ba3cdc5190b44da96e5ecb5f39e2cbe3713984dc8062cdab679c759de51500b1

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

em_nrat4VVx_installer_Win7-Win11_x86_x64.msi
Size

94.2MB
MD5

f740670bd608f6a564366606e0bba8da
SHA1

c635e8453bf0f06c34d41d3319670e5dc966a5f4
SHA256

ba3cdc5190b44da96e5ecb5f39e2cbe3713984dc8062cdab679c759de51500b1
SHA512

88f1e800265e4e72f914e50240a6a7cca630ea4bcd6981be13237cc6f42b182741542b907737490a367453c179ace55fb64c3e0fb2cb6ecf1bace7a442458e0e
SSDEEP

1572864:SX+lBWb7cVOxi2CDRq/SUx6EIL2CjmFkm+pF7Vxo81MOL9vh12epl37cTLiAhRLh:nLYxsRq/76L2CjmCZpRXouxvD6LbhRHJ

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe"	msiexec.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	1540	msiexec.exe
5	1540	msiexec.exe
7	1540	msiexec.exe
9	1540	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\	ITSMService.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E455012CBF4BA8A2AC67618C00590908	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E455012CBF4BA8A2AC67618C00590908	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD	ITSMService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Gaborone	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Ensenada	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Jerusalem	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Pacific\Wake	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\US\Alaska	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\StdBBox.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\form.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\httplib.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\importlib\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\pprint.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\xcode_emulation.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Campo_Grande	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Menominee	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Katmandu	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Ujung_Pandang	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\qtwebengine_resources_100p.pak	msiexec.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Libya	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp858.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools\command\easy_install.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\North_Dakota\Beulah	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\nl.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\emxccompiler.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\getopt.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\_markerlib\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Bangui	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\14Point.fs	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\msvcp140.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Yakutsk	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\cachecontrol\compat.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Brazil\East	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\SystemV\PST8PDT	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\Gray.cs	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\focus.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\ctypes\macholib\dyld.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\dependency_links.txt	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip-7.1.2.dist-info\RECORD	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\cp1250.enc	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Mbabane	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT+6	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\langcyrillicmodel.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\locations.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\msgs\fo.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Mazatlan	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Pacific\Majuro	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\US\Pacific-New	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\keyword.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\vcs\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\progress\__init__.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\symtable.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\koi8_r.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\ZoomHeight.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\pgen2\parse.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Guyana	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\La_Paz	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\samples\SGrid0.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\demos\rmt	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\msgs\es.msg	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\uu_codec.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\generator\msvs.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\14Point.fsc	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\tearoff.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\sched.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\Debugger.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\multiprocessing\connection.py	python_x86_Lib.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\f76d099.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID4A2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID4E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDABD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID3C6.tmp	msiexec.exe
File created	C:\Windows\Installer\f76d09b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF88.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76d098.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76d098.msi	msiexec.exe
File created	C:\Windows\Installer\f76d099.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB6A.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSID358.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID434.tmp	msiexec.exe
File created	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE72E.tmp	msiexec.exe

Executes dropped EXE 7 IoCs

pid	Process
2268	python_x86_Lib.exe
3008	ITSMService.exe
1904	ITSMAgent.exe
2644	ITSMAgent.exe
1628	ITSMAgent.exe
1296	RmmService.exe
2140	RmmService.exe

Loads dropped DLL 64 IoCs

pid	Process
2984	MsiExec.exe
2984	MsiExec.exe
2984	MsiExec.exe
2984	MsiExec.exe
2208	MsiExec.exe
2208	MsiExec.exe
1728	cmd.exe
2208	MsiExec.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1540	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_x86_Lib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ITSMService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	python_x86_Lib.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	ITSMService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	ITSMService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ITSMService.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\PackageCode = "D7076E96D3235814DB26ACC95D2BAD84"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Version = "151109272"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CDM	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDM\proxy = "false"	ITSMService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductIcon = "C:\\Windows\\Installer\\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\\icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\PackageName = "em_nrat4VVx_installer_Win7-Win11_x86_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductName = "Endpoint Manager Communication Client"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1904	ITSMAgent.exe
2644	ITSMAgent.exe
1628	ITSMAgent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2760	msiexec.exe
2760	msiexec.exe
3008	ITSMService.exe
3008	ITSMService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1540	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1540	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeSecurityPrivilege	2760	msiexec.exe
Token: SeCreateTokenPrivilege	1540	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1540	msiexec.exe
Token: SeLockMemoryPrivilege	1540	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1540	msiexec.exe
Token: SeMachineAccountPrivilege	1540	msiexec.exe
Token: SeTcbPrivilege	1540	msiexec.exe
Token: SeSecurityPrivilege	1540	msiexec.exe
Token: SeTakeOwnershipPrivilege	1540	msiexec.exe
Token: SeLoadDriverPrivilege	1540	msiexec.exe
Token: SeSystemProfilePrivilege	1540	msiexec.exe
Token: SeSystemtimePrivilege	1540	msiexec.exe
Token: SeProfSingleProcessPrivilege	1540	msiexec.exe
Token: SeIncBasePriorityPrivilege	1540	msiexec.exe
Token: SeCreatePagefilePrivilege	1540	msiexec.exe
Token: SeCreatePermanentPrivilege	1540	msiexec.exe
Token: SeBackupPrivilege	1540	msiexec.exe
Token: SeRestorePrivilege	1540	msiexec.exe
Token: SeShutdownPrivilege	1540	msiexec.exe
Token: SeDebugPrivilege	1540	msiexec.exe
Token: SeAuditPrivilege	1540	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1540	msiexec.exe
Token: SeChangeNotifyPrivilege	1540	msiexec.exe
Token: SeRemoteShutdownPrivilege	1540	msiexec.exe
Token: SeUndockPrivilege	1540	msiexec.exe
Token: SeSyncAgentPrivilege	1540	msiexec.exe
Token: SeEnableDelegationPrivilege	1540	msiexec.exe
Token: SeManageVolumePrivilege	1540	msiexec.exe
Token: SeImpersonatePrivilege	1540	msiexec.exe
Token: SeCreateGlobalPrivilege	1540	msiexec.exe
Token: SeBackupPrivilege	2608	vssvc.exe
Token: SeRestorePrivilege	2608	vssvc.exe
Token: SeAuditPrivilege	2608	vssvc.exe
Token: SeBackupPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	1508	DrvInst.exe
Token: SeRestorePrivilege	1508	DrvInst.exe
Token: SeRestorePrivilege	1508	DrvInst.exe
Token: SeRestorePrivilege	1508	DrvInst.exe
Token: SeRestorePrivilege	1508	DrvInst.exe
Token: SeRestorePrivilege	1508	DrvInst.exe
Token: SeRestorePrivilege	1508	DrvInst.exe
Token: SeLoadDriverPrivilege	1508	DrvInst.exe
Token: SeLoadDriverPrivilege	1508	DrvInst.exe
Token: SeLoadDriverPrivilege	1508	DrvInst.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1540	msiexec.exe
1540	msiexec.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe
1904	ITSMAgent.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
1904	ITSMAgent.exe
3008	ITSMService.exe
2644	ITSMAgent.exe
1628	ITSMAgent.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe
3008	ITSMService.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2984	2760	msiexec.exe	34
PID 2760 wrote to memory of 2984	2760	msiexec.exe	34
PID 2760 wrote to memory of 2984	2760	msiexec.exe	34
PID 2760 wrote to memory of 2984	2760	msiexec.exe	34
PID 2760 wrote to memory of 2984	2760	msiexec.exe	34
PID 2760 wrote to memory of 2984	2760	msiexec.exe	34
PID 2760 wrote to memory of 2984	2760	msiexec.exe	34
PID 2760 wrote to memory of 2208	2760	msiexec.exe	35
PID 2760 wrote to memory of 2208	2760	msiexec.exe	35
PID 2760 wrote to memory of 2208	2760	msiexec.exe	35
PID 2760 wrote to memory of 2208	2760	msiexec.exe	35
PID 2760 wrote to memory of 2208	2760	msiexec.exe	35
PID 2760 wrote to memory of 2208	2760	msiexec.exe	35
PID 2760 wrote to memory of 2208	2760	msiexec.exe	35
PID 2208 wrote to memory of 1728	2208	MsiExec.exe	36
PID 2208 wrote to memory of 1728	2208	MsiExec.exe	36
PID 2208 wrote to memory of 1728	2208	MsiExec.exe	36
PID 2208 wrote to memory of 1728	2208	MsiExec.exe	36
PID 1728 wrote to memory of 2268	1728	cmd.exe	38
PID 1728 wrote to memory of 2268	1728	cmd.exe	38
PID 1728 wrote to memory of 2268	1728	cmd.exe	38
PID 1728 wrote to memory of 2268	1728	cmd.exe	38
PID 1728 wrote to memory of 2268	1728	cmd.exe	38
PID 1728 wrote to memory of 2268	1728	cmd.exe	38
PID 1728 wrote to memory of 2268	1728	cmd.exe	38
PID 2268 wrote to memory of 2192	2268	python_x86_Lib.exe	40
PID 2268 wrote to memory of 2192	2268	python_x86_Lib.exe	40
PID 2268 wrote to memory of 2192	2268	python_x86_Lib.exe	40
PID 2268 wrote to memory of 2192	2268	python_x86_Lib.exe	40
PID 3008 wrote to memory of 1904	3008	ITSMService.exe	44
PID 3008 wrote to memory of 1904	3008	ITSMService.exe	44
PID 3008 wrote to memory of 1904	3008	ITSMService.exe	44
PID 3008 wrote to memory of 1904	3008	ITSMService.exe	44
PID 3008 wrote to memory of 2644	3008	ITSMService.exe	45
PID 3008 wrote to memory of 2644	3008	ITSMService.exe	45
PID 3008 wrote to memory of 2644	3008	ITSMService.exe	45
PID 3008 wrote to memory of 2644	3008	ITSMService.exe	45
PID 3008 wrote to memory of 1628	3008	ITSMService.exe	46
PID 3008 wrote to memory of 1628	3008	ITSMService.exe	46
PID 3008 wrote to memory of 1628	3008	ITSMService.exe	46
PID 3008 wrote to memory of 1628	3008	ITSMService.exe	46
PID 3008 wrote to memory of 1296	3008	ITSMService.exe	51
PID 3008 wrote to memory of 1296	3008	ITSMService.exe	51
PID 3008 wrote to memory of 1296	3008	ITSMService.exe	51
PID 3008 wrote to memory of 1296	3008	ITSMService.exe	51

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\em_nrat4VVx_installer_Win7-Win11_x86_x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1540

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 24DFE13C53A433DB24C4AACEE7632096
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2984
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D0C315A1E9295738CFE975D6F34703DC M Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe
      "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2268
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2192

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000474" "00000000000004B4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"
1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1904
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2644
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1628
- C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --start
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1296

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1664

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2140

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76d09a.rbs

Filesize
711KB

MD5
01c300fc3e6d0752c5de82318d827bb8

SHA1
18307c478b565e0407d4c3da0b0fb17b46454c3c

SHA256
a3b4921e8b7c0d5402a7ff7c9b0259eebfd922a9d9fe9ea0a8b4b6c3adf02fa5

SHA512
5d3f1cc719ee5bcc2a487745b4949057ceef96e2d0be3816bcbb190de31ae7675450f65324820b90991f0ce2963522256f2eea0d49b5473195d0f937cad0f85b

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

Filesize
3.0MB

MD5
a5b010d5b518932fd78fcfb0cb0c7aeb

SHA1
957fd0c136c9405aa984231a1ab1b59c9b1e904f

SHA256
5a137bfe1f0e6fc8a7b6957d5e9f10df997c485e0869586706b566015ff36763

SHA512
e0ca4b29f01f644ef64669ed5595965b853ae9eaa7c6c7d86df7634437041ef15ceb3c2d1ab9dec4171c80511684a7d7b06fc87b658e5a646699eb9523bc4994

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe

Filesize
8.4MB

MD5
6b4752088a02d0016156d9e778bb5349

SHA1
bd13b1f7b04e0fe23db6b3e4bd0aa91c810e1745

SHA256
f64f13bf19726624a9cbaedda03a156597737581d6bc025c24e80517f5cab011

SHA512
0fe982b0b551238fc881511cdd0656ee71f22aca3a5e83ef7ce41b3adf603f1be17ba3e2c10797ee3dfb5e15ff1ac3e8cf4e05c657e7c047f302f50baa42ba2d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\MSVCP140.dll

Filesize
426KB

MD5
8ff1898897f3f4391803c7253366a87b

SHA1
9bdbeed8f75a892b6b630ef9e634667f4c620fa0

SHA256
51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

SHA512
cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
ba7f4d9c0659e79dc5c1aa091414284f

SHA1
342daf5cdfd1aee5edff560f5b4e9e0681fcf1f6

SHA256
9e5c3ab0f40be5ca0164dad342e1e77dcd2effc1320c453d46acc70590211d04

SHA512
e03c5e93001f836a14ae27bc53b556c29472b317a7b541f52b3828d3c276c5e73692ee79758669bd20cde1083ff70e2cf8dc01db1cbb7d100965ab038cfd1cd4

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
1d796213b9d5fbc612f232706336c173

SHA1
726192774094cd83ed54af59b287343b704ef7af

SHA256
ea9ffcb2905791caf7959968cb1ce93bd52aef0bc9b4b7651f36794e93855b1c

SHA512
12b3be45fe3da2421b807a861c875bca4ed747837ebe4b8abdbf5b9c9c051f05edbac145a5c6b7e66893cfd0a23bd30571fc80a2f0acff4145562139e899a4ac

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
ee3ad8b3266942804746c9caeac61250

SHA1
560c2fc9bbc122a969a2ff6ee86a3a2d34fb87c2

SHA256
eeaadeee2af2412a4ba6ad9a4f5b9c1ed950c1804b6c39f084ae0477640603a7

SHA512
af701a7344f1b334384158fbe0480a9c62eacdfccbae44be21f18067c0b5143bafbbfcffb9e4fb2a3d3b625612a86eb836659ab6af3de2c48b1aa72639be4018

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
b040f6ffd5fd5ae9595fdbdac670c4f3

SHA1
9715cc4e914908e20ea55f7ba9200d1a999594e3

SHA256
7e3bd6f3d1ac923ec421e9daeb0896e956d6fb409fd085000af26eabca72d5a0

SHA512
467075c15d1bca1b7a682a04a6ba48daab4c7122fa03a4c70deb5b922925e00e78adc7c826046e011fea384c5bea167485efb6d5914fbfb0e08c28f39f84e3dc

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
3477b3547908e24ab914086aaa186500

SHA1
977ee0182efb1a6045441c354e6f8b68d78c78c2

SHA256
e3cb66e2c81d8e0e3df66096dda346c5a35562a28497a610c97e29608f7b4a43

SHA512
51ef9ec5631d67044606c36e1d6580131c8757a22dae4d33742394aec3fa1907bcc8a8ee1a55fa7327866d8212b8f69c89c496b62a758282c03c7e91173c1c05

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
a401127ff04d09a30a1836472ad92174

SHA1
bf5c29ee6c1c23d0b7cd7b37987885d3628965e8

SHA256
96490994c16e9c0bf77889a7c01a8a8ab33b41d1bf51b6e7fc7391bbf27e23cf

SHA512
7a7d2c1bda86f5e9e4c592ffe442fd301b2769231d8aa0ac4c7c130e3f9f558abf5a3205d4066d8298a44df1b1a84ebc46b629c7a4c7abaeb6f4091a6364eafa

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
d28b184587231bdbfcaba0aa1d565d4e

SHA1
79fa8e825fd0b27953d02fe081db9b677a2df4fc

SHA256
ad981f2994684abd13f9e297243078645ac0c83f686dd4693ad34935e9b4a303

SHA512
372578bea5b32230123fbb74b5aa621fb6b341b32e8af599654a2451cc3d8d9142fb38a8c77b369dc33b668c96646d8aaebdd04083c8caf473432f19e3c18645

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
571090df128c56206e6a3d11782c92cc

SHA1
256920bac47975c57ada6e86e051689fbc1f2a44

SHA256
125b53ddf4ef3ac13c7e3640c8a5b2c7ffc90031101a81f6920ccb520034fa72

SHA512
c2e7218180772faeb3aa797687526611d276d8ebd915c825129f32cc6054b79fe654f950fa8b1b4e6ffe89d4880032ac891de1b5840961ece5edc2d29eca3f62

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
e221f8e4aa8a2adf167d49c65cd97f0d

SHA1
1445d410e5651d7a12494d3baafae95edf283e9e

SHA256
22ee6f652bd153395fab5aed35663235b5b6da0f014f6b8a3fb006e7ed660ee6

SHA512
ce3030a197cfd568b6e846f8b458a2b124ac4fb3926493935cae212a6cb236824d72358ad4ec5760b3ce5c77c9e7656dc2bb0ba0017bf5bc902d48a9c0c556af

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
32KB

MD5
8cd4b7ca3c39649e324a4602dc8ca45a

SHA1
39172d1bd87d599d861a4dcb093fec722048d277

SHA256
d9172a21430de969a79238c3867fac3541e004e5b7b498f121c7a56e932ed5c1

SHA512
54c273a55ce9e5121e699554480da2140a6e9dd7d7a1f3db20297a10bf53cd1d8046d293ac0469ad09b67f2c380a30232e971d7458cf3f91bbd4b549688a1497

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
74e9ec48ba51ee5fcebf4c772ecc30bf

SHA1
1c5cc4ae39650a40229b84e01669bed09176c182

SHA256
6a5bbc415498aeddbe07ae43d8896dfd08eca8ca829dc701c191485c963721cc

SHA512
fbcff8d90326798ecbc31047b44e15d7034fb3c2d936b28d65d6efb3df36078cbea20edbbcc6193962111463437f8125c853c616fc109a6dfb4c22bded369aa1

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
5118e54b1c6a4a49ea4ab91b74ce3bc1

SHA1
a9a070921588e5c3624857dfbb6744a8e2c893a0

SHA256
85be45197e5284bec5081ce24b4ac3984fda1d6fe3a49f9085819631fd62fcd8

SHA512
b3b744113f3171c5c9ac61715e81335d291c0f1d19262d26cb442859e1279c774cfc556ad73f6a85960b38f1928b02e64b99bff83295bc9e988688af371d56e5

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
39a9d1eb358ebd0b4abc38af05277b7b

SHA1
99193d97a56d8ba0a014836f80fff54e55104e85

SHA256
a440980f85cd03fa83c4821d65030acf278e9d72d6b550f6ec0f89725f85d41a

SHA512
d3b311aa5976c81cf5a0fbabd32b0d719883c616cc45cd2908bacff72ee4b2ef7ca588b4ef34da1fcc716813e2a4e1d3731187812f5b76ce093e846e41b91513

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
822565c249cb2dbb476635c0c72fc62a

SHA1
657b4880e49f5fccbebca1655bd84e4fa51a1aa1

SHA256
0dff6ae03e10221f5b633a09540b215e63f55565873cc97f1c256d7df7a560d8

SHA512
413af10fb05ac30888c7fb3991f95504a3c421f2fbebd089788d1389cfd2796d6bf3bfdd224f4ff570511023f1dae81499742e488cb78d61bb998afd331b2037

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
9c5d9eb6e8982abd8a56a3543276d82a

SHA1
e7307eb6b959cf1b1f102eb210b9b163d5ea8e36

SHA256
cc22f626a3eaa8748144c56645477b4c5967f46dcb40782f188777c8033b5113

SHA512
8055dfc84677bef4f913ecdb4615e3d14d7e913ea49ac44a9a61b6be6a1fc9e1836eb1620d869f846ded4b5360e7a1b12e7701b7526b35284376bd4c620924bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
765B

MD5
0838a8204d4780f9f23ddd29e923a5f0

SHA1
975428f0c85c49be63c816a179def6b8a2388d90

SHA256
323d0350b7114cd1a2bb038dec2539e47fc60b183b89cad6cb2b50c7784520a8

SHA512
b8dcc34f6c1428bd3d12a5bd31bc8a5c87f4d16c51f73dd54eb73a1cffcc07d0113e918f5b4a9c40987901cd8f7f446867c9669126d84ac59697c0b9846d9f80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

Filesize
637B

MD5
76073e3449b1689314bc364bb5c4280a

SHA1
926aacca371e49acc069917a843fd9875ba5113f

SHA256
7fb5f20d4d7c437c9fcd105988dd2f48923e16166ca4bd60e765a66758623381

SHA512
af712029c81f492c0fd64ca4cfa9d4e38987af6007808a4c939d5eea05fc57800be5ea3173637f6a703f1e9ddb819c1e8a5098f926bece546252054235e075b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
1KB

MD5
75706d22cefe7f2618d31cff0bf616e5

SHA1
9ea2793506559b4d6283fad1e417ce4f4ef9230d

SHA256
26432ef46726510d348e0f10236a1aa3c37450435bbe8fd24401e217a236e0df

SHA512
65ec0433df7499c71b9671cadfed5f158d21e0e88f0c386153880eebc8c2d374a0964247e6e3b5e84378a46da4d73bb4bff17ecc10c144c6715ea63b70280e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
484B

MD5
dc85ecfe28e6208b29fce75b99860cc3

SHA1
6b39d29a3b3dad32e863ff37cca251674d8f4b64

SHA256
b6b6908000b387b0129c479b86589941a96eb08dabdf61283e3c212618f22b7e

SHA512
fd5ce1fc557390393588c3096efbc507fa1ef133fb758f01b9bcfc4642c07a836ed9c02911148463abecbbf57ced8fac8001348cc02a4c0c3a06d50cf0d17772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

Filesize
480B

MD5
51cd6d7269021b89876ef6e9dc5100a8

SHA1
7d408478cbacf5a3c72bede2e5b7edc4b6846a0c

SHA256
6cd0c3f960b7b661ffba686a2adbdd39321e8509b9e06f5a775b1e89c4e183d8

SHA512
c6a25d34feaa1f0f6c5ea1aa0962dd40074b13857d75a0dc0cdd5c5cb36616385d001c043ff1e5ee6e8ebc366383abe260072df16a2cd30ff6ff2399b8f95cd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1971c3fd2abd0db30e509b0566149f15

SHA1
230d3a0839e92734c6370f21a87e0d054bf3fed9

SHA256
5af65cf115d6b65edce45566a48e0ec45080b494558ffed0ebe9e4fb25ba3fcc

SHA512
e624a03da2358d4c50584d93e0d4fec3e170c4593295ec31a4f8046fcb1f1f6ca4d6a8eeaa8343f45c56a7c864e0c1ec43cfdb827d5a239138446fcd1f91338d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
482B

MD5
ae987dd3cc80d4b7029f2721473adf91

SHA1
1acb4bd57e0976d19f2a9ebe1cc89b6456c72876

SHA256
80134d926db23fc042a2a5003da8401de047be0302cec0e44ebc888efaa50e4a

SHA512
fdc74d216cf64888ce3ce90a3d923946d8c653455d3d3756fae248ad62785e51a8956dc5666691bf7f05595ebe62f1b0df108096190f0cd47260b62066686244

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
226B

MD5
feceaa82323f9de4d3578592d22f857d

SHA1
4c55c509e6d16466d1d4c31a0687ededf2eabc9a

SHA256
61480b43136b02965f59e3256b8de1bf35caa7c084a7bcb3ed5f4236451d4484

SHA512
82dac003d30eed4fc4e06ab4a426c9b7f355d777c243b710c5c0d3afc4c26d93874af2d0a542fca4a2038050b0d0fa8f63ed82e5f2771ae8a4de0f3b08d56d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB000.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB003.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\MSID358.tmp

Filesize
285KB

MD5
82d54afa53f6733d6529e4495700cdd8

SHA1
b3e578b9edde7aaaacca66169db4f251ee1f06b3

SHA256
8f4894b9d19bfe5d8e54b5e120cef6c69abea8958db066cdd4905cc78ecd58b6

SHA512
22476e0f001b6cf37d26e15dfb91c826c4197603ea6e1fbb9143c81392e41f18fa10a2d2d1e25425baaf754bff7fd179ef1df34966c10985e16d9da12a445150

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-core-file-l1-2-0.dll

Filesize
10KB

MD5
7d64aefb7e8b31292da55c6e12808cdb

SHA1
568c2a19a33bb18a3c6e19c670945630b9687d50

SHA256
62a4810420d997c7fdd9e86a42917a44b78fb367a9d3c0a204e44b3ff05de6d4

SHA512
68479da21f3a2246d60db8afd2ae3383a430c61458089179c35df3e25ca1a15eba86a2a473e661c1364613baa93dcb38652443eb5c5d484b571ab30728598f9b

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-core-file-l2-1-0.dll

Filesize
10KB

MD5
dcd09014f2b8041e89270fecd2c078b2

SHA1
b9f08affdd9ff5622c16561e6a6e6120a786e315

SHA256
6572965fd3909af60310db1e00c8820b2deef4864612e757d3babab896f59ed7

SHA512
ef2ac73100184e6d80e03ce5aa089dbddb9e2a52adf878c34b7683274f879dcf2b066491cfc666f26453acbd44543d9741f36369015bd5d07e36b49d435751f6

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-core-localization-l1-2-0.dll

Filesize
13KB

MD5
3979437d6817cdf82da474c8a1eefb0d

SHA1
5e96fe40993acbc7c2e9a104d51a728950ad872e

SHA256
3dd2e16b6f135cdd45bce4065f6493540ebbaf2f7f1553085a2442ea2cf80a10

SHA512
4f64c6d232fdae3e7e583cb1aa39878abbfbbc9466108b97a5dce089c35eb30af502b5b212b043c27c1b12b23c165bd2b559060c43d9e2efcdda777b34f0066b

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
4da67feefeb86b58a20b3482b93285b3

SHA1
6cd7f344d7ca70cf983caddb88ff6baa40385ef1

SHA256
3a5d176b1f2c97bca7d4e7a52590b84b726796191ae892d38ad757fd595f414d

SHA512
b9f420d30143cf3f5c919fa454616765602f27c678787d34f502943567e3e5dfb068fec8190fea6fa8db70153ed620eb4fe5dc3092f9b35b7d46b00cc238e3ba

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-core-synch-l1-2-0.dll

Filesize
11KB

MD5
c250b2e4ff04d22306bf8ce286afd158

SHA1
e5c60b7892ff64cbff02d551f9dbf25218c8195b

SHA256
42367b6b7285bddc185c0badefe49e883646f574b1d7d832c226f2d1ce489c5b

SHA512
a78c4ddf98330698c9da8d1d2c7c3176f22dfabf0900008cff1f294f56a2a14b52becd09ba37a065d544f58617911b3f5850614b5aabd0ec7daf236f29c9b10b

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
3339350008a663975ba4953018c38673

SHA1
78614a1aad7fc83d6999dcc0f467b43693be3d47

SHA256
4f77abb5c5014769f907a194fd2e43b3c977df1fb87f8c98dd15a7b950d1e092

SHA512
a303fd57dd59f478a8d6c66785768886509625a2baf8bf2b357bb249fc93f193ac8c5c2c9193e53738805700e49b941bf741d6c4850a43f29a82424ccdda191b

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-crt-convert-l1-1-0.dll

Filesize
14KB

MD5
392b572dc6275d079270ad8e751a2433

SHA1
8347bba17ed3e7d5c2491f2177af3f35881e4420

SHA256
347ceeb26c97124fb49add1e773e24883e84bf9e23204291066855cd0baea173

SHA512
dbdbd159b428d177c5f5b57620da18a509350707881fb5040ac10faf2228c2ccfd6126ea062c5dd4d13998624a4f5745ed947118e8a1220190fdb93b6a3c20b7

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
9806f2f88ba292b8542a964c0b102876

SHA1
c02e1541a264a04963add31d2043fa954b069b6b

SHA256
cf601a7b883bb4fb87c28b4a1d9f823d2454b298cdbcb4da4f508db8bd1278ba

SHA512
d68cb926de3caa498ad2aea60e2c5dbb72f30836a6ad9bb11a48f2ca706656981d9332dae44769ccf6f8de3b2ea1507983440afbe1322520f2fd1674cd8de823

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
12KB

MD5
1747189e90f6d3677c27dc77382699d8

SHA1
17e07200fc40914e9aa5cbfc9987117b4dc8db02

SHA256
6cc23b34f63ba8861742c207f0020f7b89530d6cdd8469c567246a5879d62b82

SHA512
d2cc7223819b9109b7ce2475dfb2a58da78d0d3d606b05b6f24895d2f05fb1b83ee4c1d7a863f3c3488f5d1b014cd5b429070577bd53d00bb1e0a0a9b958f0b1

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-crt-heap-l1-1-0.dll

Filesize
11KB

MD5
1bcb55590ab80c2c78f8ce71eadeb3dc

SHA1
8625e6ed37c1a5678c3b4713801599f792dc1367

SHA256
a3f13fa93131a17e05ad0c4253c34b4db30d15eae2b43c9d7ec56fdc6709d371

SHA512
d80374ec9b17692b157031f771c6c86dc52247c3298594a936067473528bbb511be4e033203144bbf2ec2acfd7e3e935f898c945eb864dcf8b43ae48e3754439

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
7481e20041cf8e366d737962d23ec9de

SHA1
a13c9a2d6cf6c92050eaae5ecb090a401359d992

SHA256
4615ec9effc0c27fc0cfd23ad9d87534cbe745998b7d318ae84ece5ea1338551

SHA512
f7a8e381d1ac2704d61258728a9175834cf414f7f2ff79bd8853e8359d6468839585cb643f0871334b943b0f7b0d868e077f6bd3f61668e54785ee8b94bf7903

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
047c779f39ebb4f57020cd5b6fb2d083

SHA1
440077fc83d1c756fe24f9fb5eae67c5e4abd709

SHA256
078d2551f53ca55715f5c6a045de1260ce331b97fd6d047f8455e06d97ef88dc

SHA512
95a57d79c47d11f43796aea8fd1183d3db9448dee60530144b64a2dd3cd863f5b413356076c26101d96dd007ebf8aff9e23cf721ba4e03d932c333b8e5536b73

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
16KB

MD5
10e9dfc88bf784847e7b9aab82e28d0c

SHA1
cb750cf87d561ca32f5860854da374dae6c9f2ad

SHA256
e6bab87156c9e7ae14ce36a754eb6891891a22ddfff584b706538152017fbb0f

SHA512
29c2edb44cada75ee8ccae1b55a405c8282c937450913196d54b6da1a1e121451c6e14a92a200574984961fa8c649d8a40caf58ea50a33d42a7dfae4439091c2

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
1f1d50aa4553e77f6b90ae13bd56a95c

SHA1
cf421a298f485c2a000791e1840ededeea19bad0

SHA256
d343529d2a49cbb89d644deafce573b873ab45e0bf57e2d906b2f2a964d7bd9a

SHA512
a08bdcc2883066a8bdb9336eec5c7f8593202c367ce75a7d7390ed4c6e0e1dbe80b7afadeee78f12ac0386d70ac360af12bf0ff3285acda0425789038951f180

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
fa5327c2a3d284385d8dc3d65935604b

SHA1
a878b7cdf4ad027422e0e2182dad694ed436e949

SHA256
704ad27cab084be488b5757395ad5129e28f57a7c6680976af0f096b3d536e66

SHA512
473ff715f73839b766b5f28555a861d03b009c6b26c225bc104f4aab4e4ea766803f38000b444d4d433ff9ea68a3f940e66792bae1826781342f475860973816

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\log4cplusU.dll

Filesize
471KB

MD5
0b03f7123e8bc93a38d321a989448dcc

SHA1
fc8bfdf092cdd6b9c1ec3b90389c035c37e50bd7

SHA256
a7fbfdb3100c164f139e9d0ebcf47282308e5173ab610dcb20a05b6e0615b54b

SHA512
6d00c65111c0f389ad189178705ed04712b2c6de8918f58de7c3747126a4b4e50b4a73525cc0993af02d35323b1430f34baf6f99712df822d6cdc63e24ed7ae5

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe

Filesize
7.2MB

MD5
dcebee7bb4e8b046b229edc10ded037f

SHA1
f9bdf0b478e21389800542165f721e5018d8eb29

SHA256
2eb0eefab534217953744c2cc36de2e1a1ced6ea882734e7b1f4b34a0b19689b

SHA512
9827600a19da5a816f1b0d93aa2629cb48f13f6e5fc42cd44bb1031ecd2e942854b34e7da44335acb85e42c44b1e720e9da8bc1d9ad23a9b1de0190f026f4d30

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\ucrtbase.dll

Filesize
1.1MB

MD5
126fb99e7037b6a56a14d701fd27178b

SHA1
0969f27c4a0d8270c34edb342510de4f388752cd

SHA256
10f8f24aa678db8e38e6917748c52bbcd219161b9a07286d6f8093ab1d0318fa

SHA512
d787a9530bce036d405988770621b6f15162347a892506ce637839ac83ac6c23001dc5b2292afd652e0804bd327a7536d5f1b92412697c3be335a03133d5fe17

Download Submit
\Program Files (x86)\COMODO\Endpoint Manager\vcruntime140.dll

Filesize
74KB

MD5
1a84957b6e681fca057160cd04e26b27

SHA1
8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

SHA256
9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

SHA512
5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

Download Submit
\Windows\Installer\MSID3C6.tmp

Filesize
203KB

MD5
d53b2b818b8c6a2b2bae3a39e988af10

SHA1
ee57ec919035cf8125ee0f72bd84a8dd9e879959

SHA256
2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2

SHA512
3aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e

Download Submit
memory/1628-5120-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/1904-5162-0x00000000004C0000-0x00000000004CA000-memory.dmp

Filesize
40KB

Download
memory/1904-5146-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/1904-5141-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/1904-5140-0x00000000004C0000-0x00000000004CA000-memory.dmp

Filesize
40KB

Download
memory/1904-5139-0x00000000004C0000-0x00000000004CA000-memory.dmp

Filesize
40KB

Download
memory/1904-5113-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/1904-5112-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/3008-5163-0x0000000003D80000-0x0000000003DCC000-memory.dmp

Filesize
304KB

Download