ba3cdc5190b44da96e5ecb5f39e2cbe3713984dc8062cdab679c759de51500b1

Analysis

max time kernel
135s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba3cdc5190b44da96e5ecb5f39e2cbe3713984dc8062cdab679c759de51500b1.msi
Size

94.2MB
MD5

f740670bd608f6a564366606e0bba8da
SHA1

c635e8453bf0f06c34d41d3319670e5dc966a5f4
SHA256

ba3cdc5190b44da96e5ecb5f39e2cbe3713984dc8062cdab679c759de51500b1
SHA512

88f1e800265e4e72f914e50240a6a7cca630ea4bcd6981be13237cc6f42b182741542b907737490a367453c179ace55fb64c3e0fb2cb6ecf1bace7a442458e0e
SSDEEP

1572864:SX+lBWb7cVOxi2CDRq/SUx6EIL2CjmFkm+pF7Vxo81MOL9vh12epl37cTLiAhRLh:nLYxsRq/76L2CjmCZpRXouxvD6LbhRHJ

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe"	msiexec.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	3008	msiexec.exe
7	3008	msiexec.exe
9	3008	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\act_fold.xbm	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples\FileEnt.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\colorama\ansitowin32.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\html5parser.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\SystemV\AST4ADT	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\msgs\es.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\bitmaps\harddisk.xbm	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\compat\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\sysconfig.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\DragDrop.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\msvc9_support.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Indiana\Indianapolis	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\bg.msg	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\xml\dom\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\_markerlib\markers.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\euc-cn.enc	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Malabo	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Indian\Mayotte	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\Icons\idle_32.gif	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\nturl2path.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\msgs\en.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Regina	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\UTC	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Cairo	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Canada\Mountain	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Tirane	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\radio.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\Icons\tk.gif	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib-tk\Tkconstants.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\zh_hk.msg	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\FileDlg.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\qtwebengine_resources.pak	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_import.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\ssl_support.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\history.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\Catamarca	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Novokuznetsk	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\combo.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\uuid.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp1256.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\utils\logging.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\multiprocessing\pool.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\compat.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\St_Thomas	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Dacca	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT0	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\command\install_scripts.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\multiprocessing\dummy\connection.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\menubu.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\xml\etree\ElementTree.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\commands\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\plusarm.xpm	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\sets.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\input.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib-tk\tkSimpleDialog.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\commands\uninstall.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\utils.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\ca.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\vi.msg	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\FloatEnt.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\aifc.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\quopri_codec.py	python_x86_Lib.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58194f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}	msiexec.exe
File opened for modification	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3CBD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI48F3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58194f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1BE0.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI222B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2933.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A0F.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI1DD5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI226B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22BA.tmp	msiexec.exe
File created	C:\Windows\Installer\e581951.msi	msiexec.exe

Executes dropped EXE 4 IoCs

pid	Process
2404	python_x86_Lib.exe
3228	ITSMService.exe
4588	ITSMAgent.exe
5092	ITSMAgent.exe

Loads dropped DLL 52 IoCs

pid	Process
4352	MsiExec.exe
4352	MsiExec.exe
4352	MsiExec.exe
4352	MsiExec.exe
1184	MsiExec.exe
1184	MsiExec.exe
1184	MsiExec.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
5092	ITSMAgent.exe
5092	ITSMAgent.exe
5092	ITSMAgent.exe
5092	ITSMAgent.exe
5092	ITSMAgent.exe
5092	ITSMAgent.exe
4588	ITSMAgent.exe
5092	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
1184	MsiExec.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3008	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_x86_Lib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b58935fac5ebb7730000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b58935fa0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b58935fa000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db58935fa000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b58935fa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	python_x86_Lib.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	python_x86_Lib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	python_x86_Lib.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductName = "Endpoint Manager Communication Client"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductIcon = "C:\\Windows\\Installer\\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\\icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Version = "151109272"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\PackageName = "ba3cdc5190b44da96e5ecb5f39e2cbe3713984dc8062cdab679c759de51500b1.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\PackageCode = "D7076E96D3235814DB26ACC95D2BAD84"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Assignment = "1"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4588	ITSMAgent.exe
5092	ITSMAgent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3092	msiexec.exe
3092	msiexec.exe
3228	ITSMService.exe
3228	ITSMService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3008	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3008	msiexec.exe
Token: SeSecurityPrivilege	3092	msiexec.exe
Token: SeCreateTokenPrivilege	3008	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3008	msiexec.exe
Token: SeLockMemoryPrivilege	3008	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3008	msiexec.exe
Token: SeMachineAccountPrivilege	3008	msiexec.exe
Token: SeTcbPrivilege	3008	msiexec.exe
Token: SeSecurityPrivilege	3008	msiexec.exe
Token: SeTakeOwnershipPrivilege	3008	msiexec.exe
Token: SeLoadDriverPrivilege	3008	msiexec.exe
Token: SeSystemProfilePrivilege	3008	msiexec.exe
Token: SeSystemtimePrivilege	3008	msiexec.exe
Token: SeProfSingleProcessPrivilege	3008	msiexec.exe
Token: SeIncBasePriorityPrivilege	3008	msiexec.exe
Token: SeCreatePagefilePrivilege	3008	msiexec.exe
Token: SeCreatePermanentPrivilege	3008	msiexec.exe
Token: SeBackupPrivilege	3008	msiexec.exe
Token: SeRestorePrivilege	3008	msiexec.exe
Token: SeShutdownPrivilege	3008	msiexec.exe
Token: SeDebugPrivilege	3008	msiexec.exe
Token: SeAuditPrivilege	3008	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3008	msiexec.exe
Token: SeChangeNotifyPrivilege	3008	msiexec.exe
Token: SeRemoteShutdownPrivilege	3008	msiexec.exe
Token: SeUndockPrivilege	3008	msiexec.exe
Token: SeSyncAgentPrivilege	3008	msiexec.exe
Token: SeEnableDelegationPrivilege	3008	msiexec.exe
Token: SeManageVolumePrivilege	3008	msiexec.exe
Token: SeImpersonatePrivilege	3008	msiexec.exe
Token: SeCreateGlobalPrivilege	3008	msiexec.exe
Token: SeBackupPrivilege	5080	vssvc.exe
Token: SeRestorePrivilege	5080	vssvc.exe
Token: SeAuditPrivilege	5080	vssvc.exe
Token: SeBackupPrivilege	3092	msiexec.exe
Token: SeRestorePrivilege	3092	msiexec.exe
Token: SeRestorePrivilege	3092	msiexec.exe
Token: SeTakeOwnershipPrivilege	3092	msiexec.exe
Token: SeRestorePrivilege	3092	msiexec.exe
Token: SeTakeOwnershipPrivilege	3092	msiexec.exe
Token: SeBackupPrivilege	4824	srtasks.exe
Token: SeRestorePrivilege	4824	srtasks.exe
Token: SeSecurityPrivilege	4824	srtasks.exe
Token: SeTakeOwnershipPrivilege	4824	srtasks.exe
Token: SeRestorePrivilege	3092	msiexec.exe
Token: SeTakeOwnershipPrivilege	3092	msiexec.exe
Token: SeBackupPrivilege	4824	srtasks.exe
Token: SeRestorePrivilege	4824	srtasks.exe
Token: SeSecurityPrivilege	4824	srtasks.exe
Token: SeTakeOwnershipPrivilege	4824	srtasks.exe
Token: SeRestorePrivilege	3092	msiexec.exe
Token: SeTakeOwnershipPrivilege	3092	msiexec.exe
Token: SeRestorePrivilege	3092	msiexec.exe
Token: SeTakeOwnershipPrivilege	3092	msiexec.exe
Token: SeRestorePrivilege	3092	msiexec.exe
Token: SeTakeOwnershipPrivilege	3092	msiexec.exe
Token: SeRestorePrivilege	3092	msiexec.exe
Token: SeTakeOwnershipPrivilege	3092	msiexec.exe
Token: SeRestorePrivilege	3092	msiexec.exe
Token: SeTakeOwnershipPrivilege	3092	msiexec.exe
Token: SeRestorePrivilege	3092	msiexec.exe
Token: SeTakeOwnershipPrivilege	3092	msiexec.exe
Token: SeShutdownPrivilege	1184	MsiExec.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
3008	msiexec.exe
3008	msiexec.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe
4588	ITSMAgent.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
3228	ITSMService.exe
4588	ITSMAgent.exe
5092	ITSMAgent.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 4824	3092	msiexec.exe	101
PID 3092 wrote to memory of 4824	3092	msiexec.exe	101
PID 3092 wrote to memory of 4352	3092	msiexec.exe	103
PID 3092 wrote to memory of 4352	3092	msiexec.exe	103
PID 3092 wrote to memory of 4352	3092	msiexec.exe	103
PID 3092 wrote to memory of 1184	3092	msiexec.exe	104
PID 3092 wrote to memory of 1184	3092	msiexec.exe	104
PID 3092 wrote to memory of 1184	3092	msiexec.exe	104
PID 1184 wrote to memory of 1376	1184	MsiExec.exe	105
PID 1184 wrote to memory of 1376	1184	MsiExec.exe	105
PID 1184 wrote to memory of 1376	1184	MsiExec.exe	105
PID 1376 wrote to memory of 2404	1376	cmd.exe	107
PID 1376 wrote to memory of 2404	1376	cmd.exe	107
PID 1376 wrote to memory of 2404	1376	cmd.exe	107
PID 2404 wrote to memory of 5048	2404	python_x86_Lib.exe	108
PID 2404 wrote to memory of 5048	2404	python_x86_Lib.exe	108
PID 2404 wrote to memory of 5048	2404	python_x86_Lib.exe	108
PID 3228 wrote to memory of 4588	3228	ITSMService.exe	111
PID 3228 wrote to memory of 4588	3228	ITSMService.exe	111
PID 3228 wrote to memory of 4588	3228	ITSMService.exe	111
PID 3228 wrote to memory of 5092	3228	ITSMService.exe	112
PID 3228 wrote to memory of 5092	3228	ITSMService.exe	112
PID 3228 wrote to memory of 5092	3228	ITSMService.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ba3cdc5190b44da96e5ecb5f39e2cbe3713984dc8062cdab679c759de51500b1.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3008

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B522C0A5F57274C3D85952F67D29AF40
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4352
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6F193D4CAB0A0654598C9C7BAA20111E E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe
      "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4588
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e581950.rbs

Filesize
710KB

MD5
81a57e65cfc1de279ec8b99d90f97a80

SHA1
cb0f1e17941e5a2d10b62cff680a352549508737

SHA256
bc6131c89f679736af8dc167f8059265b66554270c5870861748282782d9a2d8

SHA512
30184af201d631fa8e8e3a0892cd7a5801f37b63579502b3a447c5b60ddd09e7f569cee4ee136908734198233cbc84fe565fb57bf36252b4b35c954a7df0c438

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ApplicationManagement.dll

Filesize
87KB

MD5
25c603e78d833ff781442886c4a01fe6

SHA1
6808adc90eb5db03163103ec91f7bc58ee8aa6d0

SHA256
94afd301c1baa84b18e3b72d017b6a009145c16c6592891c92f50c127e55169e

SHA512
84e33be97d97ae341d74fc8273d191df519616f12bec8ac2f89454897c30a5f7bf9115f208c8dae78da83f0ca7bf9e5f07544d37d87b07f63408fbc91e449d54

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

Filesize
3.0MB

MD5
a5b010d5b518932fd78fcfb0cb0c7aeb

SHA1
957fd0c136c9405aa984231a1ab1b59c9b1e904f

SHA256
5a137bfe1f0e6fc8a7b6957d5e9f10df997c485e0869586706b566015ff36763

SHA512
e0ca4b29f01f644ef64669ed5595965b853ae9eaa7c6c7d86df7634437041ef15ceb3c2d1ab9dec4171c80511684a7d7b06fc87b658e5a646699eb9523bc4994

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe

Filesize
8.4MB

MD5
6b4752088a02d0016156d9e778bb5349

SHA1
bd13b1f7b04e0fe23db6b3e4bd0aa91c810e1745

SHA256
f64f13bf19726624a9cbaedda03a156597737581d6bc025c24e80517f5cab011

SHA512
0fe982b0b551238fc881511cdd0656ee71f22aca3a5e83ef7ce41b3adf603f1be17ba3e2c10797ee3dfb5e15ff1ac3e8cf4e05c657e7c047f302f50baa42ba2d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Core.dll

Filesize
5.1MB

MD5
9356330cdf731eea1e628b215e599ce5

SHA1
88645c60b3c931314354d763231137a9ec650f1b

SHA256
ad045d1d084a88fe3f48c12aee48746b22cb3a579f9140840c54ae61f7af3478

SHA512
3d9ab9b1cdecad6809be96d82df2d1b9b8c9e1a7cf0ac79a820a92b11c8fa079f5a2c3875ba0b733503742c6977d6239ce22acec023a22038b2e7ee1ebd62d90

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Gui.dll

Filesize
5.2MB

MD5
d29d11da9f344f6d679a0de7b3174890

SHA1
b4cac4aa9c6b82e8d2d0c43991e8073261c13089

SHA256
079e3a248d169143a3d5da48d24dbcc0ce5fb8aaccbc02a6fce61c5fe2461b9f

SHA512
b43f2ef86d6fe4beb28a10e19834a4f76dbaddd071d16353b2641b72f2faa552a3bdba33a606da71a34ebb932f57dd142758b4a0a240231022c8bed8ee97cad6

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Network.dll

Filesize
1015KB

MD5
de150de21f1a2b72534eaa4aa4f03202

SHA1
39ed224cced1266d4adc5e68f6516979b8f52b33

SHA256
03871db7d626d14e84d8ebf007139aa2c08038cd3403ac6259f1a2eb01ae1477

SHA512
30eff193620724cda86e6de31c430f9d4426e677a553c7918f9b85dbfc67687acdecc2a29e45473666c01ce311b73833d9f79db8a93e80570c7ace8837ca531a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Sql.dll

Filesize
174KB

MD5
88aeafdcc3f3fa04b9b20022906745b0

SHA1
9dc03428234000d19bbc3cb437d370b8e1863329

SHA256
cd84c9c486c3e967ddd061718893ef5ee48eca24f77e3366b8fd3d2dd21f477f

SHA512
5ea87730f26b16215eb2b892a6da689524546ef6cfaf4e6c1f4e0afa083ceec3e8f00c9259d316d84ef4cb05b01023a1362b4a676d10b55e06ee365557ab7986

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Widgets.dll

Filesize
4.4MB

MD5
13f078d5c63cb192f68b45f5767a9e6f

SHA1
6149189a1553c2e0e6d715d3177c16c11af7d33a

SHA256
b0abf95a23e1616f3542a8cb794aac5b7463dff3db8621e3cd719ab1dd7f6226

SHA512
f3293fcdccb4901d4eb405706ad20da361140842a335e6f6a7ce54222fe028a1da2179be14ec40dbb5a1784ed5d33bd467174091606e6fcac12039dc0f48e52a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Xml.dll

Filesize
163KB

MD5
4bac5e44b4b2f138f6608c661330dad0

SHA1
b08ff311b24d9bbc48d4014d7a0cd0de129a19e7

SHA256
59ba9deba38b1e652a046fd6b58847a58883f2d8c5c1e81acfa78d2daad98a1c

SHA512
74871aaaf8dc3fc006f7a1fdc42eabf5a86e34674d34362b2b00bdebe023d78fa0e6a5ef4676dc038178a6eeb01a0ba1676f68a1cc6828ac8d4ece550106ee0a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5XmlPatterns.dll

Filesize
2.2MB

MD5
e2749ff4266d5a933feb7685dfe375b2

SHA1
f09a432c67f45fc2ed27c762db4176b7dd47e908

SHA256
e4ee537b6a585ec7656afd9fc6fd3f655ff44bec6ff8ec291fc3e868caade27c

SHA512
4efc6b0b8d39b47d9c415fc3bc7460e4f738e3694fac691bf94569549569a8d65270a54488af3ae49de9fabdbe518250ceee83f6633e1da407636e6e02bac8bb

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\enrollment_settings.ini

Filesize
35B

MD5
d0e16ef103a87cb2bf9d4e16e6a33067

SHA1
bda32805fff3988fdbbf929b09527f94e25ed314

SHA256
f2ea7775aabe97ad080780391b22a477aacb19822365292024dab36eb39dbba5

SHA512
88d2ab62d0a9a42fc021dbdbbea0e8f486bca3e3b562de2c5d01afbf577148fc88dd6a4f329e194287787031cdca8b00f051befb14d0d02b3731e5e9041c410f

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\libcrypto-1_1.dll

Filesize
2.5MB

MD5
8f4ccd26ddd75c67e79ac60afa0c711f

SHA1
6a8b00598ac4690c194737a8ce27d1d90482bd8b

SHA256
ab7af6f3f78cf4d5ed4a2b498ef542a7efe168059b4a1077230a925b1c076a27

SHA512
9a52ac91876eea1d8d243c309dadb00dfae7f16705bde51aa22e3c16d99ccf7cc5d10b262a96cfbb3312981ac632b63a3787e8f1de27c9bb961b5be6ff2ba9f4

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\libssl-1_1.dll

Filesize
533KB

MD5
bf2cae7a6256b95e1ba1782e6a6c5015

SHA1
3fbdc3afa52673c7bdfab16b500bbe56f1db096b

SHA256
352d2fd16675855e20cc525b6376734933539b76bc4b40d679d3069008fe4cfc

SHA512
90755eb718ba404b0e48a6713d4680db252f8156328a58fc347e74d84b8bd53a7a6276755c672240c0e5d78200130e3ddf86990779ddd86c6d10cebf2bc02c9e

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\log4cplusU.dll

Filesize
471KB

MD5
0b03f7123e8bc93a38d321a989448dcc

SHA1
fc8bfdf092cdd6b9c1ec3b90389c035c37e50bd7

SHA256
a7fbfdb3100c164f139e9d0ebcf47282308e5173ab610dcb20a05b6e0615b54b

SHA512
6d00c65111c0f389ad189178705ed04712b2c6de8918f58de7c3747126a4b4e50b4a73525cc0993af02d35323b1430f34baf6f99712df822d6cdc63e24ed7ae5

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\msvcp140.dll

Filesize
426KB

MD5
8ff1898897f3f4391803c7253366a87b

SHA1
9bdbeed8f75a892b6b630ef9e634667f4c620fa0

SHA256
51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

SHA512
cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\proxy_settings.ini

Filesize
101B

MD5
273ec42863e3d9f999381f09c13d313b

SHA1
008d1954b2a7d1c692a697c891f9692f41f10481

SHA256
4dd2c699bbb8c398788067be6fc82edc68c8246b8f6765169776bb24ebd0c487

SHA512
940df3f73592ccabc27bf2cc77de98eade7eb8988d30144060c817eda614085e36eadb699b02123c63774416e827194c269acd1267fad1d560b7df86a79ed89b

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe

Filesize
7.2MB

MD5
dcebee7bb4e8b046b229edc10ded037f

SHA1
f9bdf0b478e21389800542165f721e5018d8eb29

SHA256
2eb0eefab534217953744c2cc36de2e1a1ced6ea882734e7b1f4b34a0b19689b

SHA512
9827600a19da5a816f1b0d93aa2629cb48f13f6e5fc42cd44bb1031ecd2e942854b34e7da44335acb85e42c44b1e720e9da8bc1d9ad23a9b1de0190f026f4d30

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\qdjango-db0.dll

Filesize
132KB

MD5
342249e8c50e8849b62c4c7f83c81821

SHA1
618aa180b34c50e243aefbf36bb6f69e36587feb

SHA256
07bc6eb017005500d39e2c346824eef79b3e06f60c46fb11572f98d4fe4083c5

SHA512
32a44252926881edf916ac517cb55d53b0b1b5adcc5952a674d1707d2c1431a68b27e593b4c4fcab0648e3cbeddf3d4e8024ff2a3385af9dbd2b2244e518340a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmproxy.dll

Filesize
154KB

MD5
84c848ca734892ea2e8ab90d84317ee3

SHA1
a1b38d4f1b466061481bdfde7628139c908f7ee5

SHA256
01c53abd5585992f9d62de40f4750899829b9e7e4a026b8d9f5d1cb1748a3fa9

SHA512
cec124435d6d4c76497e7886ca317a0c12a9d8e77200ba94cf6a699b318b91cb4db886eba5a5161941a7dd349f827cd3694abb864d6e37a9084a208276bee7df

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\sqldrivers\qsqlite.dll

Filesize
1.1MB

MD5
d9d7b0d7386cd57e4301d57cb7294b4b

SHA1
dcf385b8d3f9f99a07e1b7757508e5e4080f336c

SHA256
a4ee1bc55369a13b3e721aa48e44de31c6f00439838e923ab7a66438fbab4002

SHA512
e1568ce01edd46aabc795dd4eacab565ffc8dc0271129b5aa770f3763fba756a5de59aa4329510e65282bb19537874c6f307712a7fa2b6971f50dbee7b2664d7

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\vcruntime140.dll

Filesize
74KB

MD5
1a84957b6e681fca057160cd04e26b27

SHA1
8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

SHA256
9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

SHA512
5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
765B

MD5
d522d917d7bc2a9f6f30153e891412f4

SHA1
f07cea07eeef634227df02442f8aca6da0efb36f

SHA256
c5aeb3de5e864807086042f0d7598b361ff3e34cd4ab829a9e367241924cef10

SHA512
dc6819d95eb29a12c4564940d60babdec5298ea4b10fef8c40dbbf0fb7253b0d17879cc8a8704a8d141161d87e4bfba16bc1a4a79cf606394b552a9b94c6787e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

Filesize
637B

MD5
4fe7daefe26be8b0da6c0edb1e3b062e

SHA1
bc9d7e3ff783bdaf0cc2009e552eeccd989e5774

SHA256
c7f7e228158b1ace8ffba4fd1d5b411288314b991f5451fdf2125fc224307a28

SHA512
850660423e6ee6342aa2fa2cc39786eca3fedd8494cea7443cd918744419cdc29e85edf3f267cf0a5ee69a6837460b1cfea3166b71b77f7c2c837b9e43460d14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
1KB

MD5
ddc6626cca0d30ad41b3cbc4e591df33

SHA1
43af70a960e9176a0c8b969e1de8b6f9f3505f3c

SHA256
90eef2502efcf4d0aa84766530d78db8f4e972c517c57039fa107f01d3cb1e7b

SHA512
c8aa3c24dbc958173c316ae6e291fd30e4635351cfe52199557ecd3596570cadcd71c2ce272c225208bcae5743d44b693545c3e9de7477b7f57f578cbd4b08c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
484B

MD5
7c0e1e72fc323c3205b66cb9f71194b8

SHA1
c72bae223836b2202ea6a8f276fd5e2a7acad255

SHA256
3421e3879c579cc2549e38b7000efd34df97d12f34311ce8f067b81bd12ca2c6

SHA512
5517164789361769239b307d54be4c5db21e8488c718a436fdc0a5998e9f5135dd39e6c02f2fba4bd7b1477187880b8c572b272c75b9ded2dc3d34e5c4117510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

Filesize
480B

MD5
c74a6cc949760f0f15cd825c4b8039c7

SHA1
c120ed7722dfd89b3e00c39e370664938fcc8a74

SHA256
b04ee910743008b750f5076d032db4dda4526525544b68ca5a52d07def0c132b

SHA512
6deff9aa669bdd0fdd437f34b269a5db6a7c220e20497c20c9590e38a794b69fa73afc2b934fd57c0c962c4c273614863b694e1c3949a76d340b0cdba05591b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
482B

MD5
1dc41af9e3efbb85362e8aca4197d462

SHA1
c7aec35af4e2b17d45cd7faa0c20e8da6b97ba4c

SHA256
adc0469926d63db845d1ec74e953711f1eb6f2c8ccec531a0f1348f2d090753e

SHA512
8b2780eadbf0b77328bd719574dcc683f35a3f5d6c9914fcb8cd9884071ef09cdbdd1a56236ebac7b8c1fb32c7ef9fabe926ed74ebf682620dff046a10191f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
226B

MD5
feceaa82323f9de4d3578592d22f857d

SHA1
4c55c509e6d16466d1d4c31a0687ededf2eabc9a

SHA256
61480b43136b02965f59e3256b8de1bf35caa7c084a7bcb3ed5f4236451d4484

SHA512
82dac003d30eed4fc4e06ab4a426c9b7f355d777c243b710c5c0d3afc4c26d93874af2d0a542fca4a2038050b0d0fa8f63ed82e5f2771ae8a4de0f3b08d56d45

Download Submit
C:\Windows\Installer\MSI1BE0.tmp

Filesize
285KB

MD5
82d54afa53f6733d6529e4495700cdd8

SHA1
b3e578b9edde7aaaacca66169db4f251ee1f06b3

SHA256
8f4894b9d19bfe5d8e54b5e120cef6c69abea8958db066cdd4905cc78ecd58b6

SHA512
22476e0f001b6cf37d26e15dfb91c826c4197603ea6e1fbb9143c81392e41f18fa10a2d2d1e25425baaf754bff7fd179ef1df34966c10985e16d9da12a445150

Download Submit
C:\Windows\Installer\MSI1DD5.tmp

Filesize
203KB

MD5
d53b2b818b8c6a2b2bae3a39e988af10

SHA1
ee57ec919035cf8125ee0f72bd84a8dd9e879959

SHA256
2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2

SHA512
3aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
d281f29ee879e06d1b33663eef6534ee

SHA1
5c6d6be72fc50acb7dd5a23bc7a722723806f67a

SHA256
664960d3d1f58cf1712cdbedde99fa326d633c5120b00bea8b358a20745af5e7

SHA512
f54d14b021859d4cdc27f10906070589f33ed1dcd2beca6d363ff30bb35d4557ad33c839e4fad93ce16f64b95ecc42de362b87a71796d6114426066c04f80f6c

Download Submit
\??\Volume{fa3589b5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{51cab87e-6768-427b-a64b-d502ffa1eef1}_OnDiskSnapshotProp

Filesize
6KB

MD5
6564689ea1c32d5537a9ea7069c5deb8

SHA1
77503e451ff25a0fa4cf5b80a8ea5b00c5d7479d

SHA256
ade94fa1c2a1d5f23078f6549b72dfef9a0758873a73880b1fcebb5d32f2405d

SHA512
0184c4fa7e933740eaaf0907ec9971920b7cbcba3ab51dcdb579d7eed77cc378b4376c02e19d5d7e3fe108eaf505716d09ccb4c7d2ba04856237d8a69ac0cc66

Download Submit