eeee232ef628352d43833b909892d2ed0807a43850baaf8d828b769c7840eb92

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

em_FReBA03x_installer_Win7-Win11_x86_x64/em_FReBA03x_installer_Win7-Win11_x86_x64.msi
Size

93.9MB
MD5

a2b4081e6ac9d7ff9e892494c58d6be1
SHA1

8b1858f5b6f9de98da0da23835ffb7197341b401
SHA256

d2479f32549799d766941ca412912a3c58b06fc1bcef55eb4db4c0d90bdd7dfb
SHA512

8a9ec3b404c7a0df38d08e96c8484d18b9d78a53ecd6de0f2632a84767df7b2f7fb387fa5295cb9f1cf3f6af55b2150c5d7dff7593385fe44afc8ecfce011d74
SSDEEP

1572864:OC2l1WbND0AFuMNQQyf7CfhU+43Seba3aQ6BZmOEbQSRsvuv+Tg9yS3i0PWmZyGT:qPoDn9NJ143Xba3Z6zN3c9X3ZzkL2kq1

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\ITarian\\Endpoint Manager\\ITSMAgent.exe"	msiexec.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	2700	msiexec.exe
5	2700	msiexec.exe
7	2700	msiexec.exe
9	2700	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\	ITSMService.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\distutils\emxccompiler.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\encodings\iso8859_10.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\menu.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\idlelib\aboutDialog.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\setuptools\command\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Conakry	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\Jujuy	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Choibalsan	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\bitmaps\folder.gif	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\bitmaps\resize2.xbm	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\encodings\iso8859_15.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Ensenada	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Libya	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\email\mime\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib2to3\fixes\fix_nonzero.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\vcs\subversion.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\setuptools\site-patch.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\compiler\transformer.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\cProfile.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\pkgutil.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\easy-install.pth	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\msgs\de_be.msg	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\US\Pacific-New	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\idlelib\ReplaceDialog.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib2to3\main.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\vcs\git.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\mbcharsetprober.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\encoding\ascii.enc	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Canada\Eastern	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\Select.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pkg_resources\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\msgs\es_py.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\St_Vincent	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Swift_Current	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\msgs\ca.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Timbuktu	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\America\Kralendijk	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\about.xpm	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\StdBBox.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\antigravity.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\distutils\command\install_data.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\encoding\cp860.enc	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\encoding\ksc5601.enc	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\demos\items.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\distutils\command\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk85.lib	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\rmmlogs\RmmServiceInstaller.log	RmmService.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\idlelib\idle.pyw	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib-tk\Tkinter.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\encodings\mac_iceland.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\demos\paned2.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\fileinput.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\genericpath.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\idlelib\ZoomHeight.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\utils.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\tzdata\SystemV\AST4	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\select.xpm	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tk8.5\demos\check.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\distutils\command\build_scripts.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\hotshot\stats.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\lib-tk\tkFont.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tcl8.5\encoding\cp949.enc	python_x86_Lib.exe
File created	C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\tix8.4.3\ChkList.tcl	python_x86_Lib.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\{C82FE567-C842-487F-B719-C9FDC94F7221}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI724D.tmp	msiexec.exe
File created	C:\Windows\Installer\f775dd9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\wix{C82FE567-C842-487F-B719-C9FDC94F7221}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\f775ddc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6232.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI67B1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C82FE567-C842-487F-B719-C9FDC94F7221}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\f775dd9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5FDE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI60C9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI688C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B14.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f775dda.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f775dda.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6211.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6252.tmp	msiexec.exe

Executes dropped EXE 7 IoCs

pid	Process
2384	python_x86_Lib.exe
1260	ITSMService.exe
2992	ITSMAgent.exe
2648	ITSMAgent.exe
2864	ITSMAgent.exe
748	RmmService.exe
1904	RmmService.exe

Loads dropped DLL 64 IoCs

pid	Process
2064	MsiExec.exe
2064	MsiExec.exe
2064	MsiExec.exe
2064	MsiExec.exe
892	MsiExec.exe
892	MsiExec.exe
1168	cmd.exe
892	MsiExec.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
1260	ITSMService.exe
2648	ITSMAgent.exe
2648	ITSMAgent.exe
2992	ITSMAgent.exe
2648	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2700	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_x86_Lib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Modifies data under HKEY_USERS 53 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	ITSMService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\765EF28C248CF7847B919CDF9CF42712	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\765EF28C248CF7847B919CDF9CF42712\DefaultFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\Version = "151109282"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\765EF28C248CF7847B919CDF9CF42712	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CDM	ITSMService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\SourceList\PackageName = "em_FReBA03x_installer_Win7-Win11_x86_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\PackageCode = "B1460A196BBBB7C44ADB0144887655EA"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\em_FReBA03x_installer_Win7-Win11_x86_x64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\em_FReBA03x_installer_Win7-Win11_x86_x64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDM\proxy = "false"	ITSMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\ProductName = "Endpoint Manager Communication Client"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765EF28C248CF7847B919CDF9CF42712\ProductIcon = "C:\\Windows\\Installer\\{C82FE567-C842-487F-B719-C9FDC94F7221}\\icon.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
2648	ITSMAgent.exe
2992	ITSMAgent.exe
2864	ITSMAgent.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2716	msiexec.exe
2716	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2700	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2700	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeSecurityPrivilege	2716	msiexec.exe
Token: SeCreateTokenPrivilege	2700	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2700	msiexec.exe
Token: SeLockMemoryPrivilege	2700	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2700	msiexec.exe
Token: SeMachineAccountPrivilege	2700	msiexec.exe
Token: SeTcbPrivilege	2700	msiexec.exe
Token: SeSecurityPrivilege	2700	msiexec.exe
Token: SeTakeOwnershipPrivilege	2700	msiexec.exe
Token: SeLoadDriverPrivilege	2700	msiexec.exe
Token: SeSystemProfilePrivilege	2700	msiexec.exe
Token: SeSystemtimePrivilege	2700	msiexec.exe
Token: SeProfSingleProcessPrivilege	2700	msiexec.exe
Token: SeIncBasePriorityPrivilege	2700	msiexec.exe
Token: SeCreatePagefilePrivilege	2700	msiexec.exe
Token: SeCreatePermanentPrivilege	2700	msiexec.exe
Token: SeBackupPrivilege	2700	msiexec.exe
Token: SeRestorePrivilege	2700	msiexec.exe
Token: SeShutdownPrivilege	2700	msiexec.exe
Token: SeDebugPrivilege	2700	msiexec.exe
Token: SeAuditPrivilege	2700	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2700	msiexec.exe
Token: SeChangeNotifyPrivilege	2700	msiexec.exe
Token: SeRemoteShutdownPrivilege	2700	msiexec.exe
Token: SeUndockPrivilege	2700	msiexec.exe
Token: SeSyncAgentPrivilege	2700	msiexec.exe
Token: SeEnableDelegationPrivilege	2700	msiexec.exe
Token: SeManageVolumePrivilege	2700	msiexec.exe
Token: SeImpersonatePrivilege	2700	msiexec.exe
Token: SeCreateGlobalPrivilege	2700	msiexec.exe
Token: SeBackupPrivilege	744	vssvc.exe
Token: SeRestorePrivilege	744	vssvc.exe
Token: SeAuditPrivilege	744	vssvc.exe
Token: SeBackupPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeLoadDriverPrivilege	2748	DrvInst.exe
Token: SeLoadDriverPrivilege	2748	DrvInst.exe
Token: SeLoadDriverPrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2700	msiexec.exe
2700	msiexec.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe
2992	ITSMAgent.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2648	ITSMAgent.exe
2992	ITSMAgent.exe
2864	ITSMAgent.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2064	2716	msiexec.exe	34
PID 2716 wrote to memory of 2064	2716	msiexec.exe	34
PID 2716 wrote to memory of 2064	2716	msiexec.exe	34
PID 2716 wrote to memory of 2064	2716	msiexec.exe	34
PID 2716 wrote to memory of 2064	2716	msiexec.exe	34
PID 2716 wrote to memory of 2064	2716	msiexec.exe	34
PID 2716 wrote to memory of 2064	2716	msiexec.exe	34
PID 2716 wrote to memory of 892	2716	msiexec.exe	35
PID 2716 wrote to memory of 892	2716	msiexec.exe	35
PID 2716 wrote to memory of 892	2716	msiexec.exe	35
PID 2716 wrote to memory of 892	2716	msiexec.exe	35
PID 2716 wrote to memory of 892	2716	msiexec.exe	35
PID 2716 wrote to memory of 892	2716	msiexec.exe	35
PID 2716 wrote to memory of 892	2716	msiexec.exe	35
PID 892 wrote to memory of 1168	892	MsiExec.exe	36
PID 892 wrote to memory of 1168	892	MsiExec.exe	36
PID 892 wrote to memory of 1168	892	MsiExec.exe	36
PID 892 wrote to memory of 1168	892	MsiExec.exe	36
PID 1168 wrote to memory of 2384	1168	cmd.exe	38
PID 1168 wrote to memory of 2384	1168	cmd.exe	38
PID 1168 wrote to memory of 2384	1168	cmd.exe	38
PID 1168 wrote to memory of 2384	1168	cmd.exe	38
PID 1168 wrote to memory of 2384	1168	cmd.exe	38
PID 1168 wrote to memory of 2384	1168	cmd.exe	38
PID 1168 wrote to memory of 2384	1168	cmd.exe	38
PID 2384 wrote to memory of 1568	2384	python_x86_Lib.exe	39
PID 2384 wrote to memory of 1568	2384	python_x86_Lib.exe	39
PID 2384 wrote to memory of 1568	2384	python_x86_Lib.exe	39
PID 2384 wrote to memory of 1568	2384	python_x86_Lib.exe	39

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\em_FReBA03x_installer_Win7-Win11_x86_x64\em_FReBA03x_installer_Win7-Win11_x86_x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2700

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 56246E4ED7245903F318DE32A10EB2BB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2064
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 85A45427B17190C1D05786B61D31C2C1 M Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\ITarian\Endpoint Manager\" && "C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe
      "C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe"
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2384
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000494" "00000000000005D8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe
"C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe"
1⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1260
- C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2992
- C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe" noui
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2648
- C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2864
- C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe
  "C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe" --start
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:748

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2192

C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe
"C:\Program Files (x86)\ITarian\Endpoint Manager\RmmService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1904

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f775ddb.rbs

Filesize
711KB

MD5
d7e76f168707ae81251cee4012d6552d

SHA1
008b83cfd54c56129062b820e5bb41f1c1bdfb08

SHA256
19a083e2b7972d87ccf7c0f479d57bd08d0365eadf2f6af3b2489b06b7365b41

SHA512
83b05b1c42a4dc236994b7299c35d47b0eb5941847f0636f7609188d38d20d09be3392c44f879ab3554a031d543ea7753bcbdf014735ce24bc917e2eaaf48a45

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMAgent.exe

Filesize
3.0MB

MD5
e6215cb872859527bd919caece57800b

SHA1
e0cb7579997eadd2131fa1e44ccd3d13a566b59c

SHA256
33417ec81b6742fbf550f7423198cc6bcce6274bb819934c898d6eb1ef4004a6

SHA512
93c4c4b33ef4c3b7829d853518ce9990b138ce96ac0c779d4c0bf725422600e236f948c2ebc253b5ec6394f407a9ef621c9410bb85db7f9a7ff7a08028f2cca7

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\ITSMService.exe

Filesize
8.4MB

MD5
f70538a01b88689852037389b49826d2

SHA1
0eba13501285260c628450b7d57bfadc2b670faf

SHA256
0f9a70684ee7cecca6c01d8d65ed51a15b60f1d1664cc353f391f7a3d426f3a3

SHA512
a4d0952da18e0e60d36739e2d8bcb09175afdbc6ee6a8839da56c55e7b0af4cced57a99e540b1f60b83a7e18411c9e62244a4a5229bc684f300ddd72b1522af6

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\Qt5Widgets.dll

Filesize
4.4MB

MD5
7969a5f8485f76e7da470e966b4b677f

SHA1
a1da9489c84d6309438855ee56bf113bbca651f4

SHA256
996fd8ef02b76adc0a327465491fff334d22e667ccf4a2e2adf82ab948038c83

SHA512
f70eb7da4a1cb9d84ada16400cbd4a3cf62243dd7fbf46eb16e5818c1a7db223b0cf47e1fdbaf9888a4e037af8529c3e1d31461089dbbf2c6f63007935c52bcc

Download Submit
C:\Program Files (x86)\ITarian\Endpoint Manager\python_x86_Lib.exe

Filesize
7.2MB

MD5
7b7174e51f9cd2e2bf5c0877f3b7f4ce

SHA1
4373bdeff7ddb686a2d4dc24f4ff64656add61a8

SHA256
87157acde3d71be94feb4b5eeac0c6a908b7d36de1af66ce4fa682617de6aee4

SHA512
4e55c80ab85b1a960cb699b62513dd400252cd3519ecbf4db2ee33728fb9cda89ee3be6d3a7cfa308fe791a993af4284c09a2e6400fe137606b145388eb5664f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
765B

MD5
3a4e147a2de6fd9d42312ccd8e2b3240

SHA1
633def9461927ca583646e25060f33edaea4ebad

SHA256
d0432db5cc17fbdd3136c90e386ab1441bf45cc890eaadc337acf683f0aea744

SHA512
2f4a38de4c880b87cdfc5ae5e21d32e56bed615eaff3cc2f24a18b53dd1ea7462e901bba2587a3ad1539d7a19c6e3991d5ca847f89248d86a9a6780bc159b12e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

Filesize
637B

MD5
7c3f5ee48927243f66de32d91dd70aa9

SHA1
82efd681abfd00121e51daa09e002f6fb878bfba

SHA256
a4e49f7e1c5cbb992dcd9cfb9257635d69393b31b134c96ddc260f075e187b1b

SHA512
95402858de0b147ce85f6ed6999f13f929d6e58c2fa5b09ba76f2294a74d7410601e69a38b7b71893710c6e1870f4b0fe8e20a973bc70696fa27aeb27ff3b7b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
1KB

MD5
e850e063c3d21e596f614a0fac173298

SHA1
192a158c4739e3162640934084a925fe2e4588cc

SHA256
3f4268d58f84a28da29ce3532ced8eb4389ce461a94465da3f6413ebd15a9c03

SHA512
c972136f400092a5800497aef304375859c1e1d3df4792d40ffb8fbf128a9af8d4ab6972efe2c366b3ac9eeb8a188a86aa07811daac489f4438a9c8fcd86f17d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
484B

MD5
2a95b93dab2f778d1c439d0b6b12b0a2

SHA1
b6ea536d8fffe0f46a94f0b265200166909662a5

SHA256
7cff8301a41f77df1376788f9e6c3d9349c789591b431ad3ac89aac7026dfe02

SHA512
fa69b13a34e2e06fc3e466b13027e4b5d84c2a1c859610a1db26a6e44ccf6fcf5b3ccc218b3da58f89a63b0440a0113d74e113060d9af444cf171c419f17a8eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

Filesize
480B

MD5
5ac070979d8903eac5e9511726437522

SHA1
1b912bef8a83dbfadf9dba2a75141d9f9bb7db8a

SHA256
307ebd51b2a72b9f0012b3109d58c90239f3c0900dbbef8809ef93d4389c7d39

SHA512
269c37d618c60dfb0136a4da554edd2d324c964eeb4a7e5f129753b0ce0b2acacd1a11f93a7edb1675c136e8d40ed565890a887e04211454dcf6670e8383b0d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ca550f9697112c93c3565d3739c6157

SHA1
3040770c74cdb00ae7ab8b7ecb58f6ae98c96549

SHA256
319ed4ca8c57366c6d74b6803318ac31f5bef60b0a0e3eb164707ef4d53d3663

SHA512
ef47ebdc97f7b4a851075c82f5731f2bce192cd92fc6e00e5a94060fcdcdd16ed6c32036f0f5a6ef3c346f1c7388f1aa0575f0f234778b8ffcfa6f90bf8a6271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
482B

MD5
69ab984e147dbe2897708051ad70dd31

SHA1
e84bcdbd89fff41dad54aa4f0244fce95dce2658

SHA256
b3efb2e22e15b07f35d5a835347286dff8c351a9e276b66ba9e847bb7840e177

SHA512
4e47579e16b837fde7d9a69249edba89c17ccff4b00ba88a184bf714f64d001af72aae367fec55d1b5558e89a524479b49fec5d32da537b65820f3285424828e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
228B

MD5
8f45e0ea664b30edd40e277c6eb8fc89

SHA1
9742d05a0eabe8c4960d80bcb24e51514e77a803

SHA256
e2cdd1993e117f75ecd7833a86becccc3ecee73d8afd7197971acac88408c4d3

SHA512
6dec7f7a59cff0533eee2f50c44eefff880f1486d8cc0c3fa2884bb222d837dde26d7a21f4879b3ed2e4081dee6580529bbd3f23b93efd2e80609bb37b85f00d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3CE3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D05.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\MSI5FDE.tmp

Filesize
285KB

MD5
a036727c2de2b87f22572d1a990d18eb

SHA1
029a583923ef9e017a2dc6334591c40468f7f55b

SHA256
f39b9cfe82861e5206011c96f9683210b4ac8abd0c0b7291c58e2f1094cf663f

SHA512
a0c7008343b4cae633263c8c6c989c76b3558b977a78360a024f4d719a00a7eccf50d170ec22a5fa8756730168b3aba487268ef9a517c3bd73cc46de4425845a

Download Submit
C:\Windows\Installer\MSI60C9.tmp

Filesize
203KB

MD5
d53b2b818b8c6a2b2bae3a39e988af10

SHA1
ee57ec919035cf8125ee0f72bd84a8dd9e879959

SHA256
2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2

SHA512
3aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\ApplicationManagement.dll

Filesize
87KB

MD5
3ee9fa14a1a572a684ce35ca04641ac6

SHA1
ae04a8cf0cf0d04adc076a9724ca9c9ec61c3387

SHA256
4ce15a660e3167f3d66e3241d4ae204437e32c0149d385489999fbd6e2cdc031

SHA512
a6f379b9ef6a9a98360d22ab104b68dad9ad5f04e8c6fbe0be658994e44f9501beb3f20639475fbd7f8ae37b337f4cf7a3fb5d3b449fdf843d632e0e48443739

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\Qt5Core.dll

Filesize
5.1MB

MD5
de8cbc4ca3be4595864305f387d61e18

SHA1
aeb5c93d429fe9f75f944c6c1cb89b73adbaecd2

SHA256
9794dfdd69deac852f4695b1cc3349d7a6c2c3b73d1227e8f5a08de83bad053d

SHA512
9c8afe027b67604e996fa767d0b3a7bac6f34b4f1bd68085765b7ee1193dbaedecf85698309c792c104c6bbc62e74edfb78d90e36a6844b392ee4e959aa11e28

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\Qt5Network.dll

Filesize
1015KB

MD5
fdd60a6d835d294abd0f15551eae82c5

SHA1
921fe9f548901212f273000ba9c6f9c573f4dbec

SHA256
e430daed9d03d1d3d419ba2ddf45710c6b5268b31264637343444a946838ec51

SHA512
74efca078f5721dd9fef7ca64d68f8f50b5c47a3cac4c66c80729ddef3b5cd2ec955ab0dcc9f6c564d3daf6d02654899644ddace50888a44410d174319a10ccd

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\Qt5Sql.dll

Filesize
174KB

MD5
dff5a079ad88ef376589b4ba9aacf183

SHA1
7d25fb0b4a19bc7c0133c546e6d17912dead18e0

SHA256
60624c8e6edfb2fd2f930e74d7791e189e7df5445da3a228994861fab6ed1c80

SHA512
17fd90c552023b671c815e7dcfa453510428f43db4516631230627c1fe5905f7e49b5a5f167976030197cc380f2951be22ef34aee7d3a7e8110cff8927965614

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\Qt5Xml.dll

Filesize
163KB

MD5
d39f397e23f7532768069e87465bc80a

SHA1
fc7e6aa0402c3ebe724f4907553f3f5c6152addf

SHA256
ed553a7d2a75131e20095e16a9bc28ae6ddde902b2bf2df925fe04b4b427aac7

SHA512
7187dc6e4f631b00a61ba679af9a1d3efe8ef9dfb0f471afdba3ba4b53f8dcd040a5ab34a8fbbaef942f18825ca0903c913853bfb6307733c7996ed50b0210c9

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\Qt5XmlPatterns.dll

Filesize
2.2MB

MD5
862ae60ac641c121572e484aa9be6407

SHA1
d1a866200227c3b26f2ba29b212f7fb6db276a5a

SHA256
1d27c8e75ecb9b0fe0f0f5fdb38ad21370cfad5073c633a8299dbaca4b295f15

SHA512
841256c1b61ef4f9b9637c1f427c0601c3f1a484c1c0a3083a2a831e46127870fde78af37a6b7b23814c541b0f0deab8ad3ba513a7a25444a396396f97e81d02

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-core-file-l1-2-0.dll

Filesize
10KB

MD5
7d64aefb7e8b31292da55c6e12808cdb

SHA1
568c2a19a33bb18a3c6e19c670945630b9687d50

SHA256
62a4810420d997c7fdd9e86a42917a44b78fb367a9d3c0a204e44b3ff05de6d4

SHA512
68479da21f3a2246d60db8afd2ae3383a430c61458089179c35df3e25ca1a15eba86a2a473e661c1364613baa93dcb38652443eb5c5d484b571ab30728598f9b

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-core-file-l2-1-0.dll

Filesize
10KB

MD5
dcd09014f2b8041e89270fecd2c078b2

SHA1
b9f08affdd9ff5622c16561e6a6e6120a786e315

SHA256
6572965fd3909af60310db1e00c8820b2deef4864612e757d3babab896f59ed7

SHA512
ef2ac73100184e6d80e03ce5aa089dbddb9e2a52adf878c34b7683274f879dcf2b066491cfc666f26453acbd44543d9741f36369015bd5d07e36b49d435751f6

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-core-localization-l1-2-0.dll

Filesize
13KB

MD5
3979437d6817cdf82da474c8a1eefb0d

SHA1
5e96fe40993acbc7c2e9a104d51a728950ad872e

SHA256
3dd2e16b6f135cdd45bce4065f6493540ebbaf2f7f1553085a2442ea2cf80a10

SHA512
4f64c6d232fdae3e7e583cb1aa39878abbfbbc9466108b97a5dce089c35eb30af502b5b212b043c27c1b12b23c165bd2b559060c43d9e2efcdda777b34f0066b

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
4da67feefeb86b58a20b3482b93285b3

SHA1
6cd7f344d7ca70cf983caddb88ff6baa40385ef1

SHA256
3a5d176b1f2c97bca7d4e7a52590b84b726796191ae892d38ad757fd595f414d

SHA512
b9f420d30143cf3f5c919fa454616765602f27c678787d34f502943567e3e5dfb068fec8190fea6fa8db70153ed620eb4fe5dc3092f9b35b7d46b00cc238e3ba

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-core-synch-l1-2-0.dll

Filesize
11KB

MD5
c250b2e4ff04d22306bf8ce286afd158

SHA1
e5c60b7892ff64cbff02d551f9dbf25218c8195b

SHA256
42367b6b7285bddc185c0badefe49e883646f574b1d7d832c226f2d1ce489c5b

SHA512
a78c4ddf98330698c9da8d1d2c7c3176f22dfabf0900008cff1f294f56a2a14b52becd09ba37a065d544f58617911b3f5850614b5aabd0ec7daf236f29c9b10b

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
3339350008a663975ba4953018c38673

SHA1
78614a1aad7fc83d6999dcc0f467b43693be3d47

SHA256
4f77abb5c5014769f907a194fd2e43b3c977df1fb87f8c98dd15a7b950d1e092

SHA512
a303fd57dd59f478a8d6c66785768886509625a2baf8bf2b357bb249fc93f193ac8c5c2c9193e53738805700e49b941bf741d6c4850a43f29a82424ccdda191b

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-conio-l1-1-0.dll

Filesize
11KB

MD5
eb07d1e84fd3fd83e71c1ea7ae8498a3

SHA1
b162375e93c40955244342d18902bff8ed902674

SHA256
687be4f560dc3fb96bcda9332617a2d4b1d587411dd1c31ad088146ac0b24a76

SHA512
5787637599e1ec9f086c78bfa4ce7d49a8374404dbce8d884e90282b366a446ef3444288add0f3741c642beb01266555053091bdee2ee70bf6126052bf1564e0

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-convert-l1-1-0.dll

Filesize
14KB

MD5
392b572dc6275d079270ad8e751a2433

SHA1
8347bba17ed3e7d5c2491f2177af3f35881e4420

SHA256
347ceeb26c97124fb49add1e773e24883e84bf9e23204291066855cd0baea173

SHA512
dbdbd159b428d177c5f5b57620da18a509350707881fb5040ac10faf2228c2ccfd6126ea062c5dd4d13998624a4f5745ed947118e8a1220190fdb93b6a3c20b7

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
9806f2f88ba292b8542a964c0b102876

SHA1
c02e1541a264a04963add31d2043fa954b069b6b

SHA256
cf601a7b883bb4fb87c28b4a1d9f823d2454b298cdbcb4da4f508db8bd1278ba

SHA512
d68cb926de3caa498ad2aea60e2c5dbb72f30836a6ad9bb11a48f2ca706656981d9332dae44769ccf6f8de3b2ea1507983440afbe1322520f2fd1674cd8de823

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
12KB

MD5
1747189e90f6d3677c27dc77382699d8

SHA1
17e07200fc40914e9aa5cbfc9987117b4dc8db02

SHA256
6cc23b34f63ba8861742c207f0020f7b89530d6cdd8469c567246a5879d62b82

SHA512
d2cc7223819b9109b7ce2475dfb2a58da78d0d3d606b05b6f24895d2f05fb1b83ee4c1d7a863f3c3488f5d1b014cd5b429070577bd53d00bb1e0a0a9b958f0b1

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-heap-l1-1-0.dll

Filesize
11KB

MD5
1bcb55590ab80c2c78f8ce71eadeb3dc

SHA1
8625e6ed37c1a5678c3b4713801599f792dc1367

SHA256
a3f13fa93131a17e05ad0c4253c34b4db30d15eae2b43c9d7ec56fdc6709d371

SHA512
d80374ec9b17692b157031f771c6c86dc52247c3298594a936067473528bbb511be4e033203144bbf2ec2acfd7e3e935f898c945eb864dcf8b43ae48e3754439

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
7481e20041cf8e366d737962d23ec9de

SHA1
a13c9a2d6cf6c92050eaae5ecb090a401359d992

SHA256
4615ec9effc0c27fc0cfd23ad9d87534cbe745998b7d318ae84ece5ea1338551

SHA512
f7a8e381d1ac2704d61258728a9175834cf414f7f2ff79bd8853e8359d6468839585cb643f0871334b943b0f7b0d868e077f6bd3f61668e54785ee8b94bf7903

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-math-l1-1-0.dll

Filesize
21KB

MD5
f4e9937296ec528938a3c28a48687f5c

SHA1
961390a2c5e08336857c8a39b254b2bfe3d8bdc6

SHA256
190a2cc8c8e47fcd4d07b4e260e247fb3b5fb4661aa50f7b05158cd062d80762

SHA512
00ccf9326e593236f57c39ffcd3ab1a77c54755c5f938207ad548d64d60a7468ea21f6e340d385e6576bb049bca1dd318da572c5808c353dda1c4629fd99bc42

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
047c779f39ebb4f57020cd5b6fb2d083

SHA1
440077fc83d1c756fe24f9fb5eae67c5e4abd709

SHA256
078d2551f53ca55715f5c6a045de1260ce331b97fd6d047f8455e06d97ef88dc

SHA512
95a57d79c47d11f43796aea8fd1183d3db9448dee60530144b64a2dd3cd863f5b413356076c26101d96dd007ebf8aff9e23cf721ba4e03d932c333b8e5536b73

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
16KB

MD5
10e9dfc88bf784847e7b9aab82e28d0c

SHA1
cb750cf87d561ca32f5860854da374dae6c9f2ad

SHA256
e6bab87156c9e7ae14ce36a754eb6891891a22ddfff584b706538152017fbb0f

SHA512
29c2edb44cada75ee8ccae1b55a405c8282c937450913196d54b6da1a1e121451c6e14a92a200574984961fa8c649d8a40caf58ea50a33d42a7dfae4439091c2

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
1f1d50aa4553e77f6b90ae13bd56a95c

SHA1
cf421a298f485c2a000791e1840ededeea19bad0

SHA256
d343529d2a49cbb89d644deafce573b873ab45e0bf57e2d906b2f2a964d7bd9a

SHA512
a08bdcc2883066a8bdb9336eec5c7f8593202c367ce75a7d7390ed4c6e0e1dbe80b7afadeee78f12ac0386d70ac360af12bf0ff3285acda0425789038951f180

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
fa5327c2a3d284385d8dc3d65935604b

SHA1
a878b7cdf4ad027422e0e2182dad694ed436e949

SHA256
704ad27cab084be488b5757395ad5129e28f57a7c6680976af0f096b3d536e66

SHA512
473ff715f73839b766b5f28555a861d03b009c6b26c225bc104f4aab4e4ea766803f38000b444d4d433ff9ea68a3f940e66792bae1826781342f475860973816

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\api-ms-win-crt-utility-l1-1-0.dll

Filesize
11KB

MD5
cefab9071ec289d88bb312816e62ca82

SHA1
bd95bd97332ea21506171924acde4f4248a2ee6a

SHA256
340ced80fbcfca804925ff680da1929f68b95959fd7e4d0c9f67322bb5fe2155

SHA512
03c4b2b155392dc02370994d28b78d18c38ccbb0c594866ae31db54111f0f18e264e1378acde0f2638e19871d7e3df7ca3365ad63c0de689c331f6e5b14e3582

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\libcrypto-1_1.dll

Filesize
2.5MB

MD5
a443165cde68e6bf7fba18bfdb10f358

SHA1
e670e6d3357ff0acc85be626f6feb44ef4bc0b43

SHA256
9fe3393b71cf667264a2f7c4ae1afbf9c8110df9a0b197732215392acf4b11f8

SHA512
dc3670d2020b8725f3a966b69eefb5d08c9424f4c3950d19a99b49e9862ee8ed7ab7d0c937c4ce94c237092cf2190c8eea2204be1b7770d5be0728090c570739

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\libssl-1_1.dll

Filesize
533KB

MD5
93672b91b1180409098adf715ce7f3d2

SHA1
55d462a97f88118eae1a48e35eb0800e4bb89133

SHA256
f7421298d4d02dfa2592cffa95a8df04cb9630c531aa0a8b0b74f701a2cc4fb4

SHA512
36693e2c45ff968b257e3aa13750fda0225ca628b4209e2d0bcb8a899ffec132fa2a83e2d152c69f477d1eeef59f58eb80b1158e34cf27d15565495fe32574b8

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\log4cplusU.dll

Filesize
471KB

MD5
c1a301526e947b2a99017fdd0f6117f0

SHA1
c4919aa0d5a9af5b588f3b5edef372c1426737f1

SHA256
b63f3111b880ad987b647d2c7ea5abe860794b4369289ef5688aa50de0407722

SHA512
3cd9210314f9217d4afe2f9c757cd985ee4c17bdd566cc4bdf4872cb8075fb3101c6fac6412b90b5dd7bbfef48f7e57ec8fca85699035b9b6817f175c6aff21a

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\msvcp140.dll

Filesize
426KB

MD5
8ff1898897f3f4391803c7253366a87b

SHA1
9bdbeed8f75a892b6b630ef9e634667f4c620fa0

SHA256
51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

SHA512
cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\qdjango-db0.dll

Filesize
132KB

MD5
e922d91ecbf5ec68e2af5c4d918fd1ab

SHA1
f265bfaf489976418fe9e9c955187276c602f5d8

SHA256
70936caa3584b6f49400cdded767b8f1083872d4fe9e9a43bca2b0304434006f

SHA512
947deba25cdccea870724604aeeb63ad97ffa2a3d029c2e766a70055151ab78afea33f6746b0c3a28b252daed35576bb99d68742bba7db1ac41c2147ea659a19

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\rmmproxy.dll

Filesize
154KB

MD5
40b0a10d3eafa102a2121f585bfe9d39

SHA1
34ff0b9c903c60c3860ac911b59ac6babfbab649

SHA256
ddc523f553b1bc86cc3fc922fc76c597947028121f7e95f597c297a5f219f2b7

SHA512
d1e76134e2f4d461e679e4463c5f9bb52d9d3e6b146f32b0e98b3384d08e69c21aa963eaa2c1a3308474389b01d6165e53cdea4386e94781720deccc42c9b764

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\sqldrivers\qsqlite.dll

Filesize
1.1MB

MD5
d67a1b1ed6ae58d5409232c160ea89af

SHA1
adfc30018ad670a385dab157b4fc37f97e66bae0

SHA256
6b4f0c8f5fc503f0bb1f3a8fe876bc73a75799975049b1f24d892e51575581e3

SHA512
307aa972c18aeeed19dfedaf4403b3f506466e8ca35993c0e555a08a00a2e8f50de745849956de6fd3d2c0daee6bd40b3ec6451e0a093e986bc7e89399481076

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\ucrtbase.dll

Filesize
1.1MB

MD5
126fb99e7037b6a56a14d701fd27178b

SHA1
0969f27c4a0d8270c34edb342510de4f388752cd

SHA256
10f8f24aa678db8e38e6917748c52bbcd219161b9a07286d6f8093ab1d0318fa

SHA512
d787a9530bce036d405988770621b6f15162347a892506ce637839ac83ac6c23001dc5b2292afd652e0804bd327a7536d5f1b92412697c3be335a03133d5fe17

Download Submit
\Program Files (x86)\ITarian\Endpoint Manager\vcruntime140.dll

Filesize
74KB

MD5
1a84957b6e681fca057160cd04e26b27

SHA1
8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

SHA256
9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

SHA512
5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

Download Submit
memory/1260-4826-0x00000000021A0000-0x00000000021EC000-memory.dmp

Filesize
304KB

Download
memory/2864-4805-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/2864-4804-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/2992-4802-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download
memory/2992-4803-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download
memory/2992-4820-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download
memory/2992-4821-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download
memory/2992-4822-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download
memory/2992-4825-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download