ba3cdc5190b44da96e5ecb5f39e2cbe3713984dc8062cdab679c759de51500b1

Analysis

max time kernel
1200s
max time network
1171s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11-08-2024 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

em_wh1U8LEO_installer_Win7-Win11_x86_x64.msi
Size

94.2MB
MD5

f740670bd608f6a564366606e0bba8da
SHA1

c635e8453bf0f06c34d41d3319670e5dc966a5f4
SHA256

ba3cdc5190b44da96e5ecb5f39e2cbe3713984dc8062cdab679c759de51500b1
SHA512

88f1e800265e4e72f914e50240a6a7cca630ea4bcd6981be13237cc6f42b182741542b907737490a367453c179ace55fb64c3e0fb2cb6ecf1bace7a442458e0e
SSDEEP

1572864:SX+lBWb7cVOxi2CDRq/SUx6EIL2CjmFkm+pF7Vxo81MOL9vh12epl37cTLiAhRLh:nLYxsRq/76L2CjmCZpRXouxvD6LbhRHJ

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe"	msiexec.exe

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow pid process

2 3992 msiexec.exe
8 3992 msiexec.exe
12 3992 msiexec.exe

flow	pid	process
2	3992	msiexec.exe
8	3992	msiexec.exe
12	3992	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

Processes:

ITSMService.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\	ITSMService.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs
Using AutoIT for possible automate script.
execution

AutoHotKey & AutoIT
T1059.010

Processes:

AutoIt3.exe

pid process

2160 AutoIt3.exe

pid	process
2160	AutoIt3.exe

Drops file in System32 directory 6 IoCs

Processes:

ITSMService.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E455012CBF4BA8A2AC67618C00590908	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E455012CBF4BA8A2AC67618C00590908	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	ITSMService.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

AutoIt3.exe

description pid process target process

PID 2160 set thread context of 996 2160 AutoIt3.exe GoogleUpdateCore.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	pid	process	target process
PID 2160 set thread context of 996	2160	AutoIt3.exe	GoogleUpdateCore.exe

Drops file in Program Files directory 64 IoCs

Processes:

python_x86_Lib.exemsiexec.exeRmmService.exe

description	ioc	process
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\DirDlg.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp437.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Tehran	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\he.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\St_Barthelemy	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Simferopol	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Vienna	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Hongkong	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\multiprocessing\pool.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\urllib3\packages\ordered_dict.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Atlantic\St_Helena	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\Victoria	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\SystemV\CST6CDT	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\MkScroll.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\site-patch.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Mbabane	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\iso8859-4.enc	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\12Point.fsc	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\filelist.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\HyperParser.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Dushanbe	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Thimphu	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Urumqi	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\EST	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\DirDlg.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\__phello__.foo.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\compiler\pyassem.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Tortola	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Tirane	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\TkWin.fs	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\ko_kr.msg	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Chisinau	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Sitka	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\dynOptionMenuWidget.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Merida	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\sgmllib.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\ACT	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Skopje	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\14Point.fs	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\xml\dom\pulldom.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\colorama	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\es_py.msg	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Halifax	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Uzhgorod	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Pacific\Niue	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\log4cplusU.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT-6	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\STList.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\lib\urlparse.pyc	RmmService.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\DLLs\winsound.pyd	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Singapore	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\widget	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Australia\Lindeman	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\DLLs	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\help.txt	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Resolute	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\email\quoprimime.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util\connection.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\install_lib.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Baghdad	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\SystemV\EST5	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\comdlg.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\version.py	python_x86_Lib.exe

Drops file in Windows directory 23 IoCs

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIBC3E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1ED.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDB7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5ABFA5C2265710E3.TMP	msiexec.exe
File created	C:\Windows\Installer\e57b6ad.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b6ad.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBC19F2462243BB34.TMP	msiexec.exe
File created	C:\Windows\Installer\e57b6af.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA0A.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC1E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC6E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC23D.tmp	msiexec.exe
File created	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\~DF0C5C11113A96DDC5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB8D0.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5AEE43F77959937F.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}	msiexec.exe

Executes dropped EXE 9 IoCs

Processes:

python_x86_Lib.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exeRmmService.exeRmmService.exeRmmService.exeAutoIt3.exe

pid	process
2100	python_x86_Lib.exe
4616	ITSMService.exe
3476	ITSMAgent.exe
340	ITSMAgent.exe
5812	ITSMAgent.exe
5232	RmmService.exe
3084	RmmService.exe
2872	RmmService.exe
2160	AutoIt3.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exeRmmService.exe

pid	process
5208	MsiExec.exe
5208	MsiExec.exe
5208	MsiExec.exe
5208	MsiExec.exe
3048	MsiExec.exe
3048	MsiExec.exe
3048	MsiExec.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
340	ITSMAgent.exe
340	ITSMAgent.exe
340	ITSMAgent.exe
340	ITSMAgent.exe
340	ITSMAgent.exe
340	ITSMAgent.exe
3476	ITSMAgent.exe
340	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
5812	ITSMAgent.exe
5812	ITSMAgent.exe
5812	ITSMAgent.exe
5812	ITSMAgent.exe
5812	ITSMAgent.exe
5812	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
5812	ITSMAgent.exe
5812	ITSMAgent.exe
5812	ITSMAgent.exe
3048	MsiExec.exe
5232	RmmService.exe
5232	RmmService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

3992 msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

GoogleUpdateCore.exeMsiExec.exepython_x86_Lib.exeITSMAgent.exeRmmService.exeMsiExec.execmd.execmd.execmd.exeITSMService.exeRmmService.exeRmmService.exeAutoIt3.exeITSMAgent.exeITSMAgent.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_x86_Lib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fd384c3a7d3ca1330000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000fd384c3a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900fd384c3a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dfd384c3a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fd384c3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AutoIt3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoIt3.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

ITSMService.exeRmmService.exemsiexec.exepython_x86_Lib.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	RmmService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	RmmService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	RmmService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ITSMService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53\Blob = 03000000010000001400000040cef3046c916ed7ae557f60e76842828b51de5314000000010000001400000017d9d6252767f931c24943d93036448c6ca94feb040000000100000010000000886ea78b530e0fd5bda4e12527ab6a2c0f00000001000000300000005d2164164eb6f3820b9b8d7a5601b60ebf70d832d2029c6c3c966db107dfcb1ba12a25700f26ca3d5b36e4a6cb576cfa19000000010000001000000092a08f142bb795a2197a0d3c7af066f55c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001d0600003082061930820401a0030201020210137d539caa7c31a9a433701968847a8d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a308195310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313d303b060355040313345365637469676f20525341204f7267616e697a6174696f6e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a02820101009c930246454a524892fc578df92dea53beb32cd5d8a8a5ec5b6903c01d10f65933defe0748a8e88c7a674af1f58dc33766d03291f7c49d0460c4b54ae2838ba7ae26d45d3a5ef8d11671bb8abd71a27dc8cea26024b052a03a4551de78936c6260f1e4569cb73bf73c55d8dfd57a317c357f125170e12cbe04accbfa4fe17c656ac040a7d97ca5638419e1f7caefaab4e8585ad999e326df8e12b2b8dc33b236da141d965842406e0b22851c5122aec4c806456d92e667b71923e4d8366b85d07fc752e3cfb07501e089b4a8bf8a364ea3e06ceb8441cea52f482213975062451e09a5cc9f6c57704006db20e81bd6f3938ba7329eb7441509d7affd7c011cdb0203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e0416041417d9d6252767f931c24943d93036448c6ca94feb300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020230500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201004e134096c9c3e66e5bc0e3baf417e1ae091fc9bfcb0c2516f27353b3761ab7ab4806d6cd007c204543456c165a1b1361d749baa402a4ace8cece2dc92a74a3dcdeaeabd06836f891af3c01f777d50bcf97abeb87e715a8fa305a617120b1c043c4b98f6d8a31eb153624fb62d50b9c8fe966bde661519793b61d87bdb0b56cfea6112906613431303d20277351d0de8583d37739204696daa7c65a162785b2cf4e0f4e8c5cbebe3800f84bf9727bd4f27ad7a22985d004bad3422c5188522ed13d246747ec55cc1bf4ca34ea26c1deddc42189f6ba7b321e8e965e844538cf80aa37698b6017741548919c6df04ea377ca1b1c48faf9cf49e85f4f850ae28f901bab704c9aebb7a63fb4ac5da45fcfe6d88a9690f74f268160765d0f247791b32a319f165ab25d8c1c29aa489c8e6fd3784070db77ecdde3d15705702de64998880584620570567686394ed3226f1dfe6df10eb362c43ccbc085b9611ebae1158059940cae05bb8c7f56be1cd25abf97f26a4cb0c67076b0908dc10b36b911d8d6285cea4ffe24b7180a9b0cd0c17c5cfb69bdcca24dc690bca64df2b1bad69a675b960252d082f9c40a5c0d28e03fc8fa959589d5a4be496c40b23ea86bb8d525b2c4fef1d3d7e7d6dc43017630fb3b8b5df74a897c9a35befccaf05701f08d3fa087327b475a974b82d266c2c42dea3f24f4a7f9a8b9e36ad91861a03b8c15	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	RmmService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	RmmService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	RmmService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	RmmService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	RmmService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	RmmService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ITSMService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ITSMService.exe

Modifies registry class 25 IoCs

Processes:

msiexec.exeITSMService.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\PackageCode = "D7076E96D3235814DB26ACC95D2BAD84"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductName = "Endpoint Manager Communication Client"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Version = "151109272"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDM\proxy = "false"	ITSMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CDM	ITSMService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductIcon = "C:\\Windows\\Installer\\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\\icon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\PackageName = "em_wh1U8LEO_installer_Win7-Win11_x86_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

ITSMAgent.exeITSMAgent.exeITSMAgent.exe

pid process

3476 ITSMAgent.exe
340 ITSMAgent.exe
5812 ITSMAgent.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exeITSMService.exe

pid process

3020 msiexec.exe
3020 msiexec.exe
4616 ITSMService.exe
4616 ITSMService.exe

pid	process
3020	msiexec.exe
3020	msiexec.exe
4616	ITSMService.exe
4616	ITSMService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exeMsiExec.exe

description	pid	process
Token: SeShutdownPrivilege	3992	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3992	msiexec.exe
Token: SeSecurityPrivilege	3020	msiexec.exe
Token: SeCreateTokenPrivilege	3992	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3992	msiexec.exe
Token: SeLockMemoryPrivilege	3992	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3992	msiexec.exe
Token: SeMachineAccountPrivilege	3992	msiexec.exe
Token: SeTcbPrivilege	3992	msiexec.exe
Token: SeSecurityPrivilege	3992	msiexec.exe
Token: SeTakeOwnershipPrivilege	3992	msiexec.exe
Token: SeLoadDriverPrivilege	3992	msiexec.exe
Token: SeSystemProfilePrivilege	3992	msiexec.exe
Token: SeSystemtimePrivilege	3992	msiexec.exe
Token: SeProfSingleProcessPrivilege	3992	msiexec.exe
Token: SeIncBasePriorityPrivilege	3992	msiexec.exe
Token: SeCreatePagefilePrivilege	3992	msiexec.exe
Token: SeCreatePermanentPrivilege	3992	msiexec.exe
Token: SeBackupPrivilege	3992	msiexec.exe
Token: SeRestorePrivilege	3992	msiexec.exe
Token: SeShutdownPrivilege	3992	msiexec.exe
Token: SeDebugPrivilege	3992	msiexec.exe
Token: SeAuditPrivilege	3992	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3992	msiexec.exe
Token: SeChangeNotifyPrivilege	3992	msiexec.exe
Token: SeRemoteShutdownPrivilege	3992	msiexec.exe
Token: SeUndockPrivilege	3992	msiexec.exe
Token: SeSyncAgentPrivilege	3992	msiexec.exe
Token: SeEnableDelegationPrivilege	3992	msiexec.exe
Token: SeManageVolumePrivilege	3992	msiexec.exe
Token: SeImpersonatePrivilege	3992	msiexec.exe
Token: SeCreateGlobalPrivilege	3992	msiexec.exe
Token: SeBackupPrivilege	3688	vssvc.exe
Token: SeRestorePrivilege	3688	vssvc.exe
Token: SeAuditPrivilege	3688	vssvc.exe
Token: SeBackupPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeBackupPrivilege	2768	srtasks.exe
Token: SeRestorePrivilege	2768	srtasks.exe
Token: SeSecurityPrivilege	2768	srtasks.exe
Token: SeTakeOwnershipPrivilege	2768	srtasks.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeBackupPrivilege	2768	srtasks.exe
Token: SeRestorePrivilege	2768	srtasks.exe
Token: SeSecurityPrivilege	2768	srtasks.exe
Token: SeTakeOwnershipPrivilege	2768	srtasks.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeRestorePrivilege	3020	msiexec.exe
Token: SeTakeOwnershipPrivilege	3020	msiexec.exe
Token: SeShutdownPrivilege	3048	MsiExec.exe

Suspicious use of FindShellTrayWindow 21 IoCs

Processes:

msiexec.exeITSMAgent.exe

pid	process
3992	msiexec.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3992	msiexec.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe

Suspicious use of SendNotifyMessage 19 IoCs

Processes:

ITSMAgent.exe

pid	process
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe
3476	ITSMAgent.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

ITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exe

pid	process
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
3476	ITSMAgent.exe
340	ITSMAgent.exe
5812	ITSMAgent.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe
4616	ITSMService.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

msiexec.exeMsiExec.execmd.exepython_x86_Lib.exeITSMService.exeRmmService.exeRmmService.execmd.exeAutoIt3.exe

description	pid	process	target process
PID 3020 wrote to memory of 2768	3020	msiexec.exe	srtasks.exe
PID 3020 wrote to memory of 2768	3020	msiexec.exe	srtasks.exe
PID 3020 wrote to memory of 5208	3020	msiexec.exe	MsiExec.exe
PID 3020 wrote to memory of 5208	3020	msiexec.exe	MsiExec.exe
PID 3020 wrote to memory of 5208	3020	msiexec.exe	MsiExec.exe
PID 3020 wrote to memory of 3048	3020	msiexec.exe	MsiExec.exe
PID 3020 wrote to memory of 3048	3020	msiexec.exe	MsiExec.exe
PID 3020 wrote to memory of 3048	3020	msiexec.exe	MsiExec.exe
PID 3048 wrote to memory of 4660	3048	MsiExec.exe	cmd.exe
PID 3048 wrote to memory of 4660	3048	MsiExec.exe	cmd.exe
PID 3048 wrote to memory of 4660	3048	MsiExec.exe	cmd.exe
PID 4660 wrote to memory of 2100	4660	cmd.exe	python_x86_Lib.exe
PID 4660 wrote to memory of 2100	4660	cmd.exe	python_x86_Lib.exe
PID 4660 wrote to memory of 2100	4660	cmd.exe	python_x86_Lib.exe
PID 2100 wrote to memory of 3548	2100	python_x86_Lib.exe	cmd.exe
PID 2100 wrote to memory of 3548	2100	python_x86_Lib.exe	cmd.exe
PID 2100 wrote to memory of 3548	2100	python_x86_Lib.exe	cmd.exe
PID 4616 wrote to memory of 3476	4616	ITSMService.exe	ITSMAgent.exe
PID 4616 wrote to memory of 3476	4616	ITSMService.exe	ITSMAgent.exe
PID 4616 wrote to memory of 3476	4616	ITSMService.exe	ITSMAgent.exe
PID 4616 wrote to memory of 340	4616	ITSMService.exe	ITSMAgent.exe
PID 4616 wrote to memory of 340	4616	ITSMService.exe	ITSMAgent.exe
PID 4616 wrote to memory of 340	4616	ITSMService.exe	ITSMAgent.exe
PID 4616 wrote to memory of 5812	4616	ITSMService.exe	ITSMAgent.exe
PID 4616 wrote to memory of 5812	4616	ITSMService.exe	ITSMAgent.exe
PID 4616 wrote to memory of 5812	4616	ITSMService.exe	ITSMAgent.exe
PID 4616 wrote to memory of 5232	4616	ITSMService.exe	RmmService.exe
PID 4616 wrote to memory of 5232	4616	ITSMService.exe	RmmService.exe
PID 4616 wrote to memory of 5232	4616	ITSMService.exe	RmmService.exe
PID 3084 wrote to memory of 2872	3084	RmmService.exe	RmmService.exe
PID 3084 wrote to memory of 2872	3084	RmmService.exe	RmmService.exe
PID 3084 wrote to memory of 2872	3084	RmmService.exe	RmmService.exe
PID 2872 wrote to memory of 1676	2872	RmmService.exe	cmd.exe
PID 2872 wrote to memory of 1676	2872	RmmService.exe	cmd.exe
PID 2872 wrote to memory of 1676	2872	RmmService.exe	cmd.exe
PID 1676 wrote to memory of 2160	1676	cmd.exe	AutoIt3.exe
PID 1676 wrote to memory of 2160	1676	cmd.exe	AutoIt3.exe
PID 1676 wrote to memory of 2160	1676	cmd.exe	AutoIt3.exe
PID 2160 wrote to memory of 996	2160	AutoIt3.exe	GoogleUpdateCore.exe
PID 2160 wrote to memory of 996	2160	AutoIt3.exe	GoogleUpdateCore.exe
PID 2160 wrote to memory of 996	2160	AutoIt3.exe	GoogleUpdateCore.exe
PID 2160 wrote to memory of 996	2160	AutoIt3.exe	GoogleUpdateCore.exe
PID 2160 wrote to memory of 996	2160	AutoIt3.exe	GoogleUpdateCore.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\em_wh1U8LEO_installer_Win7-Win11_x86_x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3992

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 06ADA1CE7224318DD4BAB06707E27309
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5208
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 80666AE723FCC1AA19B88FD01D81E8BC E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe
      "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2100
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"
1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3476
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:340
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5812
- C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5232

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:476

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --run_procedure --in Global\sharedInputMemory_1 --out Global\sharedOutputMemory_2 --err Global\sharedErrorMemory_3
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "AutoIt3.exe script.a3x"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\theistically\AutoIt3.exe
      AutoIt3.exe script.a3x
      4⤵
      Command and Scripting Interpreter: AutoIT
      Suspicious use of SetThreadContext
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:2160
    - - C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:996

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3004

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AutoHotKey & AutoIT

T1059.010

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57b6ae.rbs

Filesize
710KB

MD5
401fdede01cb816fbfac9cd6da10de5b

SHA1
180c7cf2424612ceb06eb61b3290b862ff5e6d85

SHA256
5054c23aa63d3bfdff3fbb4ace083861880fc779912db3f64a2b015b6575c73d

SHA512
479734dd8433766634d4f9adb0993d42147411b4068b1e572c836395931e830dea92368d112c07854cdb7a86be3866a59e46c2bb0e9b4ea89184676d0e46d6b8

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ApplicationManagement.dll

Filesize
87KB

MD5
25c603e78d833ff781442886c4a01fe6

SHA1
6808adc90eb5db03163103ec91f7bc58ee8aa6d0

SHA256
94afd301c1baa84b18e3b72d017b6a009145c16c6592891c92f50c127e55169e

SHA512
84e33be97d97ae341d74fc8273d191df519616f12bec8ac2f89454897c30a5f7bf9115f208c8dae78da83f0ca7bf9e5f07544d37d87b07f63408fbc91e449d54

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

Filesize
3.0MB

MD5
a5b010d5b518932fd78fcfb0cb0c7aeb

SHA1
957fd0c136c9405aa984231a1ab1b59c9b1e904f

SHA256
5a137bfe1f0e6fc8a7b6957d5e9f10df997c485e0869586706b566015ff36763

SHA512
e0ca4b29f01f644ef64669ed5595965b853ae9eaa7c6c7d86df7634437041ef15ceb3c2d1ab9dec4171c80511684a7d7b06fc87b658e5a646699eb9523bc4994

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe

Filesize
8.4MB

MD5
6b4752088a02d0016156d9e778bb5349

SHA1
bd13b1f7b04e0fe23db6b3e4bd0aa91c810e1745

SHA256
f64f13bf19726624a9cbaedda03a156597737581d6bc025c24e80517f5cab011

SHA512
0fe982b0b551238fc881511cdd0656ee71f22aca3a5e83ef7ce41b3adf603f1be17ba3e2c10797ee3dfb5e15ff1ac3e8cf4e05c657e7c047f302f50baa42ba2d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Core.dll

Filesize
5.1MB

MD5
9356330cdf731eea1e628b215e599ce5

SHA1
88645c60b3c931314354d763231137a9ec650f1b

SHA256
ad045d1d084a88fe3f48c12aee48746b22cb3a579f9140840c54ae61f7af3478

SHA512
3d9ab9b1cdecad6809be96d82df2d1b9b8c9e1a7cf0ac79a820a92b11c8fa079f5a2c3875ba0b733503742c6977d6239ce22acec023a22038b2e7ee1ebd62d90

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Gui.dll

Filesize
5.2MB

MD5
d29d11da9f344f6d679a0de7b3174890

SHA1
b4cac4aa9c6b82e8d2d0c43991e8073261c13089

SHA256
079e3a248d169143a3d5da48d24dbcc0ce5fb8aaccbc02a6fce61c5fe2461b9f

SHA512
b43f2ef86d6fe4beb28a10e19834a4f76dbaddd071d16353b2641b72f2faa552a3bdba33a606da71a34ebb932f57dd142758b4a0a240231022c8bed8ee97cad6

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Network.dll

Filesize
1015KB

MD5
de150de21f1a2b72534eaa4aa4f03202

SHA1
39ed224cced1266d4adc5e68f6516979b8f52b33

SHA256
03871db7d626d14e84d8ebf007139aa2c08038cd3403ac6259f1a2eb01ae1477

SHA512
30eff193620724cda86e6de31c430f9d4426e677a553c7918f9b85dbfc67687acdecc2a29e45473666c01ce311b73833d9f79db8a93e80570c7ace8837ca531a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Sql.dll

Filesize
174KB

MD5
88aeafdcc3f3fa04b9b20022906745b0

SHA1
9dc03428234000d19bbc3cb437d370b8e1863329

SHA256
cd84c9c486c3e967ddd061718893ef5ee48eca24f77e3366b8fd3d2dd21f477f

SHA512
5ea87730f26b16215eb2b892a6da689524546ef6cfaf4e6c1f4e0afa083ceec3e8f00c9259d316d84ef4cb05b01023a1362b4a676d10b55e06ee365557ab7986

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Widgets.dll

Filesize
4.4MB

MD5
13f078d5c63cb192f68b45f5767a9e6f

SHA1
6149189a1553c2e0e6d715d3177c16c11af7d33a

SHA256
b0abf95a23e1616f3542a8cb794aac5b7463dff3db8621e3cd719ab1dd7f6226

SHA512
f3293fcdccb4901d4eb405706ad20da361140842a335e6f6a7ce54222fe028a1da2179be14ec40dbb5a1784ed5d33bd467174091606e6fcac12039dc0f48e52a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Xml.dll

Filesize
163KB

MD5
4bac5e44b4b2f138f6608c661330dad0

SHA1
b08ff311b24d9bbc48d4014d7a0cd0de129a19e7

SHA256
59ba9deba38b1e652a046fd6b58847a58883f2d8c5c1e81acfa78d2daad98a1c

SHA512
74871aaaf8dc3fc006f7a1fdc42eabf5a86e34674d34362b2b00bdebe023d78fa0e6a5ef4676dc038178a6eeb01a0ba1676f68a1cc6828ac8d4ece550106ee0a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5XmlPatterns.dll

Filesize
2.2MB

MD5
e2749ff4266d5a933feb7685dfe375b2

SHA1
f09a432c67f45fc2ed27c762db4176b7dd47e908

SHA256
e4ee537b6a585ec7656afd9fc6fd3f655ff44bec6ff8ec291fc3e868caade27c

SHA512
4efc6b0b8d39b47d9c415fc3bc7460e4f738e3694fac691bf94569549569a8d65270a54488af3ae49de9fabdbe518250ceee83f6633e1da407636e6e02bac8bb

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\libcrypto-1_1.dll

Filesize
2.5MB

MD5
8f4ccd26ddd75c67e79ac60afa0c711f

SHA1
6a8b00598ac4690c194737a8ce27d1d90482bd8b

SHA256
ab7af6f3f78cf4d5ed4a2b498ef542a7efe168059b4a1077230a925b1c076a27

SHA512
9a52ac91876eea1d8d243c309dadb00dfae7f16705bde51aa22e3c16d99ccf7cc5d10b262a96cfbb3312981ac632b63a3787e8f1de27c9bb961b5be6ff2ba9f4

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\libssl-1_1.dll

Filesize
533KB

MD5
bf2cae7a6256b95e1ba1782e6a6c5015

SHA1
3fbdc3afa52673c7bdfab16b500bbe56f1db096b

SHA256
352d2fd16675855e20cc525b6376734933539b76bc4b40d679d3069008fe4cfc

SHA512
90755eb718ba404b0e48a6713d4680db252f8156328a58fc347e74d84b8bd53a7a6276755c672240c0e5d78200130e3ddf86990779ddd86c6d10cebf2bc02c9e

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\log4cplusU.dll

Filesize
471KB

MD5
0b03f7123e8bc93a38d321a989448dcc

SHA1
fc8bfdf092cdd6b9c1ec3b90389c035c37e50bd7

SHA256
a7fbfdb3100c164f139e9d0ebcf47282308e5173ab610dcb20a05b6e0615b54b

SHA512
6d00c65111c0f389ad189178705ed04712b2c6de8918f58de7c3747126a4b4e50b4a73525cc0993af02d35323b1430f34baf6f99712df822d6cdc63e24ed7ae5

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\msvcp140.dll

Filesize
426KB

MD5
8ff1898897f3f4391803c7253366a87b

SHA1
9bdbeed8f75a892b6b630ef9e634667f4c620fa0

SHA256
51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

SHA512
cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\proxy_settings.ini

Filesize
101B

MD5
273ec42863e3d9f999381f09c13d313b

SHA1
008d1954b2a7d1c692a697c891f9692f41f10481

SHA256
4dd2c699bbb8c398788067be6fc82edc68c8246b8f6765169776bb24ebd0c487

SHA512
940df3f73592ccabc27bf2cc77de98eade7eb8988d30144060c817eda614085e36eadb699b02123c63774416e827194c269acd1267fad1d560b7df86a79ed89b

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe

Filesize
7.2MB

MD5
dcebee7bb4e8b046b229edc10ded037f

SHA1
f9bdf0b478e21389800542165f721e5018d8eb29

SHA256
2eb0eefab534217953744c2cc36de2e1a1ced6ea882734e7b1f4b34a0b19689b

SHA512
9827600a19da5a816f1b0d93aa2629cb48f13f6e5fc42cd44bb1031ecd2e942854b34e7da44335acb85e42c44b1e720e9da8bc1d9ad23a9b1de0190f026f4d30

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\qdjango-db0.dll

Filesize
132KB

MD5
342249e8c50e8849b62c4c7f83c81821

SHA1
618aa180b34c50e243aefbf36bb6f69e36587feb

SHA256
07bc6eb017005500d39e2c346824eef79b3e06f60c46fb11572f98d4fe4083c5

SHA512
32a44252926881edf916ac517cb55d53b0b1b5adcc5952a674d1707d2c1431a68b27e593b4c4fcab0648e3cbeddf3d4e8024ff2a3385af9dbd2b2244e518340a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
b24a15017bcf6b6220647deb87900c6b

SHA1
de39de6b54caf87896b7fefa28e00cbf1fc2dbdc

SHA256
5f5b99af4614663ab75e4dc7049b3a1f8e3840bb48c8ccb12d2853989cf9263d

SHA512
751893ba31a9eb520d352d7bdda2e31c075d8ee12603d705ed0ceeb097f512bbdb2b70371a9a1b0fe8579d089181cb6a4c4456ab361bd2e18672db7978f4b678

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
ea9bc051e6b593f90859265ec8aa746c

SHA1
a19a3f2c93a32385facdba22b8c8d6c5b7055125

SHA256
838f691dd6043777a94d7cd598807c8837b74ad4264c282ca366d187b003583b

SHA512
a77fdd300fb744d8cb361ad9fa59305e91e19fc62177cc720c0dd6eef74107833e206d46430dcecd0c58f2a32ad48a59a7d19514eb80bf2d9e8c987d094a09fe

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
986bdb7843894c3833bfec97b320d90a

SHA1
b89ce01276288061fc8c906a822bf4bdcac64e8c

SHA256
841de65d4b095eb3baab49e8c447b63ec2025fd319ecaa6ab3f32e83f9ecd3ba

SHA512
5edd5915bba5b29342da5f4242cda8364172023f4208b263b39478c7dac82ca6a705fd62336a6d01a4fe115cdde427f63e1dcfebca215cf4560cd6ff9294e747

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
26ffdade376adefc3132a9f1c3402698

SHA1
abff5ceec6dcebaa8c20c3c46628dd8405ade619

SHA256
f336b09faef8807aa95a91b0bd2eed6e19cac539ea33fdf628d16afbe54e459b

SHA512
f9e1c2b5fe92062eaa80b478b1307033527847c42ea0e15a4610cd4592768bc44fa08301034664422d4c7c6010ea0910cded0760420616ff3e3549f3186c065d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
45886e0e2b6fb6f813f047930f9b4abb

SHA1
5a692e8e0c700932e89262f029dd6ac135e4fbdf

SHA256
21df410b8fc81c9452af86cedc294a33be1aa91d53a1f48a5233043fd67c3d30

SHA512
4a50a48474125ec67ad63b0def3e6583b7d5f511d9bb28bc72e09a17003a42c2e247aaa8daee849e1283e89ab982afc2ec319097a8962bd4c263e57793cf0428

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
5b9b8860cab12b5148f815549686d446

SHA1
0f90009c7b5824e00591e880463d73bf06f1d9d1

SHA256
5f2be2636a711a839b67799fe645be04786de66d186052a4c1ddbf703a4355f5

SHA512
9da7d153ff241de917883553ffabb6e438992709b251d07d5e6ed9aee02dc022e19dba67fb43f89f21d2be14fbe67307fe81223a0a95474214b4e68db151cfae

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
d3748adcf3ead4dbdd02bedaf3e24db5

SHA1
3d7eb863f47e2d57dfe28b5c2f60c7c558adcd2e

SHA256
7c12a4f59befd7bcbaa578065b4eed97a2b102ddc7988e371ba506a5d8bfd8a0

SHA512
f45d1a39c95d268803c9274ced40d053d9bed8e49c7d0d89ade45c0b12f16b51fbecb48d65f0d483eb1278e6499b94667cc7b44c9470d704927aa5a001f48de3

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
c2be9eb5c84281835116d60b9b871e9a

SHA1
8cd482184a051c630759cf1b67df280a7ec5f590

SHA256
94ecbe91339804ff3857ad6913462e004ed7c7b0b6ceb963a940180af95da310

SHA512
d9752030d8d595a4feeeebaec6f26ddff61da701003169e23123b103c246c83ae07081e094f553f7142b904329b85b0d77a91231b488e5fde51ae6b4adbe021c

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
9dd3b3722d4cc6736fa6fb1e58070081

SHA1
37ab35ed1871381065dd87af1f268ed0f4133a4e

SHA256
7e203b6db05d76e11d497d579647d32db1c9afe28ffe282b95dc5a83cf881242

SHA512
32cbb2fd9851864e130b14d691e67f13fd558516c289cf6aa488b6e9ca487f01776d7f8ed5a11eb825c5ee1605a386581f1e5a98f666d08437a251de5b6ed656

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
0dc306bce14c37dc14087027fc2c2190

SHA1
08e7adec30461ceb8c5dfe997dafb99aa1507ca2

SHA256
5f824d607eaf39f545de1ef1c22db5a8f0b78788e27c1b8cd046e856ef98fad6

SHA512
97f3dfee8a056b4aa0e7a2b7043b4aa99274120f5221e6af7f182f06729d540c05ae501de80439fd9e5818e703056102865fd187b24405b290a75b5b30f35317

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
8459bc42cd8b697e4a4b6bd6caebb77d

SHA1
780beb740261a97fe6338a49a64d38cdac9c52d3

SHA256
66eab5bbf5fca026977ca02fd7a0cffa2ee36332532e64c30854077b3282ac6d

SHA512
2a1db25d0c3a03ffa63094068086eb7dc52456d4b96d8acb8f230ab58a4a8b35e49cc31ff63873a28baf9476e311cae4fbd5026209a86c5010254b797d2293e1

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
d498d8452e1899561be58f17cffab85e

SHA1
b55d6dda38927a423a647979b3b3d780b75d7f03

SHA256
0478d487bb1ade229b5d7f265d0ab1d26d5a178f2cb5939301183754f427b0ff

SHA512
b18086d6256517f04c1283d628e361a9ecfa2dd41d69f6c8690b4d167d36401bb8eb057ca945263ff1ddc1ef200dc2f57171a147ac8b0c805a8cc81e509dd5ce

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
9376fcc58fcee21cc17807f1d87368d3

SHA1
d2d60db7cf74d55a0da37095b0ca774ffcc1f182

SHA256
1c3e39bc61e5a19d906c46e94286ecb22d14bc692c540cf15754ac955dce61fd

SHA512
29fcc67283052c3082b278dde4d26ae7408977ce06bc833517ee5db648420cd85b6dc4ec9c23443fe2fe3ddf28bf6b64a713d023d3d643430c545ed18e2c603e

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
84fadf90cd0c910a23ee615b269f2c5b

SHA1
724c0ad6f9853354739a8ddfc00fc53c36f7888c

SHA256
821225c2a82bfc68b3468e9f71a93b0bf7880d8f5c6a21d38bf6726463e6f3b3

SHA512
d2d061002a251066962efd2948463330646b502d91b3d9b00b61a9d83cbd75a10961353b26bd64a4d9b4bcfe78c9d55107ed9e0c2c20b4ac027747293bf20340

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
250590769c1adf5da64102d8837659d2

SHA1
e2f11bdebe87597803d92698dd9ac5913507a462

SHA256
4bcd1294213eb74d1756597565a4466d4f4c20d55831312e6e0ff18c28bc86cf

SHA512
f3afff813f996254ee9c82cef89343405a5d3e4f6a998b79f2f3c71891f0715f62eed35443993bb91feddf62b70ae3658583d7ee87782ba0d3e6eada08d930af

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
37d5472a3526e750dc1e232fa113ea62

SHA1
71ed2cef61d30e210c9ec4421ab7b503733a6fa0

SHA256
dedfd8c9a84d64abbaf28dd7b9573ac1fa40c0adb953ceac99331302fccf00bc

SHA512
4d35e7e715adda028107175b3d012d96566ad4eedcf1e79ced9768daf93f4766620235d833ef6adf2720434c1fc301edf3161362f007755d87d9b4bcdc30e3c6

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
63b2a75815f11817d4f90e0b6ac45543

SHA1
d71fcb20a9b16ea2652c12ccbd73d4e6af91257b

SHA256
31ef6658482f33d351e9113066747d5126e371ee71cdc831c43331d6208984a0

SHA512
61f5c11aaf648a85367a12e9e53c02d1feb3f347c9390c80ca6ed25816f6860a0df6039d4075d47749beb215bbeb6bdaae4ee4918911fa29e69f89ce5c6cb390

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
a1bf42342536d7a01d6535c3b87b897b

SHA1
fc99c48e191d8a77f2a58943e11aa388dd7bd439

SHA256
5ac1a3dd2dafa8289ed466de39dee46077bffdef06dc6fee161a942c3f72c13d

SHA512
51667b1156f3bec1e6152d95aab4112ea189ac0494da2815047d7e8c68f4f890e33cfa99e8dcd147372a0d44a25fbeb511708bd1194d0f2423c0010881d63fb8

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
d0fa62c8c67fb813840ea881cb9f1344

SHA1
f006d51b1de352af6c191be45f82f9393e0750cb

SHA256
4a0e524edbaaf4da9011122ad2bcfb8fcfb1ce5f0323daff055bedf1633959c5

SHA512
c3beb6e848caf0d89ac065f8da11d2795debbdb49a422aba6220d55220e76b92cc21d9e938e52eeab8b8c53cc638ac3586e8a8768bcda001079944b09121d805

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
e89cce1080883067741b0d530a2343d5

SHA1
425f128ce8ae7c8648abf49dd7d75823f246bac2

SHA256
f9a5c868832f856897b4b30ab0b9f5e35a2f2593300efe430453063eecacd78f

SHA512
f1d708941d0227a8f72f4211564199e4f6e9b6c101a2827f7d54f78ca8c2132e0fabf9b1964a5231ee78895b206976c33448b80e5a9df1476fb4e9be1bdd0d37

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
7de233c8939ea27746e63684a8315297

SHA1
593a82ea590c2181fa99d498f5264f4a59bc85e4

SHA256
9b766dccd8c88a3ca833d1c435e8039504990a2981bd7074a06af90643d99977

SHA512
e920b0a13b8bec39fa30f2097afd79722961cd3082114a89d44c1a7767ae83fb9cd280ac3bc54e9b599eb236585c8b88d22ac44908fc912d1690fc44775118a5

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
0a048cd081b6cf4174a7138011f9e609

SHA1
407d044d80b8f024f8b40a906aa575f0ce91ee35

SHA256
68d5b9eb613fb4c27ba52f53dbfbeb6955265a384d6cf73c5375e5da56a6e205

SHA512
218210d2e0e5de2a99b77ee086c6a126d35b12ee62450a7c540f81756e0940c8090de364a07b24b52ba6f7e008dd739dd97b333453d19e72413d9ca887394270

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
ed465f16b26d1c0f189160cc5ea3c9b0

SHA1
119dcbc27ad29f281b51d9667f3a0121cb3b0419

SHA256
8e29a4265c3555797d5364f883883d21cf1b4bda47732dddc697e0684ed07f7b

SHA512
4e4be6e949cef44256b186009c201aa7d946cc465972dfabe762bd0d942fed171696a6bec3bd8ab50204b1e9b5a7ded74eaa2f0da03c166dd39204e5fb1f448b

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
02f269d0dc8c776730412e1438533977

SHA1
234f564403bf345df90824348315d6d7bc84271a

SHA256
0481ad566c9f6ca412598641b08e401131559669d61d58d89a82df7bf8fb36d3

SHA512
ab1477e5c35dc41a25644963db421f26baf52b6a70ab5f3025f6f6c1759d31803939fbe4ca0a073d707df413ddea75966e3484af9bd813d3c6ec2a98c0bf4093

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
32KB

MD5
269726cdd16a7fef87fe3c137fe54185

SHA1
fb108a1052bdf4346756e075b8af08f5f6ba7dad

SHA256
c3d8e73a2fd25bf617dae03c3c91e25ddef242cace0c7900a612f1826dca84d4

SHA512
212f74525fd969433b03cc08697bc99da12b42471f6d14994d430b4f4ea2bca42982287d0b69ac2382b2dbaaf5be2620dfa1a7a62c19c843ab21ed8e876e6d48

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
eb8f9a9c1b66dfe061bbd70d853b76ac

SHA1
0ffc903aafb462b68a82796c716f34c004e051e5

SHA256
bebfda0fd2ec67a6a04afe93429d9f868b9d62835eb3547b1e4fe7af2f4ca03f

SHA512
40f6f3ced2fa4ff547cf1e7c4b2371eaf6b4e04e94cc12b37d4a4435fbdbfc0aea4e98bff354ac8121f8ddc681c23a1b54c0d2090572b215ef8909c7bd3a55db

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmproxy.dll

Filesize
154KB

MD5
84c848ca734892ea2e8ab90d84317ee3

SHA1
a1b38d4f1b466061481bdfde7628139c908f7ee5

SHA256
01c53abd5585992f9d62de40f4750899829b9e7e4a026b8d9f5d1cb1748a3fa9

SHA512
cec124435d6d4c76497e7886ca317a0c12a9d8e77200ba94cf6a699b318b91cb4db886eba5a5161941a7dd349f827cd3694abb864d6e37a9084a208276bee7df

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\sqldrivers\qsqlite.dll

Filesize
1.1MB

MD5
d9d7b0d7386cd57e4301d57cb7294b4b

SHA1
dcf385b8d3f9f99a07e1b7757508e5e4080f336c

SHA256
a4ee1bc55369a13b3e721aa48e44de31c6f00439838e923ab7a66438fbab4002

SHA512
e1568ce01edd46aabc795dd4eacab565ffc8dc0271129b5aa770f3763fba756a5de59aa4329510e65282bb19537874c6f307712a7fa2b6971f50dbee7b2664d7

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\token.ini

Filesize
8B

MD5
16674a4fdd74f7a049320075c9665d93

SHA1
574c925e2d534034b08dff253071fcc1c2309e3a

SHA256
c7df218540f5780d54f5591c888acdee8ee5fbc3337bf6b8d8bad66709895446

SHA512
44b7ac04e901b7e5876f5fe8c44a91258836dffa73b7eadf8b8daec78f3dc124eb140f1cc0bc2442ec75742c429aa4b8f878582c52b77d65c8d562099082e371

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\vcruntime140.dll

Filesize
74KB

MD5
1a84957b6e681fca057160cd04e26b27

SHA1
8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

SHA256
9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

SHA512
5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
765B

MD5
fff2cc217cec93b9b4e91ea34e23efaa

SHA1
c6a7f0e18796e1c6b789ec9fb7e98fbc639bc1df

SHA256
9bd2f914e637e30ba764c0af86102be829546122e443b30588e5e9723a15873b

SHA512
f426e383b51806458533ddd15e4aec6cddde1acf497b8a84542818c4dffa3b5c21093a075a79a8e46ce5ddf6d16be9ed66c339724c63f76c6be7bd048cef5a3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

Filesize
637B

MD5
f29448db915ce12024c00f8db2735a37

SHA1
8c42cc59bf9684c8913d77b6481d6f9a35291fe2

SHA256
1220fbb03d07705373e10fff29e767a41a523ff3bbd1280f1e6c313421bd6930

SHA512
932aa9847dc8630259827605dbf4cca4a778fda7ae164b814d6d552086812395441389179094c01c0225477aafdf9f3e2daa235e5884cf6eba01d32ee54b6b01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
1KB

MD5
8991f83c49d2736793a0c917c3d8ae4d

SHA1
71752a06511633fcb9d2df14b507e555e4d1b17a

SHA256
a94ee10e4836486a24b1020e70055b440e46b52913a6e9cd66d0cae467276990

SHA512
6fedbb05506b87ca954be1e413a1ca2824ae3b060242e89a1002a06d6549838f2d9e09768a878211a1929ef9cd260415bb061a8a28d16ee6e647780fc7e8b3cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
484B

MD5
7de3f54140fcbab14717fa31b9ef7695

SHA1
ab6f0c8cdee336d67dfcf6f33e5a37fe326dabe7

SHA256
7d38ad755d7899f46e0ab6b5088f34de5d9d9c2c5213e43abe81c193a345b56e

SHA512
120762a442c4d93bc6f1506c5eea5509b1e185b559a7d339f5f01083304a859a25ae89248ec6565fd2e7d417d4689f8385f3b867f11684bfe73559009e4f33e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

Filesize
480B

MD5
285c8a2639ddafc3f5ff23d0e66b8b87

SHA1
b186ceea8d8573051dcb99defbc5691463192324

SHA256
c9ab73b6e1aa6e3bdff260998894062c177c49f7ec4eb6de69efcf8c991f46d1

SHA512
aa051250fbb9e37c0a97b1a26eedb2b4f75222536fa2f5c5adb5a34b0287467bde7a6de9df0177af1417c1c14d89920f3d80dcf165e967a62798e8e2b507335b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
482B

MD5
67bb0976d46e5d7ee05d54ecd10fcd3b

SHA1
ec58f91441340d4c347e12ddea56e6a88511e628

SHA256
3b6e94a5794fa3ba39abc0baaa292331589fb47dbb77171d3439636a9b435e82

SHA512
b20ab511ce3867afe2dc01d98607c137f3a53469c44e6f74578569bc97e2537c62d1c0f6cebf1b52cfebaf20f39952f482dacbe59c5ec7ce0e7c3c7a109ad711

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
226B

MD5
feceaa82323f9de4d3578592d22f857d

SHA1
4c55c509e6d16466d1d4c31a0687ededf2eabc9a

SHA256
61480b43136b02965f59e3256b8de1bf35caa7c084a7bcb3ed5f4236451d4484

SHA512
82dac003d30eed4fc4e06ab4a426c9b7f355d777c243b710c5c0d3afc4c26d93874af2d0a542fca4a2038050b0d0fa8f63ed82e5f2771ae8a4de0f3b08d56d45

Download Submit
C:\Windows\Installer\MSIB8D0.tmp

Filesize
285KB

MD5
82d54afa53f6733d6529e4495700cdd8

SHA1
b3e578b9edde7aaaacca66169db4f251ee1f06b3

SHA256
8f4894b9d19bfe5d8e54b5e120cef6c69abea8958db066cdd4905cc78ecd58b6

SHA512
22476e0f001b6cf37d26e15dfb91c826c4197603ea6e1fbb9143c81392e41f18fa10a2d2d1e25425baaf754bff7fd179ef1df34966c10985e16d9da12a445150

Download Submit
C:\Windows\Installer\MSIBA0A.tmp

Filesize
203KB

MD5
d53b2b818b8c6a2b2bae3a39e988af10

SHA1
ee57ec919035cf8125ee0f72bd84a8dd9e879959

SHA256
2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2

SHA512
3aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
12.8MB

MD5
7e76c8e8cd6b0f4ec1b192189f0a0357

SHA1
89070ce4006293072d2f95b3b225225632ea5d95

SHA256
fbc780eed69640eba9b11b25a7356783f3cb71c101895b72919b6bccad4a5c6a

SHA512
74f6164fd3ce38bd2d5a6197353ff264125793e5c740275f9d8dcd2f03aca6b5d1e22f4c035b1bdc1025adf6fac262e602f0e3420b1593c1bb68772137541239

Download Submit
\??\Volume{3a4c38fd-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{387b8f48-53ba-4080-b93a-949fc43684bf}_OnDiskSnapshotProp

Filesize
6KB

MD5
98f86013cddcfb4deca77e533d341707

SHA1
4d39993dab9ff0760673ca39963544b604621351

SHA256
4fc1fc14cce9921644b04c25a46d1f1192d0736232122e0284728c2e44eca568

SHA512
657439915867aa865892287690c4f2e2947c6ffd489a50125ba346519a2bbdcdb5b09385a0d01c016baec42cb8ded50ba98cfe79a8c9a5e6bc9864ff6d6d52e4

Download Submit
memory/996-5629-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/996-5630-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download