eca24f77e3366b8fd3d2dd21f477f
SHA5125ea87730f26b16215eb2b892a6da689524546ef6cfaf4e6c1f4e0afa083ceec3e8f00c9259d316d84ef4cb05b01023a1362b4a676d10b55e06ee365557ab7986
-
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Widgets.dllFilesize
4.4MB
MD513f078d5c63cb192f68b45f5767a9e6f
SHA16149189a1553c2e0e6d715d3177c16c11af7d33a
SHA256b0abf95a23e1616f3542a8cb794aac5b7463dff3db8621e3cd719ab1dd7f6226
SHA512f3293fcdccb4901d4eb405706ad20da361140842a335e6f6a7ce54222fe028a1da2179be14ec40dbb5a1784ed5d33bd467174091606e6fcac12039dc0f48e52a
-
C:\Program Files (x86)\COMODO\Endpoint Manager\libssl-1_1.dllFilesize
533KB
MD5bf2cae7a6256b95e1ba1782e6a6c5015
SHA13fbdc3afa52673c7bdfab16b500bbe56f1db096b
SHA256352d2fd16675855e20cc525b6376734933539b76bc4b40d679d3069008fe4cfc
SHA51290755eb718ba404b0e48a6713d4680db252f8156328a58fc347e74d84b8bd53a7a6276755c672240c0e5d78200130e3ddf86990779ddd86c6d10cebf2bc02c9e
-
C:\Program Files (x86)\COMODO\Endpoint Manager\log4cplusU.dllFilesize
471KB
MD50b03f7123e8bc93a38d321a989448dcc
SHA1fc8bfdf092cdd6b9c1ec3b90389c035c37e50bd7
SHA256a7fbfdb3100c164f139e9d0ebcf47282308e5173ab610dcb20a05b6e0615b54b
SHA5126d00c65111c0f389ad189178705ed04712b2c6de8918f58de7c3747126a4b4e50b4a73525cc0993af02d35323b1430f34baf6f99712df822d6cdc63e24ed7ae5
-
C:\Program Files (x86)\COMODO\Endpoint Manager\proxy_settings.iniFilesize
101B
MD5273ec42863e3d9f999381f09c13d313b
SHA1008d1954b2a7d1c692a697c891f9692f41f10481
SHA2564dd2c699bbb8c398788067be6fc82edc68c8246b8f6765169776bb24ebd0c487
SHA512940df3f73592ccabc27bf2cc77de98eade7eb8988d30144060c817eda614085e36eadb699b02123c63774416e827194c269acd1267fad1d560b7df86a79ed89b
-
C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exeFilesize
7.2MB
MD5dcebee7bb4e8b046b229edc10ded037f
SHA1f9bdf0b478e21389800542165f721e5018d8eb29
SHA2562eb0eefab534217953744c2cc36de2e1a1ced6ea882734e7b1f4b34a0b19689b
SHA5129827600a19da5a816f1b0d93aa2629cb48f13f6e5fc42cd44bb1031ecd2e942854b34e7da44335acb85e42c44b1e720e9da8bc1d9ad23a9b1de0190f026f4d30
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.logFilesize
65KB
MD597ecc9d2f0e8122c390da2fba3ce0a30
SHA1d81b4720f1aa2351a7e5ae845c6aff308a71792e
SHA256128e105f0960c8fb0203fccb7182d9d36b25a76c2224854237dd41f780b25b93
SHA512957b7fcf0844024f55d678837e8c740bc9aa01078c81c3a03152ff454d37e20c0b269d1ffe5efdc5738aefd53c4bc7a2d60fdb859330c26d635c400f114ec476
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1Filesize
33KB
MD5da6764e2bdb3b988b7c7eecd62c39b36
SHA1cb883a4feab90b85e8ed5277f8770615bf748308
SHA2564feb733a6106068d2f4c642ccc4aff70ab539033ca52ecdb89253b3761cb025d
SHA5124cce4e1fb7a3ae0757a78453504cc8d0deb5f24d575a23b13c5c7c9a20538bcb47c91913b2ed0dab9b110dbbed140266e6aeae76770a0e2abec2f170912b879f
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.2Filesize
33KB
MD53223c316cee2e46b52caa6f13f67f0a3
SHA133885c0aa4e5a65b4a6ca8463bf680068d2c8cf8
SHA2569ba8b32e39dc43db5e29990f4a15f5fc0f1867ae6919f3362713ec0b1a8a5381
SHA51266110cb7a910495a7c9c8c51e669bff38d76e07286db4447294b7c42164caf3aea4af99b22a01d5c458a2a518f014a3c24baab5f312893f0d3e69fcc1bd330fc
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.3Filesize
33KB
MD51ef70ca2bf2c84d80efbfb5420eaa9bf
SHA17afb50f809a80d87a48d9f187a5df6610d2a0eef
SHA2563ec0ce3b15f713c06493f208891dff683d1e2e50abda7c66419a9b200cc21c5e
SHA5124a2d1636ed6c85e8096202f6943591f56cf8a96f480abd597317ac673cc133822169a573604da220a2aed2b258704f59eb3762b7f7d11208cfbe3e7356312457
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD55917f4630e308f3f741735cdb1f468b8
SHA192be32db04ea7c34706fa24b4b2a217cc9a99972
SHA2562d1aa572f0cfb627d8264ab16bbd385a8ec2fd8e0d58afbf16b66416ac52aef7
SHA512bb1ca46984e05e5612d34dc36cca851b170ad73b4d292d096fb25389b54610ea053065fb8f3ce831641ef3ab436810a63374e1ae87e3fbbe071303197c43af93
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD516f34b1b87cd763228be48aee1bfe5ed
SHA1591140c1e23ccc22cf2231b9f3444fe8b609eb88
SHA25602c6957abbdc1ecb3941ee9e8a487233cc48ad2e005fd00cca8d87d79b8e310f
SHA5126cc1cb4c46514df6006db2b4193c38003beaf22ffcc69d5fdd2e0c1bfaa1408e2f7a41919290a515d29fd90a61791a56fda0b55d0f161abbbcdccf8d68eb97c8
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5e19ca9db4c9556bb771cce90734eec6b
SHA190c386db3888997acf3d50372bf2e60bfe241254
SHA256a416ce654ed32535c38c3e7d673911ad37674fb09aeb65f43caac22c29eddc74
SHA512a751fa846f307ec3d70e5140409be8e7dc10411bc01fbb4bd2d49b8e8aeb3557e525f31918b77732ad626e300e6a0225e45386673efd9e6f07ce3e435e377686
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5ff059d2419b3c85ed252779327de80d2
SHA15fd1b51a887de814f89c88a00b141e413252f77d
SHA2565f5fdfb46494de0f268f6705dbbb02f4200d5f22a5704356b68d1453cf309533
SHA5123bf12b481d43c2e356d5713517c630dc9cd6134aa1dd87f7e1a0547624741b220fc6baa1e511b002a83dd9b7353cf2e86640d69cdd6d503e38e5dd3b38471164
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5b02cc3ea04df6ae2cf40ad89ecdc8aa0
SHA1a1a4d62518604e1f81b4c428267e1aec1fed8db2
SHA2562a4a616d70cb616f1fb82c55b189c1857e4b11844f7d700462e946c30dae0509
SHA512da529b1e52ef62806ee4421ac31dfdcac17eb41a20c69afb4e919dd9b5339313ca258f3b9e6ee7de550568985176578f71d3d4147143c1c889041217d066e1e0
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD524fb990b8b6e7206932c6072cf2fab3c
SHA10604fc3de7beaa57b527415e208e8a371d22989f
SHA256402093c82277243451a4eec3541a43cbf8493e893f51c332f6ad8a8be5d71b62
SHA5127c5504a77c1efa3e5140d01b869b48d6fdd5490587ed2eb83d991a1123dd762e0836327163730456f7ab9b81aedfbd1fcba3a26de5473a88b7e2b46cbb927244
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5a93b67dc4da1378756eda9b8141c854f
SHA17df567cf798c14c26fd1f6770d851b250f5645b8
SHA25604a9af4d8fd51ab00407322d9818a9b7bc4995419a685f63a57d0290602f629c
SHA51244650f7f78cac16d1bb9925f3dc4f6da9b9f1f2cd1b69bd8a50246c9a9852ad06feabec9ef3603b3106be7527e001295b775872e80387cd0cb0eacbe518b4613
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD543e6c2f0559d17a9e84dd697dc57423d
SHA1f9e0201b93b87b7552f2624ef165f90467b8b4f2
SHA25611b22762903fd4d1092b787f7c1e37157964e09d5dbbb59892202cf7df5bd896
SHA512fa35fefe90c52b6ce2280ac2228e5ba57909fbcec5d0a790ac789cff83f9298f5f2a75ead564d109bc1160b5ff07aee2265b0a4a4640bd89b56b961b12290168
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD51ddafb47aa7d9e1de92fde3915ed6142
SHA1faf90c17a0beebff92ab977351c4b8c39288e91e
SHA2566d1b0a18497f9cd60848ce503bd6a02f08b7007157ce6f0cc700bca1d1dcbee3
SHA51297a75b8c0ce5e18bb849e9b44c150bcfd4bdf6de0f6d4e2cc3efa406c40ba50f58f2ae4d1eb42a3dc78989c6be3f3cd1efa214dda40015d0297672ad3a881320
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD56812c7faed51ea7323cd396495187595
SHA16a09ea805c3fbcbf83dfe1e5fc115a8edf4de93d
SHA256df1f4094179966f9b8d3ab4857da0a014f87324aefb8ba76202b37a7294e2fe8
SHA512b8102bd4c65e0999a42e7af2b22c839316e5aa57ba1043f1c0261c76659e589ad2af680f8e2f53b1a57ffe7ed26b6ce5a21604ab3517b4afea3ad14db30be2b8
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5773ba123a936d78845d30468a7bf2863
SHA126b68bfe684fa4fa9e97e4de5a632c6fc90ea3dd
SHA2561b0a3d1eb4cf1c0ede33b7ceef149eb192a513e9b13642e3c653553a8ade71e8
SHA51247f73fab486c5787ebf1262431757c175fdf8131d9cd60562ca8c6ad2b05457c02e0006f9f8bbd487c3afdb381e932fb8102d39cf99f984d8d11376a63bff57d
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD563b7c6d6bd0a181d20e199b3ff02a9f7
SHA1470672b848bdcaa08537697a9736b75196cf9255
SHA2564162939bfe818ce2b6ef3b10562b341c702db8a976cfad0edcc78c1d8c8f84b7
SHA512f58c624d35926de54bdad7b66c12d546bd7fff3cce8dda85451401c1f07ac1561fbb0ee1a652d3299c58b5d5ac15a8656baa5a77e12bb4334040360502a3eb17
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD5b81ce80a2257d2440801bc3eb62fc3d0
SHA1d21326b530bafc2edc8dc3dd54aab80e5ad353d5
SHA2569f25e57822f1ad0109572fb6dfa35f1764ba4218a08f661e711460c5e843a17a
SHA512ece6acc0cb975dbec76311de20cf008bf832ad6758cf01d8a78c78b3d1eec7bbc81872a78e3fd7d95962df04b2af3edec66b5525b41dc3d25f2827843180ce5c
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD57a586dbf0fc1770ea5cf70927e729003
SHA127a988b1e2cbfb809f47e6960f47ebc549093797
SHA2566b7d591089dbce8fe83a515055a014073615211ac7d73760677e60c73d3b01c5
SHA5124192ec9da5df9a5376798afb6dda744ef72bc580469c23c851b80e47c9a956f63d2c9922537111af5061f7833ffe13b552ff8aa366cfa0e831ce649756f979b4
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
32KB
MD5b83940967d9098174d5dc1efbd444218
SHA15044a57bb2a6dcfd8ff6f9cd32139a7a292e5468
SHA256b56c0a9ffe883624b1d7d82b83bad731fcae75a8facc3fd05e58e37a050cbfe5
SHA51232e87d07c65c2a1f5987b38c3be8fe7f7665f62b1ac3a64fa96966d55dd97072b493757492e8cd486908bea59da3feb9d311fe657db3ebaec74452dae9d30a4f
-
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4Filesize
33KB
MD50ef05dbd08e57cd2725d0618a0d50cad
SHA1bb5647fa99dab33dbb4766f67b26a4d38bdd6286
SHA25629e318782729f2bb36165b1bc5add685849fd78c55920cb42348c733f054cfac
SHA51203add5d378bc0146e95024639991105c7c26f5ca433bae10cf1a5c2b46c94aa85573b50e6b2ed0eba2136984dd344802f2345346bbe04bd73b7a8686dfc23cf8
-
C:\Program Files (x86)\COMODO\Endpoint Manager\token.iniFilesize
8B
MD516674a4fdd74f7a049320075c9665d93
SHA1574c925e2d534034b08dff253071fcc1c2309e3a
SHA256c7df218540f5780d54f5591c888acdee8ee5fbc3337bf6b8d8bad66709895446
SHA51244b7ac04e901b7e5876f5fe8c44a91258836dffa73b7eadf8b8daec78f3dc124eb140f1cc0bc2442ec75742c429aa4b8f878582c52b77d65c8d562099082e371
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013Filesize
765B
MD5fff2cc217cec93b9b4e91ea34e23efaa
SHA1c6a7f0e18796e1c6b789ec9fb7e98fbc639bc1df
SHA2569bd2f914e637e30ba764c0af86102be829546122e443b30588e5e9723a15873b
SHA512f426e383b51806458533ddd15e4aec6cddde1acf497b8a84542818c4dffa3b5c21093a075a79a8e46ce5ddf6d16be9ed66c339724c63f76c6be7bd048cef5a3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784Filesize
637B
MD5f29448db915ce12024c00f8db2735a37
SHA18c42cc59bf9684c8913d77b6481d6f9a35291fe2
SHA2561220fbb03d07705373e10fff29e767a41a523ff3bbd1280f1e6c313421bd6930
SHA512932aa9847dc8630259827605dbf4cca4a778fda7ae164b814d6d552086812395441389179094c01c0225477aafdf9f3e2daa235e5884cf6eba01d32ee54b6b01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225FFilesize
1KB
MD58991f83c49d2736793a0c917c3d8ae4d
SHA171752a06511633fcb9d2df14b507e555e4d1b17a
SHA256a94ee10e4836486a24b1020e70055b440e46b52913a6e9cd66d0cae467276990
SHA5126fedbb05506b87ca954be1e413a1ca2824ae3b060242e89a1002a06d6549838f2d9e09768a878211a1929ef9cd260415bb061a8a28d16ee6e647780fc7e8b3cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013Filesize
484B
MD508e416c63188c5e2bcff64e070451596
SHA1e63e9e40e936bd0455cd0b07aef788ebf779e0e7
SHA25628c05dbcf00e662482bf1bc990f977e697afb8c8aecc852ec0c7642317ac727f
SHA51268477763b4b9ff9e616ae2d58a9dc316f4159e83e18f4d28841160c0e0834b6693597f1af50862de1d28ea40b657e10c82b1a2ec6b8a32fc57ada3a5d84bb464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784Filesize
480B
MD56218561f4b84a2e4d7d3d2d43d859d51
SHA107adba9cff1167f62c459225518e69982a667efa
SHA2563cdbecc799b5c263182ffa531c6dc9396133d27210e8a93ba7a27d4c2a40caef
SHA512b06c617145e7224147db5212f06e6661380f5225a6523986cf7a522f42e549c926d247ea43434e83029f829532a0ba9b0a514516d3edc8e3abd27d7dbd4a9bcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225FFilesize
482B
MD5dd6544622fd79dbc330dd02c24b58f76
SHA1ba43d12ac68447c3e5cb26f4f027139ce94569d5
SHA256a218108690c69eea429740a2aa4ddeab3dc9190e9e4ad0d1516c17e9ed053a78
SHA51296daf6eeca30e52981a95b03071e5d4a83b45d4cf8447c33bef0023246dd5530dd4ca703d3ed469ed881050e73025b4205a33639194d1f8cd1da979baf8f29c2
-
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmdFilesize
226B
MD5feceaa82323f9de4d3578592d22f857d
SHA14c55c509e6d16466d1d4c31a0687ededf2eabc9a
SHA25661480b43136b02965f59e3256b8de1bf35caa7c084a7bcb3ed5f4236451d4484
SHA51282dac003d30eed4fc4e06ab4a426c9b7f355d777c243b710c5c0d3afc4c26d93874af2d0a542fca4a2038050b0d0fa8f63ed82e5f2771ae8a4de0f3b08d56d45
-
C:\Windows\Installer\MSI94DD.tmpFilesize
285KB
MD582d54afa53f6733d6529e4495700cdd8
SHA1b3e578b9edde7aaaacca66169db4f251ee1f06b3
SHA2568f4894b9d19bfe5d8e54b5e120cef6c69abea8958db066cdd4905cc78ecd58b6
SHA51222476e0f001b6cf37d26e15dfb91c826c4197603ea6e1fbb9143c81392e41f18fa10a2d2d1e25425baaf754bff7fd179ef1df34966c10985e16d9da12a445150
-
C:\Windows\Installer\MSI959A.tmpFilesize
203KB
MD5d53b2b818b8c6a2b2bae3a39e988af10
SHA1ee57ec919035cf8125ee0f72bd84a8dd9e879959
SHA2562a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2
SHA5123aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
26.0MB
MD5b0353995e921ab2e666d92a9b56c0981
SHA1d507f5cfb4b6a18adb077a77b331269611052873
SHA256c7692867340b8366651655af9c4a16832a3b9974730340d91d9e4b4f66ca088b
SHA512a1c5f58aaaab8b22a1aa50ca0772f7e80f304db51b2515c0448ef80de5bde0717228d0a84d6bb2d9d859d83ba263d63fadf1662c4b885fbb44c2fdd23dcfbf8b
-
\??\Volume{38fc5f00-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8b328b46-73f4-4d6c-8c39-9ca306f1a2c1}_OnDiskSnapshotPropFilesize
5KB
MD5c065149247ecc5601270ed28af79bbcb
SHA1898173599c13af47c6fb726fc3c0c071c33a3611
SHA25611c061118c696c244faab3c31f8c1b9d8f1b7b05c76b795ed776a563c5c49caf
SHA5120e0b4844d0ab6045c5b4c21296561940ff74cec4e0f80732a43aa18250cdbb8470631ebea1dd489111032b0c27c489ba921d6dd47d6229599f3fcc36ae83e93c
-
\Program Files (x86)\COMODO\Endpoint Manager\ApplicationManagement.dllFilesize
87KB
MD525c603e78d833ff781442886c4a01fe6
SHA16808adc90eb5db03163103ec91f7bc58ee8aa6d0
SHA25694afd301c1baa84b18e3b72d017b6a009145c16c6592891c92f50c127e55169e
SHA51284e33be97d97ae341d74fc8273d191df519616f12bec8ac2f89454897c30a5f7bf9115f208c8dae78da83f0ca7bf9e5f07544d37d87b07f63408fbc91e449d54
-
\Program Files (x86)\COMODO\Endpoint Manager\Qt5Xml.dllFilesize
163KB
MD54bac5e44b4b2f138f6608c661330dad0
SHA1b08ff311b24d9bbc48d4014d7a0cd0de129a19e7
SHA25659ba9deba38b1e652a046fd6b58847a58883f2d8c5c1e81acfa78d2daad98a1c
SHA51274871aaaf8dc3fc006f7a1fdc42eabf5a86e34674d34362b2b00bdebe023d78fa0e6a5ef4676dc038178a6eeb01a0ba1676f68a1cc6828ac8d4ece550106ee0a
-
\Program Files (x86)\COMODO\Endpoint Manager\Qt5XmlPatterns.dllFilesize
2.2MB
MD5e2749ff4266d5a933feb7685dfe375b2
SHA1f09a432c67f45fc2ed27c762db4176b7dd47e908
SHA256e4ee537b6a585ec7656afd9fc6fd3f655ff44bec6ff8ec291fc3e868caade27c
SHA5124efc6b0b8d39b47d9c415fc3bc7460e4f738e3694fac691bf94569549569a8d65270a54488af3ae49de9fabdbe518250ceee83f6633e1da407636e6e02bac8bb
-
\Program Files (x86)\COMODO\Endpoint Manager\libcrypto-1_1.dllFilesize
2.5MB
MD58f4ccd26ddd75c67e79ac60afa0c711f
SHA16a8b00598ac4690c194737a8ce27d1d90482bd8b
SHA256ab7af6f3f78cf4d5ed4a2b498ef542a7efe168059b4a1077230a925b1c076a27
SHA5129a52ac91876eea1d8d243c309dadb00dfae7f16705bde51aa22e3c16d99ccf7cc5d10b262a96cfbb3312981ac632b63a3787e8f1de27c9bb961b5be6ff2ba9f4
-
\Program Files (x86)\COMODO\Endpoint Manager\qdjango-db0.dllFilesize
132KB
MD5342249e8c50e8849b62c4c7f83c81821
SHA1618aa180b34c50e243aefbf36bb6f69e36587feb
SHA25607bc6eb017005500d39e2c346824eef79b3e06f60c46fb11572f98d4fe4083c5
SHA51232a44252926881edf916ac517cb55d53b0b1b5adcc5952a674d1707d2c1431a68b27e593b4c4fcab0648e3cbeddf3d4e8024ff2a3385af9dbd2b2244e518340a
-
\Program Files (x86)\COMODO\Endpoint Manager\rmmproxy.dllFilesize
154KB
MD584c848ca734892ea2e8ab90d84317ee3
SHA1a1b38d4f1b466061481bdfde7628139c908f7ee5
SHA25601c53abd5585992f9d62de40f4750899829b9e7e4a026b8d9f5d1cb1748a3fa9
SHA512cec124435d6d4c76497e7886ca317a0c12a9d8e77200ba94cf6a699b318b91cb4db886eba5a5161941a7dd349f827cd3694abb864d6e37a9084a208276bee7df
-
\Program Files (x86)\COMODO\Endpoint Manager\sqldrivers\qsqlite.dllFilesize
1.1MB
MD5d9d7b0d7386cd57e4301d57cb7294b4b
SHA1dcf385b8d3f9f99a07e1b7757508e5e4080f336c
SHA256a4ee1bc55369a13b3e721aa48e44de31c6f00439838e923ab7a66438fbab4002
SHA512e1568ce01edd46aabc795dd4eacab565ffc8dc0271129b5aa770f3763fba756a5de59aa4329510e65282bb19537874c6f307712a7fa2b6971f50dbee7b2664d7
-
\Program Files (x86)\COMODO\Endpoint Manager\vcruntime140.dllFilesize
74KB
MD51a84957b6e681fca057160cd04e26b27
SHA18d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA2569faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA5125f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
-
memory/2356-5645-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/2356-5646-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB