rhadamanthys | b62a2247b7a7947d5909507e63d5e756e1de4e3a5cf90b0629adabd4d9eead37

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

3.7MB
MD5

9929782fd681101b61dd6c14de2ef687
SHA1

cacecd7371034ca973add1716eae288be097bad5
SHA256

b62a2247b7a7947d5909507e63d5e756e1de4e3a5cf90b0629adabd4d9eead37
SHA512

e75b19fd2038073b10f8b844f5dcc50da790dac03e263d34579964d6585b7d5420dd89e88f11ce3d24303e3cd332393a411e167bfd2d8e83c4d4d176201e8178
SSDEEP

49152:BCF4MtMz3p0SPlwjfbJZrEs5xtMz3e0ShozikjbZHlL4OF6lrN:g

Score

10^/10

rhadamanthys sectoprat discovery execution persistence rat stealer trojan

Malware Config

Extracted

Family

rhadamanthys

https://95.217.44.124:7584/335a04be4e97b94a436125e/u5f5f02f.fhl63

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/6760-6181-0x0000000000400000-0x00000000004C6000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 6744 created 2668	6744	GoogleUpdateCore.exe	44

Executes dropped EXE 10 IoCs

pid	Process
5212	python_x86_Lib.exe
5680	ITSMService.exe
6036	ITSMAgent.exe
4188	ITSMAgent.exe
5560	ITSMAgent.exe
5368	RmmService.exe
1600	RmmService.exe
6268	RmmService.exe
6640	AutoIt3.exe
6048	python_x86_Lib.exe

Loads dropped DLL 64 IoCs

pid	Process
5336	MsiExec.exe
5336	MsiExec.exe
5336	MsiExec.exe
5336	MsiExec.exe
5260	MsiExec.exe
5260	MsiExec.exe
5260	MsiExec.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
4188	ITSMAgent.exe
4188	ITSMAgent.exe
4188	ITSMAgent.exe
6036	ITSMAgent.exe
4188	ITSMAgent.exe
4188	ITSMAgent.exe
4188	ITSMAgent.exe
4188	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
5560	ITSMAgent.exe
5560	ITSMAgent.exe
5560	ITSMAgent.exe
5560	ITSMAgent.exe
5560	ITSMAgent.exe
5560	ITSMAgent.exe
5560	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
5560	ITSMAgent.exe
5560	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
5260	MsiExec.exe
5368	RmmService.exe
5368	RmmService.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dfdhcch = "\"C:\\hdbdeeb\\AutoIt3.exe\" C:\\hdbdeeb\\dfdhcch.a3x"	AutoIt3.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
76	3100	msiexec.exe
78	3100	msiexec.exe
81	3100	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\	ITSMService.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
195	pastebin.com
196	pastebin.com

Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs

Using AutoIT for possible automate script.

execution

AutoHotKey & AutoIT

T1059.010

pid	Process
6640	AutoIt3.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E455012CBF4BA8A2AC67618C00590908	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E455012CBF4BA8A2AC67618C00590908	ITSMService.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6640 set thread context of 6744	6640	AutoIt3.exe	140
PID 6640 set thread context of 6760	6640	AutoIt3.exe	141

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\ctypes\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Ujung_Pandang	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Europe\Lisbon	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\safetk.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8\8.5	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\lib\functools.pyc	RmmService.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\constants.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\depends.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\es_ec.msg	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\folder.xbm	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\lib\os.pyc	RmmService.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\DLLs\_ctypes.pyd	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\ascii.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib-tk\Tix.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_asserts.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\langgreekmodel.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\urllib3\util\connection.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\auto.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\San_Luis	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Canada\Central	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\SystemV\CST6	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\StdShell.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\json\scanner.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib-tk\Dialog.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\symtable.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\http1.0\http.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5XmlPatterns.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\mutex.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\vcs\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp875.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\iso8859_6.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\utf_8_sig.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib-tk\turtle.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\filters\whitespace.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\curtainmode\CurtainMode32.dll	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\imageformats\qgif.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\ctypes\macholib\dylib.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib-tk\Canvas.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Yakutat	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples\FileEnt.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\quopri_codec.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Antarctica\Macquarie	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Inuvik	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\word.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\xmfbox.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\dir_util.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\progress\helpers.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\auto.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT-7	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\MET	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\cross.xbm	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\bitmaps\minus.gif	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\easy_xml.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\MSVSSettings_test.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\compat\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\cp1256.enc	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\SystemV\AST4ADT	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples\AllSampl.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples\HList1.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\html5lib\html5parser.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\pkg_resources\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\easy_install.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Oral	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Canada\Atlantic	python_x86_Lib.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF5B0.tmp	msiexec.exe
File created	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI927F.tmp	msiexec.exe
File created	C:\Windows\Installer\e57e5ad.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF552.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e57e5af.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8ADA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED02.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF07.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B1A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DAC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57e5ad.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEADE.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE2C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB0F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D7C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE89B.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
7056	6744	WerFault.exe	140
7088	6744	WerFault.exe	140

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_x86_Lib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_x86_Lib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000532ba7f3274a467a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000532ba7f30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900532ba7f3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d532ba7f3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000532ba7f300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies data under HKEY_USERS 59 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	python_x86_Lib.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53\Blob = 03000000010000001400000040cef3046c916ed7ae557f60e76842828b51de5314000000010000001400000017d9d6252767f931c24943d93036448c6ca94feb040000000100000010000000886ea78b530e0fd5bda4e12527ab6a2c0f00000001000000300000005d2164164eb6f3820b9b8d7a5601b60ebf70d832d2029c6c3c966db107dfcb1ba12a25700f26ca3d5b36e4a6cb576cfa19000000010000001000000092a08f142bb795a2197a0d3c7af066f55c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001d0600003082061930820401a0030201020210137d539caa7c31a9a433701968847a8d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a308195310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313d303b060355040313345365637469676f20525341204f7267616e697a6174696f6e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a02820101009c930246454a524892fc578df92dea53beb32cd5d8a8a5ec5b6903c01d10f65933defe0748a8e88c7a674af1f58dc33766d03291f7c49d0460c4b54ae2838ba7ae26d45d3a5ef8d11671bb8abd71a27dc8cea26024b052a03a4551de78936c6260f1e4569cb73bf73c55d8dfd57a317c357f125170e12cbe04accbfa4fe17c656ac040a7d97ca5638419e1f7caefaab4e8585ad999e326df8e12b2b8dc33b236da141d965842406e0b22851c5122aec4c806456d92e667b71923e4d8366b85d07fc752e3cfb07501e089b4a8bf8a364ea3e06ceb8441cea52f482213975062451e09a5cc9f6c57704006db20e81bd6f3938ba7329eb7441509d7affd7c011cdb0203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e0416041417d9d6252767f931c24943d93036448c6ca94feb300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020230500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201004e134096c9c3e66e5bc0e3baf417e1ae091fc9bfcb0c2516f27353b3761ab7ab4806d6cd007c204543456c165a1b1361d749baa402a4ace8cece2dc92a74a3dcdeaeabd06836f891af3c01f777d50bcf97abeb87e715a8fa305a617120b1c043c4b98f6d8a31eb153624fb62d50b9c8fe966bde661519793b61d87bdb0b56cfea6112906613431303d20277351d0de8583d37739204696daa7c65a162785b2cf4e0f4e8c5cbebe3800f84bf9727bd4f27ad7a22985d004bad3422c5188522ed13d246747ec55cc1bf4ca34ea26c1deddc42189f6ba7b321e8e965e844538cf80aa37698b6017741548919c6df04ea377ca1b1c48faf9cf49e85f4f850ae28f901bab704c9aebb7a63fb4ac5da45fcfe6d88a9690f74f268160765d0f247791b32a319f165ab25d8c1c29aa489c8e6fd3784070db77ecdde3d15705702de64998880584620570567686394ed3226f1dfe6df10eb362c43ccbc085b9611ebae1158059940cae05bb8c7f56be1cd25abf97f26a4cb0c67076b0908dc10b36b911d8d6285cea4ffe24b7180a9b0cd0c17c5cfb69bdcca24dc690bca64df2b1bad69a675b960252d082f9c40a5c0d28e03fc8fa959589d5a4be496c40b23ea86bb8d525b2c4fef1d3d7e7d6dc43017630fb3b8b5df74a897c9a35befccaf05701f08d3fa087327b475a974b82d266c2c42dea3f24f4a7f9a8b9e36ad91861a03b8c15	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ITSMService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ITSMService.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CDM	ITSMService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductName = "Endpoint Manager Communication Client"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductIcon = "C:\\Windows\\Installer\\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\\icon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\PackageCode = "D7076E96D3235814DB26ACC95D2BAD84"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDM\proxy = "false"	ITSMService.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\PackageName = "GoogleAuthenticator_em_IxMqegG7_installer_Win7-Win11_x86_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Version = "151109272"	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\GoogleAuthenticator_em_IxMqegG7_installer_Win7-Win11_x86_x64.msi:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\GoogleAuthenticator_em_IxMqegG7_installer_Win7-Win11_x86_x64(1).msi:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
6036	ITSMAgent.exe
4188	ITSMAgent.exe
5560	ITSMAgent.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4488	msiexec.exe
4488	msiexec.exe
5680	ITSMService.exe
5680	ITSMService.exe
6744	GoogleUpdateCore.exe
6744	GoogleUpdateCore.exe
6960	openwith.exe
6960	openwith.exe
6960	openwith.exe
6960	openwith.exe
4488	msiexec.exe
4488	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	firefox.exe
Token: SeDebugPrivilege	2136	firefox.exe
Token: SeDebugPrivilege	2136	firefox.exe
Token: SeShutdownPrivilege	3100	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3100	msiexec.exe
Token: SeSecurityPrivilege	4488	msiexec.exe
Token: SeCreateTokenPrivilege	3100	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3100	msiexec.exe
Token: SeLockMemoryPrivilege	3100	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3100	msiexec.exe
Token: SeMachineAccountPrivilege	3100	msiexec.exe
Token: SeTcbPrivilege	3100	msiexec.exe
Token: SeSecurityPrivilege	3100	msiexec.exe
Token: SeTakeOwnershipPrivilege	3100	msiexec.exe
Token: SeLoadDriverPrivilege	3100	msiexec.exe
Token: SeSystemProfilePrivilege	3100	msiexec.exe
Token: SeSystemtimePrivilege	3100	msiexec.exe
Token: SeProfSingleProcessPrivilege	3100	msiexec.exe
Token: SeIncBasePriorityPrivilege	3100	msiexec.exe
Token: SeCreatePagefilePrivilege	3100	msiexec.exe
Token: SeCreatePermanentPrivilege	3100	msiexec.exe
Token: SeBackupPrivilege	3100	msiexec.exe
Token: SeRestorePrivilege	3100	msiexec.exe
Token: SeShutdownPrivilege	3100	msiexec.exe
Token: SeDebugPrivilege	3100	msiexec.exe
Token: SeAuditPrivilege	3100	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3100	msiexec.exe
Token: SeChangeNotifyPrivilege	3100	msiexec.exe
Token: SeRemoteShutdownPrivilege	3100	msiexec.exe
Token: SeUndockPrivilege	3100	msiexec.exe
Token: SeSyncAgentPrivilege	3100	msiexec.exe
Token: SeEnableDelegationPrivilege	3100	msiexec.exe
Token: SeManageVolumePrivilege	3100	msiexec.exe
Token: SeImpersonatePrivilege	3100	msiexec.exe
Token: SeCreateGlobalPrivilege	3100	msiexec.exe
Token: SeBackupPrivilege	4988	vssvc.exe
Token: SeRestorePrivilege	4988	vssvc.exe
Token: SeAuditPrivilege	4988	vssvc.exe
Token: SeBackupPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeBackupPrivilege	5952	srtasks.exe
Token: SeRestorePrivilege	5952	srtasks.exe
Token: SeSecurityPrivilege	5952	srtasks.exe
Token: SeTakeOwnershipPrivilege	5952	srtasks.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeBackupPrivilege	5952	srtasks.exe
Token: SeRestorePrivilege	5952	srtasks.exe
Token: SeSecurityPrivilege	5952	srtasks.exe
Token: SeTakeOwnershipPrivilege	5952	srtasks.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe
Token: SeRestorePrivilege	4488	msiexec.exe
Token: SeTakeOwnershipPrivilege	4488	msiexec.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
3100	msiexec.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
3100	msiexec.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
2136	firefox.exe
7104	msiexec.exe
7104	msiexec.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe
6036	ITSMAgent.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
5680	ITSMService.exe
6036	ITSMAgent.exe
4188	ITSMAgent.exe
5560	ITSMAgent.exe
5680	ITSMService.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
5680	ITSMService.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
5680	ITSMService.exe
5680	ITSMService.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 2136	5096	firefox.exe	83
PID 5096 wrote to memory of 2136	5096	firefox.exe	83
PID 5096 wrote to memory of 2136	5096	firefox.exe	83
PID 5096 wrote to memory of 2136	5096	firefox.exe	83
PID 5096 wrote to memory of 2136	5096	firefox.exe	83
PID 5096 wrote to memory of 2136	5096	firefox.exe	83
PID 5096 wrote to memory of 2136	5096	firefox.exe	83
PID 5096 wrote to memory of 2136	5096	firefox.exe	83
PID 5096 wrote to memory of 2136	5096	firefox.exe	83
PID 5096 wrote to memory of 2136	5096	firefox.exe	83
PID 5096 wrote to memory of 2136	5096	firefox.exe	83
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 4772	2136	firefox.exe	84
PID 2136 wrote to memory of 3284	2136	firefox.exe	85
PID 2136 wrote to memory of 3284	2136	firefox.exe	85
PID 2136 wrote to memory of 3284	2136	firefox.exe	85
PID 2136 wrote to memory of 3284	2136	firefox.exe	85
PID 2136 wrote to memory of 3284	2136	firefox.exe	85
PID 2136 wrote to memory of 3284	2136	firefox.exe	85
PID 2136 wrote to memory of 3284	2136	firefox.exe	85
PID 2136 wrote to memory of 3284	2136	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2668
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6960

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\sample.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\sample.html
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0325e64-ed38-43ff-b901-0c6a1d39f448} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" gpu
    3⤵
    PID:4772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e31a54b-6628-48e3-8a03-df3dd9d3c1bd} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" socket
    3⤵
    PID:3284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3032 -childID 1 -isForBrowser -prefsHandle 3068 -prefMapHandle 2960 -prefsLen 24741 -prefMapSize 244658 -jsInitHandle 1188 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55b3992d-7d63-4480-aeac-88bcf6c8ef6a} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" tab
    3⤵
    PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4028 -childID 2 -isForBrowser -prefsHandle 4020 -prefMapHandle 4016 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1188 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6214eaf-89bd-4ce1-bc6c-8324158e744d} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" tab
    3⤵
    PID:1612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4932 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4924 -prefMapHandle 4920 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06e3e326-b094-4684-a96e-daad0a45c07e} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" utility
    3⤵
    - Checks processor information in registry
    PID:3872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5132 -parentBuildID 20240401114208 -prefsHandle 2784 -prefMapHandle 5116 -prefsLen 29197 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf32e26a-b936-43af-889f-f6a2314f2e11} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" rdd
    3⤵
    PID:2824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5144 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 5136 -prefMapHandle 5128 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1bbab66-c266-4401-8599-0224ed4af65f} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" utility
    3⤵
    - Checks processor information in registry
    PID:1064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 3 -isForBrowser -prefsHandle 5616 -prefMapHandle 5572 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1188 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f78682d1-cc3d-462d-9b44-f68598eebde4} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" tab
    3⤵
    PID:3436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5760 -childID 4 -isForBrowser -prefsHandle 5840 -prefMapHandle 5836 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1188 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22b5fd2f-e73e-4654-b809-d583a1666de4} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" tab
    3⤵
    PID:2560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6024 -childID 5 -isForBrowser -prefsHandle 5944 -prefMapHandle 5948 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1188 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c67a1b11-ceef-4e45-97bc-90f7b51ac53b} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" tab
    3⤵
    PID:2612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6996 -childID 6 -isForBrowser -prefsHandle 2920 -prefMapHandle 1712 -prefsLen 28094 -prefMapSize 244658 -jsInitHandle 1188 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9815ec05-4771-4bf4-93bc-02d3a2f809b4} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" tab
    3⤵
    PID:6260

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\GoogleAuthenticator_em_IxMqegG7_installer_Win7-Win11_x86_x64.msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3100

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5952
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 30BAF7379083DB2971E071C4FA9656F0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5336
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D2CD34CA7AA5CE5919FEB30A75DCAE71 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5260
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:564
  - - C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe
      "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      PID:5212
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9CCB7E4004A6EF52A9E57795880CFE52
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7144
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9EB339CEBC1966165DFEA83BE74C250D E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6008
  - - C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe
      "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:6048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5680
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6036
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4188
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5560
- C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:564

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1800

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1600
- C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --run_procedure --in Global\sharedInputMemory_1 --out Global\sharedOutputMemory_2 --err Global\sharedErrorMemory_3
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:6268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "AutoIt3.exe script.a3x"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\CoreLibs\AutoIt3.exe
      AutoIt3.exe script.a3x
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Command and Scripting Interpreter: AutoIT
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:6640
    - - C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6744
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6744 -s 444
        6⤵
        Program crash
        
        PID:7056
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6744 -s 460
        6⤵
        Program crash
        
        PID:7088
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6744 -ip 6744
1⤵
PID:7028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6744 -ip 6744
1⤵
PID:7072

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\GoogleAuthenticator_em_IxMqegG7_installer_Win7-Win11_x86_x64(1).msi"
1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:7104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AutoHotKey & AutoIT

T1059.010

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57e5ae.rbs

Filesize
710KB

MD5
b95019413c2eab0f31a04ef5313acb25

SHA1
c2b4d1650aa3ae6822cff8a75fe0100dada1b1ff

SHA256
fb9e579f7f02332c3dcb717971f4246192e5446eceb801cc4e0b07cdcb006565

SHA512
234a0f7c3c86ec68addf5c247c1252698309d1c88f8dacd9bd363687d4a16d047319c4b2c658aa550873183d2b74d3ca86a808be8454122e49ec9d7b94aa6ffe

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ApplicationManagement.dll

Filesize
87KB

MD5
25c603e78d833ff781442886c4a01fe6

SHA1
6808adc90eb5db03163103ec91f7bc58ee8aa6d0

SHA256
94afd301c1baa84b18e3b72d017b6a009145c16c6592891c92f50c127e55169e

SHA512
84e33be97d97ae341d74fc8273d191df519616f12bec8ac2f89454897c30a5f7bf9115f208c8dae78da83f0ca7bf9e5f07544d37d87b07f63408fbc91e449d54

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\DLLs\py.ico

Filesize
19KB

MD5
79fb3436099fe00487bc874fd0313d13

SHA1
de7fdac228039fcea300f0efd241bd93cb71291c

SHA256
ae74eb8119aa88532734a84dd782830f8f5cb4dff01cfa4372b1e4afa3565313

SHA512
3faac8026bb4ba853ca7e263e52c169c96997b7a05ab1f56e62598690414d83833912669174dc1643fec08edfd133d0e4031e7e667a849514404507bf3ecdb26

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

Filesize
3.0MB

MD5
a5b010d5b518932fd78fcfb0cb0c7aeb

SHA1
957fd0c136c9405aa984231a1ab1b59c9b1e904f

SHA256
5a137bfe1f0e6fc8a7b6957d5e9f10df997c485e0869586706b566015ff36763

SHA512
e0ca4b29f01f644ef64669ed5595965b853ae9eaa7c6c7d86df7634437041ef15ceb3c2d1ab9dec4171c80511684a7d7b06fc87b658e5a646699eb9523bc4994

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe

Filesize
8.4MB

MD5
6b4752088a02d0016156d9e778bb5349

SHA1
bd13b1f7b04e0fe23db6b3e4bd0aa91c810e1745

SHA256
f64f13bf19726624a9cbaedda03a156597737581d6bc025c24e80517f5cab011

SHA512
0fe982b0b551238fc881511cdd0656ee71f22aca3a5e83ef7ce41b3adf603f1be17ba3e2c10797ee3dfb5e15ff1ac3e8cf4e05c657e7c047f302f50baa42ba2d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Core.dll

Filesize
5.1MB

MD5
9356330cdf731eea1e628b215e599ce5

SHA1
88645c60b3c931314354d763231137a9ec650f1b

SHA256
ad045d1d084a88fe3f48c12aee48746b22cb3a579f9140840c54ae61f7af3478

SHA512
3d9ab9b1cdecad6809be96d82df2d1b9b8c9e1a7cf0ac79a820a92b11c8fa079f5a2c3875ba0b733503742c6977d6239ce22acec023a22038b2e7ee1ebd62d90

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Gui.dll

Filesize
5.2MB

MD5
d29d11da9f344f6d679a0de7b3174890

SHA1
b4cac4aa9c6b82e8d2d0c43991e8073261c13089

SHA256
079e3a248d169143a3d5da48d24dbcc0ce5fb8aaccbc02a6fce61c5fe2461b9f

SHA512
b43f2ef86d6fe4beb28a10e19834a4f76dbaddd071d16353b2641b72f2faa552a3bdba33a606da71a34ebb932f57dd142758b4a0a240231022c8bed8ee97cad6

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Network.dll

Filesize
1015KB

MD5
de150de21f1a2b72534eaa4aa4f03202

SHA1
39ed224cced1266d4adc5e68f6516979b8f52b33

SHA256
03871db7d626d14e84d8ebf007139aa2c08038cd3403ac6259f1a2eb01ae1477

SHA512
30eff193620724cda86e6de31c430f9d4426e677a553c7918f9b85dbfc67687acdecc2a29e45473666c01ce311b73833d9f79db8a93e80570c7ace8837ca531a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Sql.dll

Filesize
174KB

MD5
88aeafdcc3f3fa04b9b20022906745b0

SHA1
9dc03428234000d19bbc3cb437d370b8e1863329

SHA256
cd84c9c486c3e967ddd061718893ef5ee48eca24f77e3366b8fd3d2dd21f477f

SHA512
5ea87730f26b16215eb2b892a6da689524546ef6cfaf4e6c1f4e0afa083ceec3e8f00c9259d316d84ef4cb05b01023a1362b4a676d10b55e06ee365557ab7986

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Widgets.dll

Filesize
4.4MB

MD5
13f078d5c63cb192f68b45f5767a9e6f

SHA1
6149189a1553c2e0e6d715d3177c16c11af7d33a

SHA256
b0abf95a23e1616f3542a8cb794aac5b7463dff3db8621e3cd719ab1dd7f6226

SHA512
f3293fcdccb4901d4eb405706ad20da361140842a335e6f6a7ce54222fe028a1da2179be14ec40dbb5a1784ed5d33bd467174091606e6fcac12039dc0f48e52a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Xml.dll

Filesize
163KB

MD5
4bac5e44b4b2f138f6608c661330dad0

SHA1
b08ff311b24d9bbc48d4014d7a0cd0de129a19e7

SHA256
59ba9deba38b1e652a046fd6b58847a58883f2d8c5c1e81acfa78d2daad98a1c

SHA512
74871aaaf8dc3fc006f7a1fdc42eabf5a86e34674d34362b2b00bdebe023d78fa0e6a5ef4676dc038178a6eeb01a0ba1676f68a1cc6828ac8d4ece550106ee0a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5XmlPatterns.dll

Filesize
2.2MB

MD5
e2749ff4266d5a933feb7685dfe375b2

SHA1
f09a432c67f45fc2ed27c762db4176b7dd47e908

SHA256
e4ee537b6a585ec7656afd9fc6fd3f655ff44bec6ff8ec291fc3e868caade27c

SHA512
4efc6b0b8d39b47d9c415fc3bc7460e4f738e3694fac691bf94569549569a8d65270a54488af3ae49de9fabdbe518250ceee83f6633e1da407636e6e02bac8bb

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\libcrypto-1_1.dll

Filesize
2.5MB

MD5
8f4ccd26ddd75c67e79ac60afa0c711f

SHA1
6a8b00598ac4690c194737a8ce27d1d90482bd8b

SHA256
ab7af6f3f78cf4d5ed4a2b498ef542a7efe168059b4a1077230a925b1c076a27

SHA512
9a52ac91876eea1d8d243c309dadb00dfae7f16705bde51aa22e3c16d99ccf7cc5d10b262a96cfbb3312981ac632b63a3787e8f1de27c9bb961b5be6ff2ba9f4

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\libssl-1_1.dll

Filesize
533KB

MD5
bf2cae7a6256b95e1ba1782e6a6c5015

SHA1
3fbdc3afa52673c7bdfab16b500bbe56f1db096b

SHA256
352d2fd16675855e20cc525b6376734933539b76bc4b40d679d3069008fe4cfc

SHA512
90755eb718ba404b0e48a6713d4680db252f8156328a58fc347e74d84b8bd53a7a6276755c672240c0e5d78200130e3ddf86990779ddd86c6d10cebf2bc02c9e

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\log4cplusU.dll

Filesize
471KB

MD5
0b03f7123e8bc93a38d321a989448dcc

SHA1
fc8bfdf092cdd6b9c1ec3b90389c035c37e50bd7

SHA256
a7fbfdb3100c164f139e9d0ebcf47282308e5173ab610dcb20a05b6e0615b54b

SHA512
6d00c65111c0f389ad189178705ed04712b2c6de8918f58de7c3747126a4b4e50b4a73525cc0993af02d35323b1430f34baf6f99712df822d6cdc63e24ed7ae5

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\msvcp140.dll

Filesize
426KB

MD5
8ff1898897f3f4391803c7253366a87b

SHA1
9bdbeed8f75a892b6b630ef9e634667f4c620fa0

SHA256
51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

SHA512
cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\proxy_settings.ini

Filesize
101B

MD5
273ec42863e3d9f999381f09c13d313b

SHA1
008d1954b2a7d1c692a697c891f9692f41f10481

SHA256
4dd2c699bbb8c398788067be6fc82edc68c8246b8f6765169776bb24ebd0c487

SHA512
940df3f73592ccabc27bf2cc77de98eade7eb8988d30144060c817eda614085e36eadb699b02123c63774416e827194c269acd1267fad1d560b7df86a79ed89b

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe

Filesize
7.2MB

MD5
dcebee7bb4e8b046b229edc10ded037f

SHA1
f9bdf0b478e21389800542165f721e5018d8eb29

SHA256
2eb0eefab534217953744c2cc36de2e1a1ced6ea882734e7b1f4b34a0b19689b

SHA512
9827600a19da5a816f1b0d93aa2629cb48f13f6e5fc42cd44bb1031ecd2e942854b34e7da44335acb85e42c44b1e720e9da8bc1d9ad23a9b1de0190f026f4d30

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\qdjango-db0.dll

Filesize
132KB

MD5
342249e8c50e8849b62c4c7f83c81821

SHA1
618aa180b34c50e243aefbf36bb6f69e36587feb

SHA256
07bc6eb017005500d39e2c346824eef79b3e06f60c46fb11572f98d4fe4083c5

SHA512
32a44252926881edf916ac517cb55d53b0b1b5adcc5952a674d1707d2c1431a68b27e593b4c4fcab0648e3cbeddf3d4e8024ff2a3385af9dbd2b2244e518340a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
32KB

MD5
f0e807283235b74431cab977070f0abb

SHA1
86c28e2835f449058dc701de76545b83635db8e9

SHA256
bd8229afad53b45d0dbe5cf9ea8da343ff60f93c830da952f79002f09a203eb1

SHA512
2648b556ce3f8a82bfd58378f6f825b888ace367a9ceab5ddc78c406b68314f74238f45c29bc102b885f7f3fb7cf709f752ab6b7655c06f3ba6a4d42b4e8e3e7

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
47d4729292951580406dbf02be3bb40c

SHA1
e99fe32a2f692a90ca5c3257ff157b4ece0c9e1a

SHA256
4f68dd7bd4ebbd09e12079e5459bfc8cefd36e7b7d848a616bb310a50a23e6bc

SHA512
e8fc7a2097d3ea1666f4fdc71ea7ff015d1886e8a3cf4b73ce1a865a279c08bb8c7cbc218307c0417c62b6502707e69be45b62d5b7c904ba375768998d03223c

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
94cea2598649a909be2a4fc6193f1cf7

SHA1
03d200432450e06548055209f306250c16082bef

SHA256
4c6bc98268fff4cc8207262a098e5c20ada598d2824ee5c548966ff6ccbb4edc

SHA512
0177b205403dac3546c16b7aaf34f07a05702ef06d5c4c6c5c75aecf6e5a6d7e12c3ade8057cb345fc28f96f9811e73ed4403e16df819a49630a30ec53453124

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
45b3f5fce0595b2dfc0862be4c46f772

SHA1
85eb6b0d541214f110ea5e034d76f9f0640ba72e

SHA256
69e9d1de161976657cfba5fbe415d2bcab20d623325900e5d0d84a230cd7c24e

SHA512
1de25d209b307b6fa344ed02bf349abc98693120ac06573a8d82c413db01b8ec21cdf47e0ca6d39dfaee257a872dda92a7927f5eed679ab81ead86c409f9e3b9

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
fef78b1a43c7c073b31289d383a6c119

SHA1
d285d0f88f68ee0c235b993971a649d86730a4ec

SHA256
67705b08a0053361f75d15cd2808f8fbfb809b0ef29b35e90c5d7bc7b0f41e48

SHA512
1a37e27b578b62b1d150aabf3f76fbd8fd846ff40b80454aafd5a84de129748e023ff5e88301f759f9af9849e1878b42ab69bdbbdb3a1f8d000a6eb9657f7215

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
b47fe818cebbb8e981b11c8acd541cbb

SHA1
9e11370a7fddbe52c6f21fcc100ef838e2285263

SHA256
8ea7db4678586f432024a9f9011edfac3da7b75c31b65221b3eb13508d48c519

SHA512
e9805dc590a71be1acaf8ba5313d8cd82995aa59940c45f27b9298bedbc1de587c0212edd468d6736d2c6e3ba04150b34bf71dd1b73db1ecfb6693238de84a46

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
50d7a4bf0c12917e584754aa80755bf5

SHA1
86ec8c5e2c2a049b5db73a11da75ba3ff7ff0312

SHA256
59d22513936a7e5ebc9d8d2027357926765d74b7713fd8b2ccd4973eabe7e58a

SHA512
505ca00226373392a90b2cbab5f1e885bb396db6a1e8a37a39cad6e81daba76a36b6e68a7b0f9125690f8e7d203295c8b41a5825b2422abedea7da7aeaca0386

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
8628d5ddb9efa07014f177a16b4b06c8

SHA1
e05e796a87402a60fa026270b91d7419c1b4d9be

SHA256
51084f4240175a84e205626b941bd5fc55160b84824ef9a5e64583c8cafbdbf9

SHA512
029ed33de7e2c4dc38f0fcfb74254da471d6954556c2a7318b429f489c6dc59c269c977a65bd7fdb4afc9a2929270e975c9fd7563f1644a806b1c1709344d76e

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
9886198772f9ae493f678cbbe039c9b9

SHA1
254bace6a42b2a625cbc15e11835496b6c10b0cc

SHA256
27e942e66db260893c4abf3aa05b2a356d9b43b87c41f700d79b3a17efa910a0

SHA512
af35226c77e4b7b2edeccc3ab7cd84febf2a5bfbda93b3ac7dcd0b6182b366477d427df592e98871392c093bd4cee4c047b53ca0dde8a47505a096c8687ea07e

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
8458ec08e1ef3f469b787c07ef204dd0

SHA1
03f5b2ba5115ecc19a42058c0e712adfc4f7cf19

SHA256
3aa70e3de419086d14fec666a2e3dd1ef6575475e540157ae1423338dab8beab

SHA512
8c2f812dea47c815d378826fc1bd2bc885c55929ca47d767fd3ba92779b8a222b86ce0f89477cbfb1d0b6aa9339e4dff59377e256f1a6b0b0bc8ca9f91ea1fb0

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
4ec7e56ac2ee0e542319b3d7dca322f3

SHA1
21cbb8c9351c102f72e9165a028cb5ee1c052b89

SHA256
c1f381d6d23b35e0e00e8a481b4b1436ef986c2e85871da886c28063b9d89e22

SHA512
b76a23c6f728687ba250c61b7e425869da7d18db6f5dc98593351b2786414f2998ba08d8db1db0d130fc5e11c359b9149f7b5e2f3b3df753dd56a77a927975ae

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
b507f6bdf85f233c430d5d9ee318ca3b

SHA1
b8cda12fec1ca6649d38cae40cc0d1d12433a7b6

SHA256
38d3bff6561078c6a85e38055cb586d542c67621f9b26ccd76c8c2efaa9e9047

SHA512
d1c5f02ad44d01241342f8a1b99e604da9ee9cf7275f8ae72c7247df5dc59ee9dd2b1dab2a2a44f009725b757a1c8005f18d353b97d9a20ecbe000c243f4bd20

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
efab3fcca883fbd31101d31f9abf7799

SHA1
1c02188f10f0f50ee44a7c4818a0745ade2831c2

SHA256
efab719ec71aa9a34351f4705bb23e0ab9c536df86349a8bb62355f00bdbeea5

SHA512
486f3984dd8bc83213db603df6ed4c6d3f3648db4a911dc129bc00c992f7aa6e2823bdc42887bd469fe6031f8607edc3f5196dfedf892e0312648deade984c65

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
d7d069e77b14dd653b93311d6fa8160d

SHA1
dd4d066b14fbd08896fafd248f0345bb718e1193

SHA256
a4c552cf4b395b19317d8206b8cb3efb565680627c516c01753c4c322e40bf05

SHA512
634b17bbc939938c202b8776360a64261b139b9e4aec3dbc309a13939decd5b816be0185902cfb1fcc7096730fdcad0fffe338ca23951f53c204bd94aeb3bda0

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
51e72e12dd10edb8b780b8751c305f09

SHA1
22e1cc55db679a91f81668fdebe2d5d1deccc300

SHA256
d8d3632dfa71ced5147d8316ec0cc5a4d4950308babe31edd05dc389ddfb73e2

SHA512
9b54ccbdae1983655e96c36131cb7c3a973597613e10f9f029e71607b0894f0367747887ba02223c3dbc15d5fdc5b8878beb66ffb2d1f35ce27bacbd4a0a93a5

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
693d14d494607d9f49eb7a1a3d44484d

SHA1
514141fa0e480b9190050b88221c446b5d5b9a46

SHA256
b9f669fe8a91c661a420aa63d45c47bd3a23f5a29b40f4411611fdbd44e93dda

SHA512
325f48f436f13fb0c02d8d430e4dcb7e51144d7c46ff84fe84d959e44485e1524a3694e41f92e19036df2fcbeb4911f5906b36c1e52c0b898ddeecc6d06b57ce

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
d62e3c9ef4d28520fea318c2a68fbaf4

SHA1
b1cbf155f872f8cdf0fbbde7b2a8b85e1e07cbd1

SHA256
1e63ce50c5d1e5cd74ec91d8d52167a036e1abf05a94e73dda7be95cea226369

SHA512
a00245110067f3da0bd9e0f2b38a58eb6fb663e4415794beeedd25250f83c4a2dc844f5e50e3a515174aecf5af162ca740d93d983eb791645ec53fafd3cd9db8

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
e2941a8a750e92d584b47d2cf61b270e

SHA1
e96e9b04e501938e5c220d7cceec9831d79a2cf3

SHA256
245a98710605143aec1d75ccee4e6a0fc2e777cc4576ad1bb6299e8442139a68

SHA512
f55466d81098326d2fc32e9da866e42a92dd8b4d99ea40391dbd6b9aa1647732c0de878c7f8e238ae701c05e714cc51736a215f5fbac0c749aa1f8bf3aba8cf7

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
c713fdc6836bd7e93cd16816890d58f0

SHA1
a3de7067b013cb7d7bca3928a971e94626e81586

SHA256
96258e9a4366fd067c2d6f84889baa97d441e6ca6e1b81cf0410592197cf9102

SHA512
b56213d3f1c78e1e2715536388e64b1030de4fcee8fc2a488830d2ce1bba40e7647d36d038b5306d6eef20e208dcfbcb0756757de5a901097f9d310f7bd94361

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
7c09efa23c933c03a51708fdfa0df0ee

SHA1
dfe3d6328420781c43e0031d7a9d86a83e9e4f2b

SHA256
5cec80c07aba2569a77efc7c4ee09f46b09681e646466f1b0bbda647d48b959a

SHA512
bad4f9741642264b0e1b9ea8b5c9bbd6f93aca1a62160478c5a83479d5b77902e060256376048be3b89f4c0c8fc5f6d508072bc3767d28a5b80ec8f2966006e2

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
70cf64668303549e1eb35db9ed40d40f

SHA1
b14e182a1e1ff1653deaee847c02b02bf84f7154

SHA256
7ad750025e8c75ad5abc5d6089ee9d94ef91e9c4a11a9fab1b33a22b5a07bf76

SHA512
590c9efde975a5becf3db3ff81528f3bd7f196768a372e280b8d2f0bf30d8cf0588dd32b82113fbf805d73a011ca4a423537261bf13db85e45ec2c59b3308f0b

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
b1d14c7ba7303141875e6905148f9810

SHA1
06ea21cfdb275ed8fa4c08aaa9b3c6a1a3eb54be

SHA256
9e18459d0564e5c9a180be9e63ac7d57b2b3d5ce1725da0c90735e646a34c26a

SHA512
b77a39dfc5e40e577fa0d906e0ab0d43ea65438101fb588245a617c7a08df544cc89aceb32c4930bc32b00df3454b578e9ab98cbdbc792ae658c9903d1c115c3

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
b9ea2c92805fc67a6c32d39c7fb41719

SHA1
a459ad83aef4eecdcb414be2b89892fbe979a219

SHA256
07994a9510a58a82cce221cd34a15fa414e1d7e93481102549a3ec7b9971ef17

SHA512
5eb69dd4f577f9c2cfebfdfa5cb53748954479d16a53dd81a839ad05c664448fdbabe0105f91e9a787aac199bd8c9356a3b08e876db577096a5144a7ad6867f3

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
57b6b4b95c74944e890c19649866a48d

SHA1
e8151dd0d9c80e7ce26b15f4b0a753a7962b4c92

SHA256
625613bbc4e72f53f9852ef3049dfbe6bf2933a95994457ae246d34fc6cc2b32

SHA512
59558aef09ccd776ae2105199320f158c6ef55075e342960037ae8a137cc00994a718642e4e6fecbe300c288c68ff4e528f1f6493371259d7fddad75b655336c

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
db325c3b375eaf77ac9d42e02fe94926

SHA1
887f3723dea746cf884e89dd6c18b3a211dccc4a

SHA256
8b624ed215bc7e46ffb5814b704cac6096a8e53430ccd33b4e31690d207e2cc2

SHA512
6a2f8141f6df50f7ab02880de0154d99f7ab50177d769c883115506a7103b44291fcacf6ebbd658802dc241e7a1e37b4561eedb9307710ec2530051a886305ef

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
7c7878d29729c99e04e6c036a4922936

SHA1
eee3f322cf5061bf16f7b182b7ff3e22d6215451

SHA256
f85245a7b6a8febe7854a2c9c18a3c0fbdbe3439dfed777abffea72ac53216f5

SHA512
fb1decf0dec1b3ab09524a61643138601ddfe829537b4d8e195c97fddcd56aec0bf067f2e6940d770a4c8fd620cbce98cfc37525a2a3b9e87579d63e324b66af

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
c1d779fd81a9a0d7bbce6748a7ade516

SHA1
79702bad18ab4c88d85c992bd1bfa5e52fa6b9dd

SHA256
5839ce7f0dc7ba4d2151f6b5c25788943095e54c9345b5fdfcce5313b6f027fa

SHA512
d661e3f09b50d030ba68efd8a6e3f6250a1ad3c7d5e810c85cf09b6a79a92c7e4a9c70074173f1954056c06463f9411b8825b4f48cbe965fa5980255f81d2693

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
b9d61d2e6bea7601b7dade89bfae8836

SHA1
6e063c80adf3ff3e5473063bfc9e5f650720c974

SHA256
b89e4a6d0bd8aa48cababea1b1d1f588e1e0d0d0157127a6757d6659cece2bce

SHA512
31d890247dd583a3f9bf8678720550ecd6aa79994cee785286e8495ab965c68d323317ffb4a3be6a9c1f2e4e629cba96bc761dce59fa7b02d523ef8f2e806613

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
b54c0dcf04657fdd331d8d058e46bc9b

SHA1
28837d7308f73d5b2e9314b4ea418febbdcb8a8f

SHA256
167d8030fae9511a925cd32c6d1a476fe5a054e52fe46992db7123d0528d3815

SHA512
cb92b254cb0b446d106967ab7b09a5e51616771ba1d6623eb2f466256262bfc9db4337082879b96d6b2602b17d5a5c6eaf918032aa22342daed86bed50dc0192

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
0d721d67d5567a2def760ce1d5a0925f

SHA1
a633b882701aab488c190bac9df38b8ae94119fa

SHA256
7facc02b4ab5fb663471e0263f3b44d1ea7e1b3394db196816e19d7ccfca3963

SHA512
c8c7bb0e9ca0821625852dadffc5230ad9852c443dbd08fda7f5015ddd9a3f0c8ba8f9988745632dbcb3de9b33b0fada1b2d8fc4e121e8125802673f8e663cdc

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
5d6d6029263ebcf7d5dcaa14ec42eb35

SHA1
d1d7480768c1b770a7175b31985898b6215ee0c5

SHA256
0f9458772f7cd8a2ee448179b71206a653f110e435ace4b426eb351af9949cc0

SHA512
f07989b40ed27756e9abad265c297506bfb1b0d257ae0e5ee7df7a5399241be96307107b6cfc31e750b51457d55dee977d521222d66d3b94b08525141b053e37

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
37ac89ee35170e3befbefe3f0b781832

SHA1
2d07c56ec0242ad48128df297c9904d36af17f9e

SHA256
a763ece6af9361b0897a2979a67d156cc1347776bf19b05dbeb98e2f85f53ece

SHA512
f67459109a706ed380757113f34a3568f885c5176b09ab9262d08d6f3ad37ea62d23c4551f73a64db8f6ea51c4739c43a701750bc561e6a66b65a9c6cd41f21f

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
c5c3b16cf68ab950d929426fe4e99ab7

SHA1
7f21ced6c77a13a55607f29d5184067d5d7c74b1

SHA256
82b1daa2733bad929c9ba8e811415ccc8077c422907b47f18e03a2415213ae87

SHA512
ca77057143b86520144b342efe8cb3f52e92b47911c44d91c4abdd466113485ee0bfc2a15cde18fddfcda791ed7678bee08ea781729a860ad0b1c08ec0e0a43b

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
b91113694d3533640acedfcc74519c04

SHA1
00f6417eb8f974adfefc78e33fbd4b39ba9fcc3b

SHA256
1d93890cdcb7aac0a547f229a3f9fcb8aa4babc1851de0bf893d459c046e8268

SHA512
66063bc47e9b0f02ecedc26e446db92c686f4c7653e30d2cd5d72cb3ddc8128b93966457f95053193f14f3a4639262c42d0959ce6b93bf16783515abf63fa15f

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmproxy.dll

Filesize
154KB

MD5
84c848ca734892ea2e8ab90d84317ee3

SHA1
a1b38d4f1b466061481bdfde7628139c908f7ee5

SHA256
01c53abd5585992f9d62de40f4750899829b9e7e4a026b8d9f5d1cb1748a3fa9

SHA512
cec124435d6d4c76497e7886ca317a0c12a9d8e77200ba94cf6a699b318b91cb4db886eba5a5161941a7dd349f827cd3694abb864d6e37a9084a208276bee7df

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\sqldrivers\qsqlite.dll

Filesize
1.1MB

MD5
d9d7b0d7386cd57e4301d57cb7294b4b

SHA1
dcf385b8d3f9f99a07e1b7757508e5e4080f336c

SHA256
a4ee1bc55369a13b3e721aa48e44de31c6f00439838e923ab7a66438fbab4002

SHA512
e1568ce01edd46aabc795dd4eacab565ffc8dc0271129b5aa770f3763fba756a5de59aa4329510e65282bb19537874c6f307712a7fa2b6971f50dbee7b2664d7

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\token.ini

Filesize
8B

MD5
617da0f08e4117ee08d8eeaf43e56d96

SHA1
0ab9696d42a4583755f2b42983df6539fa8fba3d

SHA256
dd034e8130095c647e6016c2ee8369ef1ebeab22a2eab220268f2327b389c0ea

SHA512
5c051fe4336482e1bb03acf98c145961b3cdbaa3dabf9963e9b6b3ce5eb06eae433dd1dc491fdc625064897db993379962f83789d7ed6eb41d1540588121f5ed

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\vcruntime140.dll

Filesize
74KB

MD5
1a84957b6e681fca057160cd04e26b27

SHA1
8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

SHA256
9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

SHA512
5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
765B

MD5
ef270a8d22e0dc24afffb606e9260b92

SHA1
77b3252ed431d3d63b9d094f4b8aeb19f4abe87e

SHA256
f9c1999abd8da7ccff8ae19a2cf2e35845c27e95dd16cb2e4a983c2f442c037a

SHA512
0d61e6f388ea8822e7666f831a97a6361d659d0fcf62bc08e2468ccce8336e69d137b260f6c5baa9e0192c09275d95c22ee2f2a4c472ae9ad94b08089a1ee713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

Filesize
637B

MD5
d5f2ef2ca9102c0ec094fc0a077feaac

SHA1
3c1831776ac53013dbd69476a6e03405ab3a78b6

SHA256
b15cba39bb83ede0187a3af6af5cc93b27bce99ecb5872821bc38d65be7518d1

SHA512
dcd1bfc6e740a5893c604f38aaed7871cf6e729af3b5c90fe3391b5fa1d22ec34ee33a3cf1773ee05ac2b638f364a9bb26f2c7731bca21014cba8e47d2985eb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
1KB

MD5
ddc6626cca0d30ad41b3cbc4e591df33

SHA1
43af70a960e9176a0c8b969e1de8b6f9f3505f3c

SHA256
90eef2502efcf4d0aa84766530d78db8f4e972c517c57039fa107f01d3cb1e7b

SHA512
c8aa3c24dbc958173c316ae6e291fd30e4635351cfe52199557ecd3596570cadcd71c2ce272c225208bcae5743d44b693545c3e9de7477b7f57f578cbd4b08c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
484B

MD5
4fcc9a332bdc982c12e1291c59be22ac

SHA1
6ad6cdc166c5ce7dbd83b6ccb70bd21b6a121c0e

SHA256
288ffb85aaf5f27e0d5bcd3e32a632528e3787b14afd12447f11aca3f9db97e6

SHA512
db0150c871eae0b53d8cf66544122fc598dfb64ef3461f9778ec2fdba586a98a3081ac9056a35cd612066b758414df834f49735b088ef63a8373abf39c301eb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

Filesize
480B

MD5
02122dd0639c2bf227615c5e84bfb121

SHA1
93d220ec4b46fc67a7168fffc3f9d27196ea67f2

SHA256
64e698de26d820006edb5609c535af2837c6efe77a68686c6bc6a0740f071ca6

SHA512
ea910494dd1e2e9b04e7147bb5fec68b3a30f88419bfa98f125820249974552702d9f25d4f77da7411d66be79b86fcd3de0c820b094cab852aa22ed1bd7417f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
482B

MD5
45aabc8ca9a56eb7f16e161d3e7703dc

SHA1
9b0e635ecf9a9c2141641b55cf2dafbe4132fc41

SHA256
737ec554e68c565823a1bb4ef83d1269b776c850eacaacab16d34bfa2b7c6a71

SHA512
3f08c9127d7221cae9c01531f890bb7e7b2d9aef0b305a47d351eab69fbe284399e69f2c6e0630e26408196ac961220c0497e8ed2e9408348fe9349fd8963883

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\activity-stream.discovery_stream.json

Filesize
26KB

MD5
433f687ad5268793bdfd00b73bace71c

SHA1
9225b311517c1f751a33b36f2da6a21b677e2973

SHA256
197869b824c5113e367cdce38d5bee189a1593bc8e8c6063daec75f770f0152e

SHA512
e535e15b6e4059ff0c01de41b57f03e3be2628027b297a31a228b6e1f93fe929267d16856711e37fc0d8b71278ef7c876dd5faf975c9b12437eb70406f126501

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
226B

MD5
feceaa82323f9de4d3578592d22f857d

SHA1
4c55c509e6d16466d1d4c31a0687ededf2eabc9a

SHA256
61480b43136b02965f59e3256b8de1bf35caa7c084a7bcb3ed5f4236451d4484

SHA512
82dac003d30eed4fc4e06ab4a426c9b7f355d777c243b710c5c0d3afc4c26d93874af2d0a542fca4a2038050b0d0fa8f63ed82e5f2771ae8a4de0f3b08d56d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin

Filesize
6KB

MD5
7d46021274cf9cf0812b8bee27472ada

SHA1
b7b3ac58bb9db61bc13f5ed0dbd991607e58f140

SHA256
e0a18b2929181f604e064bd679d2049ad6c16121594f2c9278378ff3c579fce6

SHA512
7642dfd24cee2f7100a59a3c13ec76eca5080c5464c447dc05d94519a80b3ecfbf0a2c06a9d1b727f8c4434ad4cf38ee1a4743ba735d67549b1b3746ae8a5a2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\AlternateServices.bin

Filesize
8KB

MD5
7f00ab80e4b228b4a87494c4845d96ba

SHA1
ec09f2b4609639796781bc96289cde321d56f70a

SHA256
a58d6fe5174d5080c3eaf30925345490cfc40c4e9b0066314207eba88e69bcac

SHA512
7d2877ab79cc25a240fc2c41029a6d2568ca101dda0c30b7a8b3cf3714a26e9e523a5e06a2bb8aa1168f1d15a18feded336b56a438c0e98201b96a0c2240a73a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
94c12c9a2d8866c7a9f928e41fc5227a

SHA1
3d19a008907160f8fbf62dc4b51e3419c7df8a76

SHA256
aff7693d9a2b49a2be1bef6b1335fa8ed33078001481585e94ac1c9d924b0ac2

SHA512
a8e9df4e9c313708a2c6e506903caf10d7e6d71d2fcb175df1513e8a5408b58c5bc3e9999b4da18b34d2e0aae6dca819eab05b9f072e2720a8cb1055b33e4cbb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
cb8ffe730cf44c61c99ff49e37890543

SHA1
dd59f543fb3cabb7a34e9e210059654f2a0a0fd3

SHA256
2e2add9b383cd199110d8cdaa357a96943c91dc91cb2c5499b4eee43d3693cc9

SHA512
164604334d8526232c759a61d0fd4d0618daf49e6138a2dc6c960941de4bd1008dacf0cc40e2595148b7ae5940f3a5ef6a78fc5ea69af0ab54cf3e88df7c1e8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
b946a2c91dd2fcc19fb69ed03b8b33b1

SHA1
39711a93cad9dcd6243c7c5b25e2fadd632c4667

SHA256
cc1fad16135a151b41f854db5bd865e767beed222ce1bcb45a370b86455a2cb2

SHA512
6ba44117530078a5d29c4750cc3064d20c6e04001fe0a07c718327808026b959e7975548965f124056d885affbb5e6c1ce9d8e0549c90f8412152ef3e858c82d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\1dee4122-89f5-4e86-bc20-fda17e1e9389

Filesize
26KB

MD5
392d22816ed404aff48fdb5c78dc08a3

SHA1
77ae632d833b0c08c3bdc9b2d02a9858863b84be

SHA256
a2903f741a66bb82f406bf8954d1887f63eebf59088cb2a5ca00e3935a2fdf7d

SHA512
480cf44cf85b4ecd9e97d1d3de76cce0ada3968d1e680e385e361b273b085b564d749abe9492e97f3cf85db1ca5b94946c984607a7e76773f555d3a11100edba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\6ee8511a-a0a2-4758-bfee-0ac0f7a4c149

Filesize
982B

MD5
20b9b1924a98db529e4862a153e5fe20

SHA1
41070676dc81dc305360a3129b22b8d80530cd85

SHA256
c6be11e6e0dd4e0c0c2e717ad1efa8023a1e9dc5be8a955c7aee8088ca2e8950

SHA512
43e979bad8488869e6750364b9facd22cd612275aeb2106583e6ad4452baf19f17244d6f3bf3720668cc221c777bfd4f6f3322dd08c45cc835a8d3b9f5ad8a9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\datareporting\glean\pending_pings\e5824450-4768-4940-a296-96c2f4b33b02

Filesize
671B

MD5
8ce669793fdef029d655d5d44bc41058

SHA1
fe5e3a8b3d744413ecc52cff280923b2af377b78

SHA256
eaf0daca0cf314aaa8c54c3dcafbc3e6b91d24d4e4539a134bc785e658205d32

SHA512
388fafe75e7a2e9e873c2d1bccf12bd20e8bd98ecd6a04029a7677d09e4af8a08f8330c0ef55d25528e7097a5d0c875d753c2947ee7fbb05cac94e0dab378d01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs-1.js

Filesize
11KB

MD5
53ee092ff10737a70ac8c298e2e934e1

SHA1
b0507ebaf51e9614e93f3abd9295576ff858b331

SHA256
9f2fceebc649ccf47d16562c0cea62facdde23e5e3d7fcb1079f9f5bc801bd18

SHA512
1de2316d7729c9046da771a82a686c02c2fa87163e7a587144a19e8deefba7e606f095dfd52343ae8f1ca1db780b6367d17b122a9915825e2f7651446ced8867

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs.js

Filesize
12KB

MD5
2d8d09e28611aaeee1ef1100d6854f66

SHA1
2fe9a74baa4420c2452e98d8db0e17d770314a6a

SHA256
22ea851048d8468138f726c130e144ac0daaa3f6e2f0584bb9c0ddb0bedc1eaf

SHA512
e6ce0a82570d362aee06b4df96f3d111d6fe5175e66f0615b4516bfb82468a2537027f97919a5857956adaa604780688befb2f24476353f2a6091ad5ab0bba8e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\prefs.js

Filesize
11KB

MD5
d599c2964ab47d09ee646d1b26e64de6

SHA1
7057f46675c1194337e611a869f1567741a9a949

SHA256
3b0aa3f96c995d8c7a39df7e9088069444de1b08413f09cefb85f975fe5665a4

SHA512
f29b3913e4d646094a230cf6191d9aa374f5ed29a4a65b960a1a820c9c66eeab2e7366c0606be702642e7cc6b33ee6e00a3644b6fe0212d4bbcf4b40876e74cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
a2c36800461bdc2daf0c13436d75f8bc

SHA1
c245421ad5ad27732def034d06e2049d76335442

SHA256
afd5c9940373098af877e5c326561e95c304e708fce8e97a274a34e0a41613cd

SHA512
1bc9485a77b29222b9ad6ae61f8ced2dcb8b901e17579de8fc831e1fd14ee0cffc48d73d3e78dcc18aacb0b0691011c087df811226dcfb41da810310c5c84ec8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
5a38cb90e0f7b2b396065b3acee0f92c

SHA1
be21f4dc3aace167c73ca167dadad63c2bf858c3

SHA256
b832272aca06ecace2a0f9f0fc39bb2e4996d3daa6288fbba5641b6c3ba67277

SHA512
6fc37d6918704e5af37d9855252e43c1221bf574d9f54c07382b40ca4a84bb48a5da3479297568f7ae4e35dde89a698b8910b841126d50174e60f9e4f4017b6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
471096f5d30a77f719db97c44bd02939

SHA1
41462c24bd6ab059543275bcd6bc70eaf3c3e15e

SHA256
b7f0603b2bd8a8f8181e18c9b051f5dd832f6803064bc0b57b4fe7fc84dc4b74

SHA512
2260f1edf4bc4161ed3f710edcb70c888f0d124e1375b2f86c304e6343367cd25dcaafc2927b9299cb604e312a098febf1c510748192889ede4bd3be31fcb50d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
552KB

MD5
781074c66f9502f85576f1efbdd44038

SHA1
f476230ae19c51b639381f9f328ee6fc51ae1b3b

SHA256
ca1a2775a923a3e8f65f31722d035e7ce6a0c358e5e96295494e5c545171e9a8

SHA512
c9f1581e0420d00d44a32de9cf8def41860be6b09bfb9fb5796cef496d4f2260a1a79199ea92cdfe6913dc680daafd118df15cd6082fa88a55432d5fbf427bf2

Download Submit
C:\Windows\Installer\MSIE89B.tmp

Filesize
285KB

MD5
82d54afa53f6733d6529e4495700cdd8

SHA1
b3e578b9edde7aaaacca66169db4f251ee1f06b3

SHA256
8f4894b9d19bfe5d8e54b5e120cef6c69abea8958db066cdd4905cc78ecd58b6

SHA512
22476e0f001b6cf37d26e15dfb91c826c4197603ea6e1fbb9143c81392e41f18fa10a2d2d1e25425baaf754bff7fd179ef1df34966c10985e16d9da12a445150

Download Submit
C:\Windows\Installer\MSIEADE.tmp

Filesize
203KB

MD5
d53b2b818b8c6a2b2bae3a39e988af10

SHA1
ee57ec919035cf8125ee0f72bd84a8dd9e879959

SHA256
2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2

SHA512
3aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
923e64f8097a3e8eee1f23829316c404

SHA1
204efdc964dcd2f329304fd128b3666cc3dfad06

SHA256
fba1455574703020ba62516ac77ff61e9869d1054d0cc3a1940e8dee9a9e9f8e

SHA512
56e62d53ae6444e27fae3a7fc038dd09af6df1ab48121c0f8d4c282e22281923cbbd33eb8ac889adc1740d26d69171385698408076fb1f8c7f13a4ca6d2cb6b9

Download Submit
\??\Volume{f3a72b53-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4488ce68-f388-415c-a8b0-6e8ff78dfff7}_OnDiskSnapshotProp

Filesize
6KB

MD5
945f54dbc4f8b0e311482481cd22e077

SHA1
28d338a676b14830daafc6baf34ff8bf36eabb75

SHA256
4d3b5f218772b2d85aeb318b5e8de8ce070e2f8f3b32c71ddf30a1c30ad55537

SHA512
7e56beb5c5e3d0bf0b295782a5aa85c120a58c1794584d63b2f28b96eaf8823fb8463aa9191e8f8b697179c1676f47fda3052397fad5063c55268573c4ade8ef

Download Submit
memory/6744-6168-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/6744-6169-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/6744-6200-0x0000000003920000-0x0000000003D20000-memory.dmp

Filesize
4.0MB

Download
memory/6744-6204-0x0000000075750000-0x0000000075965000-memory.dmp

Filesize
2.1MB

Download
memory/6744-6202-0x00007FFD38B70000-0x00007FFD38D65000-memory.dmp

Filesize
2.0MB

Download
memory/6744-6201-0x0000000003920000-0x0000000003D20000-memory.dmp

Filesize
4.0MB

Download
memory/6760-6189-0x00000000052E0000-0x0000000005356000-memory.dmp

Filesize
472KB

Download
memory/6760-6190-0x00000000051E0000-0x0000000005230000-memory.dmp

Filesize
320KB

Download
memory/6760-6188-0x00000000055F0000-0x00000000057B2000-memory.dmp

Filesize
1.8MB

Download
memory/6760-6187-0x0000000005890000-0x0000000005E34000-memory.dmp

Filesize
5.6MB

Download
memory/6760-6186-0x0000000005240000-0x00000000052D2000-memory.dmp

Filesize
584KB

Download
memory/6760-6181-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/6760-6170-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/6960-6205-0x00000000003E0000-0x00000000003E9000-memory.dmp

Filesize
36KB

Download
memory/6960-6209-0x0000000002320000-0x0000000002720000-memory.dmp

Filesize
4.0MB

Download
memory/6960-6210-0x00007FFD38B70000-0x00007FFD38D65000-memory.dmp

Filesize
2.0MB

Download
memory/6960-6212-0x0000000075750000-0x0000000075965000-memory.dmp

Filesize
2.1MB

Download