sectoprat | hxxps://houseofgoodtones[.]org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64[.]msi

Resubmissions

12-08-2024 15:01

240812-sd558s1apb 10

11-08-2024 12:42

240811-pxewlstgrh 10

11-08-2024 03:59

240811-ekb9vayanf 6

Analysis

max time kernel
1500s
max time network
1493s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi

Score

10^/10

sectoprat discovery execution persistence rat trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3684-5335-0x0000000000400000-0x00000000004C6000-memory.dmp	family_sectoprat

Executes dropped EXE 11 IoCs

Processes:

python_x86_Lib.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exeRmmService.exeRmmService.exeRmmService.exeRmmService.exeAutoIt3.exepython_x86_Lib.exe

pid	process
2704	python_x86_Lib.exe
3932	ITSMService.exe
5312	ITSMAgent.exe
5392	ITSMAgent.exe
5664	ITSMAgent.exe
5468	RmmService.exe
5540	RmmService.exe
5700	RmmService.exe
2768	RmmService.exe
5400	AutoIt3.exe
1916	python_x86_Lib.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exeITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exeRmmService.exe

pid	process
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
532	MsiExec.exe
532	MsiExec.exe
532	MsiExec.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5392	ITSMAgent.exe
5392	ITSMAgent.exe
5392	ITSMAgent.exe
5392	ITSMAgent.exe
5392	ITSMAgent.exe
5392	ITSMAgent.exe
5392	ITSMAgent.exe
532	MsiExec.exe
5664	ITSMAgent.exe
5664	ITSMAgent.exe
5664	ITSMAgent.exe
5664	ITSMAgent.exe
5664	ITSMAgent.exe
5664	ITSMAgent.exe
5664	ITSMAgent.exe
5664	ITSMAgent.exe
5664	ITSMAgent.exe
5468	RmmService.exe
5468	RmmService.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe"	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

Processes:

ITSMService.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\	ITSMService.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

146 pastebin.com
147 pastebin.com
Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs
Using AutoIT for possible automate script.
execution

AutoHotKey & AutoIT
T1059.010

Processes:

AutoIt3.exe

pid process

5400 AutoIt3.exe

flow	ioc
146	pastebin.com
147	pastebin.com

pid	process
5400	AutoIt3.exe

Drops file in System32 directory 6 IoCs

Processes:

ITSMService.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E455012CBF4BA8A2AC67618C00590908	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E455012CBF4BA8A2AC67618C00590908	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	ITSMService.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

AutoIt3.exe

description pid process target process

PID 5400 set thread context of 3684 5400 AutoIt3.exe RegAsm.exe

description	pid	process	target process
PID 5400 set thread context of 3684	5400	AutoIt3.exe	RegAsm.exe

Drops file in Program Files directory 64 IoCs

Processes:

python_x86_Lib.exemsiexec.exepython_x86_Lib.exeRmmService.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Amman	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\pydoc_data\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\torrent-plugin.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\config.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\email\mime\application.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\tixmkpref	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\email\utils.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\platforms\qwindows.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\io.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\posixfile.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\srcfile.xbm	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\unsupported.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\NZ	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\images\face.xbm	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_apply.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Gaza	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\lib\subprocess.pyc	RmmService.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\bdist_wininst.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT+3	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\TK.csc	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Juneau	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\refactor.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\cachecontrol\caches\file_cache.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\macCroatian.enc	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Chungking	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples\SWindow.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\treeadapters\sax.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Indiana\Knox	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\compiler\ast.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\generator\dump_dependency_json.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\FileCbx.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\LabEntry.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\idna.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\St_Kitts	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\mimetypes.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\xcode_emulation.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\palette.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\_MozillaCookieJar.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\stat.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\cookielib.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Havana	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\platform.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Panama	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Nicosia	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\ninja_syntax.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Monterrey	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples\NoteBook.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\pipes.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\ar_sy.msg	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\commands\completion.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\escsm.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Rainy_River	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\Icons\python.gif	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Qatar	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\logging\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Managua	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Porto_Velho	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\lib\heapq.pyc	RmmService.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\Salta	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\lockfile\mkdirlockfile.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Indian\Reunion	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\pgen2\pgen.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Vatican	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Vladivostok	python_x86_Lib.exe

Drops file in Windows directory 24 IoCs

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
File created	C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3CD.tmp	msiexec.exe
File created	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\e5adcd6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6310.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI671A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF26.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE36E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE41C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI110C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI637E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66EA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6C1D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5adcd4.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1A8.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE96C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA19.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF19.tmp	msiexec.exe
File created	C:\Windows\Installer\e5adcd4.msi	msiexec.exe
File created	C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeRegAsm.execmd.exeRmmService.exeITSMAgent.exeRmmService.exeRmmService.exeRmmService.execmd.exeMsiExec.exepython_x86_Lib.exeITSMAgent.exeMsiExec.execmd.exeITSMService.exeMsiExec.execmd.exeMsiExec.execmd.exeITSMAgent.exeAutoIt3.exepython_x86_Lib.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_x86_Lib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_x86_Lib.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f7b83aff83bcb26e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f7b83aff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f7b83aff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df7b83aff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f7b83aff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AutoIt3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoIt3.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

ITSMService.exepython_x86_Lib.exemsiexec.exepython_x86_Lib.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	python_x86_Lib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	python_x86_Lib.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ITSMService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53\Blob = 03000000010000001400000040cef3046c916ed7ae557f60e76842828b51de5314000000010000001400000017d9d6252767f931c24943d93036448c6ca94feb040000000100000010000000886ea78b530e0fd5bda4e12527ab6a2c0f00000001000000300000005d2164164eb6f3820b9b8d7a5601b60ebf70d832d2029c6c3c966db107dfcb1ba12a25700f26ca3d5b36e4a6cb576cfa19000000010000001000000092a08f142bb795a2197a0d3c7af066f55c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001d0600003082061930820401a0030201020210137d539caa7c31a9a433701968847a8d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a308195310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313d303b060355040313345365637469676f20525341204f7267616e697a6174696f6e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a02820101009c930246454a524892fc578df92dea53beb32cd5d8a8a5ec5b6903c01d10f65933defe0748a8e88c7a674af1f58dc33766d03291f7c49d0460c4b54ae2838ba7ae26d45d3a5ef8d11671bb8abd71a27dc8cea26024b052a03a4551de78936c6260f1e4569cb73bf73c55d8dfd57a317c357f125170e12cbe04accbfa4fe17c656ac040a7d97ca5638419e1f7caefaab4e8585ad999e326df8e12b2b8dc33b236da141d965842406e0b22851c5122aec4c806456d92e667b71923e4d8366b85d07fc752e3cfb07501e089b4a8bf8a364ea3e06ceb8441cea52f482213975062451e09a5cc9f6c57704006db20e81bd6f3938ba7329eb7441509d7affd7c011cdb0203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e0416041417d9d6252767f931c24943d93036448c6ca94feb300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020230500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201004e134096c9c3e66e5bc0e3baf417e1ae091fc9bfcb0c2516f27353b3761ab7ab4806d6cd007c204543456c165a1b1361d749baa402a4ace8cece2dc92a74a3dcdeaeabd06836f891af3c01f777d50bcf97abeb87e715a8fa305a617120b1c043c4b98f6d8a31eb153624fb62d50b9c8fe966bde661519793b61d87bdb0b56cfea6112906613431303d20277351d0de8583d37739204696daa7c65a162785b2cf4e0f4e8c5cbebe3800f84bf9727bd4f27ad7a22985d004bad3422c5188522ed13d246747ec55cc1bf4ca34ea26c1deddc42189f6ba7b321e8e965e844538cf80aa37698b6017741548919c6df04ea377ca1b1c48faf9cf49e85f4f850ae28f901bab704c9aebb7a63fb4ac5da45fcfe6d88a9690f74f268160765d0f247791b32a319f165ab25d8c1c29aa489c8e6fd3784070db77ecdde3d15705702de64998880584620570567686394ed3226f1dfe6df10eb362c43ccbc085b9611ebae1158059940cae05bb8c7f56be1cd25abf97f26a4cb0c67076b0908dc10b36b911d8d6285cea4ffe24b7180a9b0cd0c17c5cfb69bdcca24dc690bca64df2b1bad69a675b960252d082f9c40a5c0d28e03fc8fa959589d5a4be496c40b23ea86bb8d525b2c4fef1d3d7e7d6dc43017630fb3b8b5df74a897c9a35befccaf05701f08d3fa087327b475a974b82d266c2c42dea3f24f4a7f9a8b9e36ad91861a03b8c15	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	ITSMService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ITSMService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	python_x86_Lib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	python_x86_Lib.exe

Modifies registry class 25 IoCs

Processes:

msiexec.exeITSMService.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CDM	ITSMService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Version = "151109272"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductName = "Endpoint Manager Communication Client"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\PackageName = "Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\PackageCode = "D7076E96D3235814DB26ACC95D2BAD84"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductIcon = "C:\\Windows\\Installer\\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\\icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDM\proxy = "false"	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

ITSMAgent.exeITSMAgent.exeITSMAgent.exe

pid process

5312 ITSMAgent.exe
5392 ITSMAgent.exe
5664 ITSMAgent.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msiexec.exeITSMService.exe

pid process

2440 msiexec.exe
2440 msiexec.exe
3932 ITSMService.exe
3932 ITSMService.exe
2440 msiexec.exe
2440 msiexec.exe

pid	process
2440	msiexec.exe
2440	msiexec.exe
3932	ITSMService.exe
3932	ITSMService.exe
2440	msiexec.exe
2440	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeMsiExec.exesrtasks.exe

description	pid	process
Token: SeShutdownPrivilege	2112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2112	msiexec.exe
Token: SeSecurityPrivilege	2440	msiexec.exe
Token: SeCreateTokenPrivilege	2112	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2112	msiexec.exe
Token: SeLockMemoryPrivilege	2112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2112	msiexec.exe
Token: SeMachineAccountPrivilege	2112	msiexec.exe
Token: SeTcbPrivilege	2112	msiexec.exe
Token: SeSecurityPrivilege	2112	msiexec.exe
Token: SeTakeOwnershipPrivilege	2112	msiexec.exe
Token: SeLoadDriverPrivilege	2112	msiexec.exe
Token: SeSystemProfilePrivilege	2112	msiexec.exe
Token: SeSystemtimePrivilege	2112	msiexec.exe
Token: SeProfSingleProcessPrivilege	2112	msiexec.exe
Token: SeIncBasePriorityPrivilege	2112	msiexec.exe
Token: SeCreatePagefilePrivilege	2112	msiexec.exe
Token: SeCreatePermanentPrivilege	2112	msiexec.exe
Token: SeBackupPrivilege	2112	msiexec.exe
Token: SeRestorePrivilege	2112	msiexec.exe
Token: SeShutdownPrivilege	2112	msiexec.exe
Token: SeDebugPrivilege	2112	msiexec.exe
Token: SeAuditPrivilege	2112	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2112	msiexec.exe
Token: SeChangeNotifyPrivilege	2112	msiexec.exe
Token: SeRemoteShutdownPrivilege	2112	msiexec.exe
Token: SeUndockPrivilege	2112	msiexec.exe
Token: SeSyncAgentPrivilege	2112	msiexec.exe
Token: SeEnableDelegationPrivilege	2112	msiexec.exe
Token: SeManageVolumePrivilege	2112	msiexec.exe
Token: SeImpersonatePrivilege	2112	msiexec.exe
Token: SeCreateGlobalPrivilege	2112	msiexec.exe
Token: SeBackupPrivilege	720	vssvc.exe
Token: SeRestorePrivilege	720	vssvc.exe
Token: SeAuditPrivilege	720	vssvc.exe
Token: SeBackupPrivilege	2440	msiexec.exe
Token: SeRestorePrivilege	2440	msiexec.exe
Token: SeRestorePrivilege	2440	msiexec.exe
Token: SeTakeOwnershipPrivilege	2440	msiexec.exe
Token: SeRestorePrivilege	2440	msiexec.exe
Token: SeTakeOwnershipPrivilege	2440	msiexec.exe
Token: SeRestorePrivilege	2440	msiexec.exe
Token: SeTakeOwnershipPrivilege	2440	msiexec.exe
Token: SeRestorePrivilege	2440	msiexec.exe
Token: SeTakeOwnershipPrivilege	2440	msiexec.exe
Token: SeRestorePrivilege	2440	msiexec.exe
Token: SeTakeOwnershipPrivilege	2440	msiexec.exe
Token: SeRestorePrivilege	2440	msiexec.exe
Token: SeTakeOwnershipPrivilege	2440	msiexec.exe
Token: SeRestorePrivilege	2440	msiexec.exe
Token: SeTakeOwnershipPrivilege	2440	msiexec.exe
Token: SeRestorePrivilege	2440	msiexec.exe
Token: SeTakeOwnershipPrivilege	2440	msiexec.exe
Token: SeRestorePrivilege	2440	msiexec.exe
Token: SeTakeOwnershipPrivilege	2440	msiexec.exe
Token: SeShutdownPrivilege	532	MsiExec.exe
Token: SeShutdownPrivilege	532	MsiExec.exe
Token: SeShutdownPrivilege	532	MsiExec.exe
Token: SeBackupPrivilege	1968	srtasks.exe
Token: SeRestorePrivilege	1968	srtasks.exe
Token: SeSecurityPrivilege	1968	srtasks.exe
Token: SeTakeOwnershipPrivilege	1968	srtasks.exe
Token: SeBackupPrivilege	1968	srtasks.exe
Token: SeRestorePrivilege	1968	srtasks.exe

Suspicious use of FindShellTrayWindow 23 IoCs

Processes:

msiexec.exeITSMAgent.exemsiexec.exe

pid	process
2112	msiexec.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
2112	msiexec.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
3556	msiexec.exe
3556	msiexec.exe

Suspicious use of SendNotifyMessage 19 IoCs

Processes:

ITSMAgent.exe

pid	process
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe
5312	ITSMAgent.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

ITSMService.exeITSMAgent.exeITSMAgent.exeITSMAgent.exe

pid	process
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
5312	ITSMAgent.exe
3932	ITSMService.exe
5392	ITSMAgent.exe
5664	ITSMAgent.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe
3932	ITSMService.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.execmd.exepython_x86_Lib.exeITSMService.exeRmmService.exeRmmService.execmd.execmd.exeAutoIt3.exeMsiExec.execmd.exepython_x86_Lib.exe

description	pid	process	target process
PID 2440 wrote to memory of 1968	2440	msiexec.exe	srtasks.exe
PID 2440 wrote to memory of 1968	2440	msiexec.exe	srtasks.exe
PID 2440 wrote to memory of 2096	2440	msiexec.exe	MsiExec.exe
PID 2440 wrote to memory of 2096	2440	msiexec.exe	MsiExec.exe
PID 2440 wrote to memory of 2096	2440	msiexec.exe	MsiExec.exe
PID 2440 wrote to memory of 532	2440	msiexec.exe	MsiExec.exe
PID 2440 wrote to memory of 532	2440	msiexec.exe	MsiExec.exe
PID 2440 wrote to memory of 532	2440	msiexec.exe	MsiExec.exe
PID 532 wrote to memory of 4928	532	MsiExec.exe	cmd.exe
PID 532 wrote to memory of 4928	532	MsiExec.exe	cmd.exe
PID 532 wrote to memory of 4928	532	MsiExec.exe	cmd.exe
PID 4928 wrote to memory of 2704	4928	cmd.exe	python_x86_Lib.exe
PID 4928 wrote to memory of 2704	4928	cmd.exe	python_x86_Lib.exe
PID 4928 wrote to memory of 2704	4928	cmd.exe	python_x86_Lib.exe
PID 2704 wrote to memory of 408	2704	python_x86_Lib.exe	cmd.exe
PID 2704 wrote to memory of 408	2704	python_x86_Lib.exe	cmd.exe
PID 2704 wrote to memory of 408	2704	python_x86_Lib.exe	cmd.exe
PID 3932 wrote to memory of 5312	3932	ITSMService.exe	ITSMAgent.exe
PID 3932 wrote to memory of 5312	3932	ITSMService.exe	ITSMAgent.exe
PID 3932 wrote to memory of 5312	3932	ITSMService.exe	ITSMAgent.exe
PID 3932 wrote to memory of 5392	3932	ITSMService.exe	ITSMAgent.exe
PID 3932 wrote to memory of 5392	3932	ITSMService.exe	ITSMAgent.exe
PID 3932 wrote to memory of 5392	3932	ITSMService.exe	ITSMAgent.exe
PID 3932 wrote to memory of 5664	3932	ITSMService.exe	ITSMAgent.exe
PID 3932 wrote to memory of 5664	3932	ITSMService.exe	ITSMAgent.exe
PID 3932 wrote to memory of 5664	3932	ITSMService.exe	ITSMAgent.exe
PID 3932 wrote to memory of 5468	3932	ITSMService.exe	RmmService.exe
PID 3932 wrote to memory of 5468	3932	ITSMService.exe	RmmService.exe
PID 3932 wrote to memory of 5468	3932	ITSMService.exe	RmmService.exe
PID 5540 wrote to memory of 5700	5540	RmmService.exe	RmmService.exe
PID 5540 wrote to memory of 5700	5540	RmmService.exe	RmmService.exe
PID 5540 wrote to memory of 5700	5540	RmmService.exe	RmmService.exe
PID 5700 wrote to memory of 4608	5700	RmmService.exe	cmd.exe
PID 5700 wrote to memory of 4608	5700	RmmService.exe	cmd.exe
PID 5700 wrote to memory of 4608	5700	RmmService.exe	cmd.exe
PID 4608 wrote to memory of 2768	4608	cmd.exe	RmmService.exe
PID 4608 wrote to memory of 2768	4608	cmd.exe	RmmService.exe
PID 4608 wrote to memory of 2768	4608	cmd.exe	RmmService.exe
PID 5700 wrote to memory of 5168	5700	RmmService.exe	cmd.exe
PID 5700 wrote to memory of 5168	5700	RmmService.exe	cmd.exe
PID 5700 wrote to memory of 5168	5700	RmmService.exe	cmd.exe
PID 5168 wrote to memory of 5400	5168	cmd.exe	AutoIt3.exe
PID 5168 wrote to memory of 5400	5168	cmd.exe	AutoIt3.exe
PID 5168 wrote to memory of 5400	5168	cmd.exe	AutoIt3.exe
PID 5400 wrote to memory of 3684	5400	AutoIt3.exe	RegAsm.exe
PID 5400 wrote to memory of 3684	5400	AutoIt3.exe	RegAsm.exe
PID 5400 wrote to memory of 3684	5400	AutoIt3.exe	RegAsm.exe
PID 5400 wrote to memory of 3684	5400	AutoIt3.exe	RegAsm.exe
PID 5400 wrote to memory of 3684	5400	AutoIt3.exe	RegAsm.exe
PID 2440 wrote to memory of 5248	2440	msiexec.exe	MsiExec.exe
PID 2440 wrote to memory of 5248	2440	msiexec.exe	MsiExec.exe
PID 2440 wrote to memory of 5248	2440	msiexec.exe	MsiExec.exe
PID 2440 wrote to memory of 5424	2440	msiexec.exe	MsiExec.exe
PID 2440 wrote to memory of 5424	2440	msiexec.exe	MsiExec.exe
PID 2440 wrote to memory of 5424	2440	msiexec.exe	MsiExec.exe
PID 5424 wrote to memory of 5472	5424	MsiExec.exe	cmd.exe
PID 5424 wrote to memory of 5472	5424	MsiExec.exe	cmd.exe
PID 5424 wrote to memory of 5472	5424	MsiExec.exe	cmd.exe
PID 5472 wrote to memory of 1916	5472	cmd.exe	python_x86_Lib.exe
PID 5472 wrote to memory of 1916	5472	cmd.exe	python_x86_Lib.exe
PID 5472 wrote to memory of 1916	5472	cmd.exe	python_x86_Lib.exe
PID 1916 wrote to memory of 6628	1916	python_x86_Lib.exe	cmd.exe
PID 1916 wrote to memory of 6628	1916	python_x86_Lib.exe	cmd.exe
PID 1916 wrote to memory of 6628	1916	python_x86_Lib.exe	cmd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
1⤵
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3800,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:1
1⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=5096,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
1⤵
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5356,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
1⤵
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5388,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
1⤵
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6088,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
1⤵
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6112,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
1⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=6176,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
1⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6016,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:8
1⤵
PID:2468

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2112

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FBD749531379459447EBB79130489FB0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 20F350D4D26CD12AD933C036FCB95BC9 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe
      "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:408
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 69880802211ED0F17A04941863DE9BEA
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5248
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C4879CBD46F9A4832CE34AE5C93FA9F7 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5472
  - - C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe
      "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6628

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:720

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5312
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5392
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5664
- C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5468

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1944

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5540
- C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --run_procedure --in Global\sharedInputMemory_1 --out Global\sharedOutputMemory_2 --err Global\sharedErrorMemory_3
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
      "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Salome\AutoIt3.exe C:\Users\Admin\AppData\Local\Temp\Salome\script.a3x"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Salome\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\Salome\AutoIt3.exe C:\Users\Admin\AppData\Local\Temp\Salome\script.a3x
      4⤵
      Executes dropped EXE
      Command and Scripting Interpreter: AutoIT
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:5400
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3684

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi"
1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4128,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
1⤵
PID:4828

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AutoHotKey & AutoIT

T1059.010

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5adcd5.rbs

Filesize
710KB

MD5
c19e013f107d917640311a6de1799bb3

SHA1
884a974eced9146162fd080f15a4cf1ab8722ce1

SHA256
11e3fe2d8a8ae5007bbb1196391990d16e01acb58cffada7d54e7c25ff6c722b

SHA512
60fd6a273cb578ec09c90dccc19650bc1f4e8e0186f64006f772c51ff74f216cf3047f1c02fa4f88eb90fbe91bdea02cea7eb07ec327242f4c8056172fde511c

Download Submit
C:\Config.Msi\e5adcd7.rbs

Filesize
4KB

MD5
a33b3763182925d13fbcf667d044d0ac

SHA1
fb80946ccfa009b4687337a0c5dc881c1e4ca9b1

SHA256
49542bd3d8771b5688a56784aff3fd682373db8a78bc8dda676b643e42fc9bca

SHA512
9407b9533b7335b6636aed359e6dc79c7182a29de1cf54f0afd7137c1687ee2dcc77661a099e6ee62fc93399b5d76cb79cbe8ac173f1a0613cd8f31db943a328

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ApplicationManagement.dll

Filesize
87KB

MD5
25c603e78d833ff781442886c4a01fe6

SHA1
6808adc90eb5db03163103ec91f7bc58ee8aa6d0

SHA256
94afd301c1baa84b18e3b72d017b6a009145c16c6592891c92f50c127e55169e

SHA512
84e33be97d97ae341d74fc8273d191df519616f12bec8ac2f89454897c30a5f7bf9115f208c8dae78da83f0ca7bf9e5f07544d37d87b07f63408fbc91e449d54

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\DLLs\py.ico

Filesize
19KB

MD5
79fb3436099fe00487bc874fd0313d13

SHA1
de7fdac228039fcea300f0efd241bd93cb71291c

SHA256
ae74eb8119aa88532734a84dd782830f8f5cb4dff01cfa4372b1e4afa3565313

SHA512
3faac8026bb4ba853ca7e263e52c169c96997b7a05ab1f56e62598690414d83833912669174dc1643fec08edfd133d0e4031e7e667a849514404507bf3ecdb26

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

Filesize
3.0MB

MD5
a5b010d5b518932fd78fcfb0cb0c7aeb

SHA1
957fd0c136c9405aa984231a1ab1b59c9b1e904f

SHA256
5a137bfe1f0e6fc8a7b6957d5e9f10df997c485e0869586706b566015ff36763

SHA512
e0ca4b29f01f644ef64669ed5595965b853ae9eaa7c6c7d86df7634437041ef15ceb3c2d1ab9dec4171c80511684a7d7b06fc87b658e5a646699eb9523bc4994

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe

Filesize
8.4MB

MD5
6b4752088a02d0016156d9e778bb5349

SHA1
bd13b1f7b04e0fe23db6b3e4bd0aa91c810e1745

SHA256
f64f13bf19726624a9cbaedda03a156597737581d6bc025c24e80517f5cab011

SHA512
0fe982b0b551238fc881511cdd0656ee71f22aca3a5e83ef7ce41b3adf603f1be17ba3e2c10797ee3dfb5e15ff1ac3e8cf4e05c657e7c047f302f50baa42ba2d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip-7.1.2.dist-info\WHEEL

Filesize
116B

MD5
e61807b52291413eaa3d1e601fd0be51

SHA1
87e0e663a0e6d23d5d771affa782f0bf9bafcee6

SHA256
e7a5a330f45412999bdf441a4f355b402a6b8b99732866f2e472c39003107885

SHA512
c0bd095394bbdab6e85c6d55b9ae0c6f5eac99e21a1b80fedee52a00035eae71329b26782ad5d210f5a4831708fd7f59aa6aad29063fb19d4f600f1f8f23c966

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\_markerlib\markers.py

Filesize
4KB

MD5
de4c15b44f46159e5827d8e41760d91e

SHA1
ea88a5e9a1aaa03ec2bb4d68e58b6a16045ba9f7

SHA256
d9ef662b7f57be822b3178854073bc0f2fce312dd42fec97ef2819982c46c985

SHA512
4e72dbfba20f5d31211c693cec360e32898d3d9b10bb95b8276e0fca7505a37ce672b93b28da85c2157f38bdac63fa21616c13748eb968e53504d2cde4d8a97f

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\packaging\__about__.py

Filesize
1KB

MD5
41d66cc8af4183eb12c775d8f7fdacb5

SHA1
446d645e8be10c82b8d91773a1227615fd50b7a9

SHA256
1f22e0ce44a6960fff72ed6f42bc8f30562037902ee3df85c0d3c299f34d296f

SHA512
47e89bf31f75f6df5167000abd408cc125e9fa1c9aab79a54a3c6b46be81eb6b8f3c3a38c498e10df61bea76d3f0a0cd6f6d5449e320431aafa8672ba1aea458

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\packaging\__init__.py

Filesize
930B

MD5
ae2776b838292dd4f0d1b92888532633

SHA1
8cf899850f0b2275d5480b1637247a84a7a90cb8

SHA256
93c4fb095e3f8c7407d22d292ebf43a3500dc3f49b42216778095c24323e3219

SHA512
3a0fa1212777bdec8781fea4f5b50b3318f23e467ef96c1034e74c939f99e98f28372639e384f3ff588c46983e52d1902caf5b8d48522c20072df129834f97c3

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\packaging\_compat.py

Filesize
1KB

MD5
d2245b8d7afe6047a321748025f0ced1

SHA1
c8b66bb5a3280ba207e21c6dc9626e7281344c3f

SHA256
f087a383d9ada2fb86fbf1d6f504da27626ee0ba28e29e38321cbedb840cd25f

SHA512
067ea9a3fabe989e3ffb6393aba8c20446b69658e0f22383ae74af770108fbb2d8ca110ece182d0427ec25c4324b92a007aaeba13af5aa53e68e6de1ce079343

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\packaging\_structures.py

Filesize
1KB

MD5
f11a72923cdbb84565918e92972f49f1

SHA1
913376fcb23fc2646471c378a7a7c3a08a79742f

SHA256
4d021c792840ed579419b0239a2d0e99a085bdc3ea3812352b054536ae9592de

SHA512
1f5ab25df5d650cf8660f0e3f51fd60b26d913f778f06c0118cb3df916e402f49aed879215fad3a9ba1a29106f200306f736dca308340e7be4cb0b5b05f25d85

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\packaging\specifiers.py

Filesize
28KB

MD5
dbf4ed00a181cc7142b7f27d08ad197d

SHA1
498c7907134901663f689a46beb50ce54e32e282

SHA256
4bda64eccfc45f37f8f3250f78a360806559e63d01669f74a953c9e5c68f1baa

SHA512
61b9f1660aa792c362240f655cbb29f186acf0c2908fd8fab9de086ec0191a113c9583b3f8656778f2e66a2deacfc40d7816e42a1586f6ecf04e29ae4a5e83b7

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\packaging\version.py

Filesize
12KB

MD5
282b75312c5607762a3849bea3471301

SHA1
811e48228d8c917f8db50eeec8e9d99cf2370068

SHA256
8ac2ac84509f369fc863ef556c3d5b9371862177012122e0c219bc5fc89cca6b

SHA512
d45db75fcbae34618a482587baf0e6fa0a8c6fb02b213fbe5d596d1cf2b1728790cac68809e6bdfe0224314d3a9e07b8d5a46ec609489315ee0e38eb4f6cf25a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\euc-cn.enc

Filesize
84KB

MD5
c5aa0d11439e0f7682dae39445f5dab4

SHA1
73a6d55b894e89a7d4cb1cd3ccff82665c303d5c

SHA256
1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00

SHA512
eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\drivea.xbm

Filesize
904B

MD5
a4ec724dc948f7094dc0eacb5a960f40

SHA1
0fcfe0dd79a951a593256a7257a7410a0294f546

SHA256
459e941ecd87984672bf1255da19a8de74f114e173e838f6b85ac734e7ef5fd1

SHA512
2c6ccda98d2c665dffb7e7340ad44822780e20e3ebb0493b58a313c0c46a62bb21be94ca0e3226aa52f410cf6ce3f0c2b2c95a0434c6e0678e77ec4ca55eec32

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\drivea.xpm

Filesize
1KB

MD5
93d39c85d0d9052a1eb932904e93da24

SHA1
6fd812fca35b166ba57c7a4e4a21c3d1a371959d

SHA256
05164d5becdda54104b20bc8f7358f627be9f2602d6b3e344a3033d92e73d148

SHA512
7032169b5952043fefb0856c01acf7cfa1632a4ecab4f460b0634cd8d5bc0de270f32586246b44eca13ce555bc893d44b1f659e125fef1fb1854dfb4ed89be55

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\netw.xbm

Filesize
898B

MD5
23f6b504a1004a9a2c91d0fcf5bce9b2

SHA1
4ea189c3af76a7df714c397bea1e32c1625d115c

SHA256
9efee21d14731a4d7b3bd7d9e3c02198bca7195173e009c25ef54a7538c93780

SHA512
0b82bdfebb4fad94b74207d23616633eee955f8203a020f4f4b957e61efece1609440741a60822e4884fadf4dddf43cae34b519b64a5e018e7a8031e8cd561b4

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\netw.xpm

Filesize
1KB

MD5
5165aae8ed4c6ee20b9aa6c3304e8042

SHA1
2404f7443e8797e335dd6bd93d8cf67dec291482

SHA256
068e6f025c1e4bb5b019ff51416fcedd4e5d211d5fca99412b19ded1295b2556

SHA512
ba573c5eb9f92f5c31236a35b021b366e4450b26f077f4c0f18ffd7f83a590e8e8415f7ecf057186ae0b0178ba04b13f5060c705c4a05fdd1a1ed4ffb911d0a9

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\images\tcllogo.gif

Filesize
2KB

MD5
ff04b357b7ab0a8b573c10c6da945d6a

SHA1
bcb73d8af2628463a1b955581999c77f09f805b8

SHA256
72f6b34d3c8f424ff0a290a793fcfbf34fd5630a916cd02e0a5dda0144b5957f

SHA512
10dfe631c5fc24cf239d817eefa14329946e26ed6bcfc1b517e2f9af81807977428ba2539aaa653a89a372257d494e8136fd6abbc4f727e6b199400de05accd5

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\license.terms

Filesize
2KB

MD5
aab15fb4a20635cecd264309d5e7f589

SHA1
c761aa7cefed34120fecf822addde47ed6e1aec2

SHA256
9a73710b7e69e7ec0defb53ef0b4de4dd296ed8a6b1c00a510117597e0793b3c

SHA512
0a01f9b91bf16ea8fdd382c8865028a4eeb87258bcb057eed0831c76eacd57013cd8c8a6f1193ac366321d544a1de3dd3bcd954be9cfa482ef60d9de1eec073d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Core.dll

Filesize
5.1MB

MD5
9356330cdf731eea1e628b215e599ce5

SHA1
88645c60b3c931314354d763231137a9ec650f1b

SHA256
ad045d1d084a88fe3f48c12aee48746b22cb3a579f9140840c54ae61f7af3478

SHA512
3d9ab9b1cdecad6809be96d82df2d1b9b8c9e1a7cf0ac79a820a92b11c8fa079f5a2c3875ba0b733503742c6977d6239ce22acec023a22038b2e7ee1ebd62d90

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Gui.dll

Filesize
5.2MB

MD5
d29d11da9f344f6d679a0de7b3174890

SHA1
b4cac4aa9c6b82e8d2d0c43991e8073261c13089

SHA256
079e3a248d169143a3d5da48d24dbcc0ce5fb8aaccbc02a6fce61c5fe2461b9f

SHA512
b43f2ef86d6fe4beb28a10e19834a4f76dbaddd071d16353b2641b72f2faa552a3bdba33a606da71a34ebb932f57dd142758b4a0a240231022c8bed8ee97cad6

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Network.dll

Filesize
1015KB

MD5
de150de21f1a2b72534eaa4aa4f03202

SHA1
39ed224cced1266d4adc5e68f6516979b8f52b33

SHA256
03871db7d626d14e84d8ebf007139aa2c08038cd3403ac6259f1a2eb01ae1477

SHA512
30eff193620724cda86e6de31c430f9d4426e677a553c7918f9b85dbfc67687acdecc2a29e45473666c01ce311b73833d9f79db8a93e80570c7ace8837ca531a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Sql.dll

Filesize
174KB

MD5
88aeafdcc3f3fa04b9b20022906745b0

SHA1
9dc03428234000d19bbc3cb437d370b8e1863329

SHA256
cd84c9c486c3e967ddd061718893ef5ee48eca24f77e3366b8fd3d2dd21f477f

SHA512
5ea87730f26b16215eb2b892a6da689524546ef6cfaf4e6c1f4e0afa083ceec3e8f00c9259d316d84ef4cb05b01023a1362b4a676d10b55e06ee365557ab7986

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Widgets.dll

Filesize
4.4MB

MD5
13f078d5c63cb192f68b45f5767a9e6f

SHA1
6149189a1553c2e0e6d715d3177c16c11af7d33a

SHA256
b0abf95a23e1616f3542a8cb794aac5b7463dff3db8621e3cd719ab1dd7f6226

SHA512
f3293fcdccb4901d4eb405706ad20da361140842a335e6f6a7ce54222fe028a1da2179be14ec40dbb5a1784ed5d33bd467174091606e6fcac12039dc0f48e52a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Xml.dll

Filesize
163KB

MD5
4bac5e44b4b2f138f6608c661330dad0

SHA1
b08ff311b24d9bbc48d4014d7a0cd0de129a19e7

SHA256
59ba9deba38b1e652a046fd6b58847a58883f2d8c5c1e81acfa78d2daad98a1c

SHA512
74871aaaf8dc3fc006f7a1fdc42eabf5a86e34674d34362b2b00bdebe023d78fa0e6a5ef4676dc038178a6eeb01a0ba1676f68a1cc6828ac8d4ece550106ee0a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5XmlPatterns.dll

Filesize
2.2MB

MD5
e2749ff4266d5a933feb7685dfe375b2

SHA1
f09a432c67f45fc2ed27c762db4176b7dd47e908

SHA256
e4ee537b6a585ec7656afd9fc6fd3f655ff44bec6ff8ec291fc3e868caade27c

SHA512
4efc6b0b8d39b47d9c415fc3bc7460e4f738e3694fac691bf94569549569a8d65270a54488af3ae49de9fabdbe518250ceee83f6633e1da407636e6e02bac8bb

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\libEGL.dll

Filesize
26KB

MD5
e7a8b7b7d0ae631fd8e2843ddaffdbe2

SHA1
36af63af284d26adacfa1c0055025dbd25008660

SHA256
40cf5f98f61346ecbc18db6b287300f2749971d89066070c7f0f2df143094e9d

SHA512
2d2f609f61f54cafce5bccee156ee38d622507672790fc8acd5428a7f8f638b5a02a356134f21a25917972bdde04e73f266f1347dbdbe0829a4e7e974fe73c56

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\libcrypto-1_1.dll

Filesize
2.5MB

MD5
8f4ccd26ddd75c67e79ac60afa0c711f

SHA1
6a8b00598ac4690c194737a8ce27d1d90482bd8b

SHA256
ab7af6f3f78cf4d5ed4a2b498ef542a7efe168059b4a1077230a925b1c076a27

SHA512
9a52ac91876eea1d8d243c309dadb00dfae7f16705bde51aa22e3c16d99ccf7cc5d10b262a96cfbb3312981ac632b63a3787e8f1de27c9bb961b5be6ff2ba9f4

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\libssl-1_1.dll

Filesize
533KB

MD5
bf2cae7a6256b95e1ba1782e6a6c5015

SHA1
3fbdc3afa52673c7bdfab16b500bbe56f1db096b

SHA256
352d2fd16675855e20cc525b6376734933539b76bc4b40d679d3069008fe4cfc

SHA512
90755eb718ba404b0e48a6713d4680db252f8156328a58fc347e74d84b8bd53a7a6276755c672240c0e5d78200130e3ddf86990779ddd86c6d10cebf2bc02c9e

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\log4cplusU.dll

Filesize
471KB

MD5
0b03f7123e8bc93a38d321a989448dcc

SHA1
fc8bfdf092cdd6b9c1ec3b90389c035c37e50bd7

SHA256
a7fbfdb3100c164f139e9d0ebcf47282308e5173ab610dcb20a05b6e0615b54b

SHA512
6d00c65111c0f389ad189178705ed04712b2c6de8918f58de7c3747126a4b4e50b4a73525cc0993af02d35323b1430f34baf6f99712df822d6cdc63e24ed7ae5

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\msvcp140.dll

Filesize
426KB

MD5
8ff1898897f3f4391803c7253366a87b

SHA1
9bdbeed8f75a892b6b630ef9e634667f4c620fa0

SHA256
51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

SHA512
cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\platforms\qwindows.dll

Filesize
1.2MB

MD5
8fa6d24d38724b50976557c089c8948c

SHA1
96f2d3e7c8fd9d67be6529545048a876c1dc059d

SHA256
e19ac3bb0fcba63aa9aa16c653b9b33656000bfee09e5e38229d4a5b651ff8f6

SHA512
071fe36d68cdd9f8eae0dccd1d5ea91746faa4381c6a721a9348bb423b579737257f0848c6dcecda9cc6e506830531e890c7a411032a1ffcac90b1264eb5c6e2

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\proxy_settings.ini

Filesize
101B

MD5
273ec42863e3d9f999381f09c13d313b

SHA1
008d1954b2a7d1c692a697c891f9692f41f10481

SHA256
4dd2c699bbb8c398788067be6fc82edc68c8246b8f6765169776bb24ebd0c487

SHA512
940df3f73592ccabc27bf2cc77de98eade7eb8988d30144060c817eda614085e36eadb699b02123c63774416e827194c269acd1267fad1d560b7df86a79ed89b

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe

Filesize
7.2MB

MD5
dcebee7bb4e8b046b229edc10ded037f

SHA1
f9bdf0b478e21389800542165f721e5018d8eb29

SHA256
2eb0eefab534217953744c2cc36de2e1a1ced6ea882734e7b1f4b34a0b19689b

SHA512
9827600a19da5a816f1b0d93aa2629cb48f13f6e5fc42cd44bb1031ecd2e942854b34e7da44335acb85e42c44b1e720e9da8bc1d9ad23a9b1de0190f026f4d30

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\qdjango-db0.dll

Filesize
132KB

MD5
342249e8c50e8849b62c4c7f83c81821

SHA1
618aa180b34c50e243aefbf36bb6f69e36587feb

SHA256
07bc6eb017005500d39e2c346824eef79b3e06f60c46fb11572f98d4fe4083c5

SHA512
32a44252926881edf916ac517cb55d53b0b1b5adcc5952a674d1707d2c1431a68b27e593b4c4fcab0648e3cbeddf3d4e8024ff2a3385af9dbd2b2244e518340a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
9a1059baef81b4efdb3ffa10459d6f77

SHA1
207f2ce485f4891b291f67be167860ecf9a0f8d9

SHA256
6ac09ddfab566eba9f0bfa015a65666cd4631c75c6a2eabb5a2f62c153eedfba

SHA512
60bcf6d569449764424312da23748f7ee23bc845d6f408083eb63e1b84ea2d57121bb8b42d943c30b9e5b988eac366b57c722e9a7ea06d32ddeec3db885e5cb7

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
796110dddd6648068510494fb78267b7

SHA1
c5453762da487f772ade4e7ff13b2b218ef3e5f3

SHA256
3b30c80754d9738867c7643e5f5520ce486eb2091635bc7d33442b7f84368ea9

SHA512
7a12828cc4d653a441346244148390577247e4e7f89100423f6bdd1930c5a216d5de97e145556c281d69661d74c6a1d8eaf3f9c7fa7aa926748116aad04ea01b

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
06e498ae0ba5cdaeb5f6c76aaf5bfe1f

SHA1
401abaf5033eca5dedced3a77f4e576c6266eb19

SHA256
3c58e9b23539e517d634f58820e05273a537874a0042c814908f392624507fbf

SHA512
b04721c5d8238b9d55cf03307c624dc0bd424f6e0ba1bb646dc0154628d89c208df27eaeb893d0d41bfcd7c38553d4c36d5160777b3f9c751fe4d0c42a297637

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
32KB

MD5
41b864bff66cad7fc7585ef0ae2c0a98

SHA1
6b191acec3a6d7df1d3b1607849faec9ad733d09

SHA256
0739cf9f8070716ba3a7d9ef4bfe63c150f17138c9b81f2de012d586f0dfd965

SHA512
741e3e672eca6c81a56dbf98da913033591d55aae20734743fe7bd5ad86f93d735c9a1f09f443ce425f7478830a5b31d13a000b6d1a7b635c7667a6739ca1f5b

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmproxy.dll

Filesize
154KB

MD5
84c848ca734892ea2e8ab90d84317ee3

SHA1
a1b38d4f1b466061481bdfde7628139c908f7ee5

SHA256
01c53abd5585992f9d62de40f4750899829b9e7e4a026b8d9f5d1cb1748a3fa9

SHA512
cec124435d6d4c76497e7886ca317a0c12a9d8e77200ba94cf6a699b318b91cb4db886eba5a5161941a7dd349f827cd3694abb864d6e37a9084a208276bee7df

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\sqldrivers\qsqlite.dll

Filesize
1.1MB

MD5
d9d7b0d7386cd57e4301d57cb7294b4b

SHA1
dcf385b8d3f9f99a07e1b7757508e5e4080f336c

SHA256
a4ee1bc55369a13b3e721aa48e44de31c6f00439838e923ab7a66438fbab4002

SHA512
e1568ce01edd46aabc795dd4eacab565ffc8dc0271129b5aa770f3763fba756a5de59aa4329510e65282bb19537874c6f307712a7fa2b6971f50dbee7b2664d7

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\token.ini

Filesize
8B

MD5
d670af02f76ed1e12dd15cf82fc09d78

SHA1
82027d68f22401cfe2b78f332d557703f899d4cb

SHA256
daca7d7ac8f6abf57f3c7bb3759be5daafea8268485293964677a56f4a887d40

SHA512
bb74387b7ff190779a8182e3a8948057ed07fbb46ceda4b4d6fcf1abef82451e4c10389bd64bc0a3eb826e8f79ba31fd36489bbb0371a8f296f3bb1bb1d9fa3f

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\vcruntime140.dll

Filesize
74KB

MD5
1a84957b6e681fca057160cd04e26b27

SHA1
8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

SHA256
9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

SHA512
5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
226B

MD5
feceaa82323f9de4d3578592d22f857d

SHA1
4c55c509e6d16466d1d4c31a0687ededf2eabc9a

SHA256
61480b43136b02965f59e3256b8de1bf35caa7c084a7bcb3ed5f4236451d4484

SHA512
82dac003d30eed4fc4e06ab4a426c9b7f355d777c243b710c5c0d3afc4c26d93874af2d0a542fca4a2038050b0d0fa8f63ed82e5f2771ae8a4de0f3b08d56d45

Download Submit
C:\Windows\Installer\MSIDF26.tmp

Filesize
285KB

MD5
82d54afa53f6733d6529e4495700cdd8

SHA1
b3e578b9edde7aaaacca66169db4f251ee1f06b3

SHA256
8f4894b9d19bfe5d8e54b5e120cef6c69abea8958db066cdd4905cc78ecd58b6

SHA512
22476e0f001b6cf37d26e15dfb91c826c4197603ea6e1fbb9143c81392e41f18fa10a2d2d1e25425baaf754bff7fd179ef1df34966c10985e16d9da12a445150

Download Submit
C:\Windows\Installer\MSIE1A8.tmp

Filesize
203KB

MD5
d53b2b818b8c6a2b2bae3a39e988af10

SHA1
ee57ec919035cf8125ee0f72bd84a8dd9e879959

SHA256
2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2

SHA512
3aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e

Download Submit
\??\Volume{ff3ab8f7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3c659cec-bba2-4f57-a3ef-6f4fda6ba728}_OnDiskSnapshotProp

Filesize
6KB

MD5
f251602e47ecd1a2a23a1a356f68b18b

SHA1
3a9f51ba8388550abd969672c357c9d0c547114d

SHA256
846a35bea9665b2eaa7663f95e4ad2146e9cc4a67dd3a58fa4638f56e8143775

SHA512
ed3519895bf9390baccfa9f9d41bacfbf8810e050176e78184b8e897a04fde69708ae9bfce9632e576d73a408ffd38a8a91764bc508149642a576ae7a3011012

Download Submit
memory/3684-5340-0x0000000005420000-0x00000000055E2000-memory.dmp

Filesize
1.8MB

Download
memory/3684-5332-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3684-5335-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3684-5336-0x00000000050A0000-0x0000000005132000-memory.dmp

Filesize
584KB

Download
memory/3684-5337-0x0000000005770000-0x0000000005D14000-memory.dmp

Filesize
5.6MB

Download
memory/3684-5341-0x0000000005250000-0x00000000052C6000-memory.dmp

Filesize
472KB

Download
memory/3684-5342-0x00000000051E0000-0x0000000005230000-memory.dmp

Filesize
320KB

Download