ba3cdc5190b44da96e5ecb5f39e2cbe3713984dc8062cdab679c759de51500b1

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

em_nrat4VVx_installer_Win7-Win11_x86_x64.msi
Size

94.2MB
MD5

f740670bd608f6a564366606e0bba8da
SHA1

c635e8453bf0f06c34d41d3319670e5dc966a5f4
SHA256

ba3cdc5190b44da96e5ecb5f39e2cbe3713984dc8062cdab679c759de51500b1
SHA512

88f1e800265e4e72f914e50240a6a7cca630ea4bcd6981be13237cc6f42b182741542b907737490a367453c179ace55fb64c3e0fb2cb6ecf1bace7a442458e0e
SSDEEP

1572864:SX+lBWb7cVOxi2CDRq/SUx6EIL2CjmFkm+pF7Vxo81MOL9vh12epl37cTLiAhRLh:nLYxsRq/76L2CjmCZpRXouxvD6LbhRHJ

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Endpoint Manager = "C:\\Program Files (x86)\\COMODO\\Endpoint Manager\\ITSMAgent.exe"	msiexec.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
6	1868	msiexec.exe
8	1868	msiexec.exe
13	1868	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	ITSMService.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\	ITSMService.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm\RemovalSecurity	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Esm	ITSMService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E455012CBF4BA8A2AC67618C00590908	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E455012CBF4BA8A2AC67618C00590908	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	ITSMService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	ITSMService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\distlib\wheel.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Hermosillo	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Ojinaga	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Pacific\Tahiti	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\abc.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\hex_codec.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\ComodRivadavia	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Resolute	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\ComboBox.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\EditorWindow.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\ReplaceDialog.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Atlantic\South_Georgia	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\ttk\utils.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\multiprocessing\pool.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tokenize.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\Catamarca	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Indian\Chagos	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\utils\filesystem.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\cp437.enc	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Barbados	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Pyongyang	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\distutils\dist.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\macosxSupport.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\cachecontrol\caches\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\demos\MkChoose.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\pref\pkgIndex.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\johab.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\pickletools.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\exceptions.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Brazil\Acre	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\distlib\wheel.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_map.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\gyp-0.1-py2.7.egg\gyp\common_test.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\SimpleXMLRPCServer.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tk8.5\ttk\scrollbar.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\BaseHTTPServer.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\quopri.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\UTC	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Mexico\BajaSur	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\mimetypes.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip-7.1.2.dist-info\RECORD	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\mac_latin2.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\multiprocessing\managers.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Argentina\Mendoza	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Asia\Bishkek	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\LabEntry.tcl	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp863.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\cp874.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Banjul	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\America\Jamaica	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\universaldetector.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\urllib3\connectionpool.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\nturl2path.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\encoding\macRoman.enc	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Africa\Harare	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Etc\GMT+6	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tix8.4.3\FileEnt.tcl	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\encodings\unicode_internal.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib-tk\Dialog.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\idlelib\__init__.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\lib2to3\fixes\fix_raw_input.py	python_x86_Lib.exe
File created	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\pip\_vendor\requests\packages\chardet\sjisprober.py	python_x86_Lib.exe
File opened for modification	C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\tcl8.5\tzdata\Pacific\Tarawa	python_x86_Lib.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIA6BC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA97C.tmp	msiexec.exe
File created	C:\Windows\Installer\e589efa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA11D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB102.tmp	msiexec.exe
File created	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\e589efc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7B6.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB074.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC5E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e589efa.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\wix{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA39.tmp	msiexec.exe

Executes dropped EXE 7 IoCs

pid	Process
1768	python_x86_Lib.exe
2712	ITSMService.exe
5840	ITSMAgent.exe
5924	ITSMAgent.exe
5972	ITSMAgent.exe
5800	RmmService.exe
5900	RmmService.exe

Loads dropped DLL 64 IoCs

pid	Process
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
660	MsiExec.exe
660	MsiExec.exe
660	MsiExec.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5924	ITSMAgent.exe
5924	ITSMAgent.exe
5924	ITSMAgent.exe
5924	ITSMAgent.exe
5924	ITSMAgent.exe
5924	ITSMAgent.exe
5972	ITSMAgent.exe
5972	ITSMAgent.exe
5972	ITSMAgent.exe
5972	ITSMAgent.exe
5972	ITSMAgent.exe
5972	ITSMAgent.exe
5924	ITSMAgent.exe
5972	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5972	ITSMAgent.exe
5972	ITSMAgent.exe
660	MsiExec.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5800	RmmService.exe
5800	RmmService.exe
5800	RmmService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1868	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python_x86_Lib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ITSMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RmmService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f7b83aff83bcb26e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f7b83aff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f7b83aff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df7b83aff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f7b83aff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 56 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ITSMService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	python_x86_Lib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	ITSMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ITSMService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	python_x86_Lib.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ITSMService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53\Blob = 03000000010000001400000040cef3046c916ed7ae557f60e76842828b51de5314000000010000001400000017d9d6252767f931c24943d93036448c6ca94feb040000000100000010000000886ea78b530e0fd5bda4e12527ab6a2c0f00000001000000300000005d2164164eb6f3820b9b8d7a5601b60ebf70d832d2029c6c3c966db107dfcb1ba12a25700f26ca3d5b36e4a6cb576cfa19000000010000001000000092a08f142bb795a2197a0d3c7af066f55c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001d0600003082061930820401a0030201020210137d539caa7c31a9a433701968847a8d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a308195310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313d303b060355040313345365637469676f20525341204f7267616e697a6174696f6e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a02820101009c930246454a524892fc578df92dea53beb32cd5d8a8a5ec5b6903c01d10f65933defe0748a8e88c7a674af1f58dc33766d03291f7c49d0460c4b54ae2838ba7ae26d45d3a5ef8d11671bb8abd71a27dc8cea26024b052a03a4551de78936c6260f1e4569cb73bf73c55d8dfd57a317c357f125170e12cbe04accbfa4fe17c656ac040a7d97ca5638419e1f7caefaab4e8585ad999e326df8e12b2b8dc33b236da141d965842406e0b22851c5122aec4c806456d92e667b71923e4d8366b85d07fc752e3cfb07501e089b4a8bf8a364ea3e06ceb8441cea52f482213975062451e09a5cc9f6c57704006db20e81bd6f3938ba7329eb7441509d7affd7c011cdb0203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e0416041417d9d6252767f931c24943d93036448c6ca94feb300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020230500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820201004e134096c9c3e66e5bc0e3baf417e1ae091fc9bfcb0c2516f27353b3761ab7ab4806d6cd007c204543456c165a1b1361d749baa402a4ace8cece2dc92a74a3dcdeaeabd06836f891af3c01f777d50bcf97abeb87e715a8fa305a617120b1c043c4b98f6d8a31eb153624fb62d50b9c8fe966bde661519793b61d87bdb0b56cfea6112906613431303d20277351d0de8583d37739204696daa7c65a162785b2cf4e0f4e8c5cbebe3800f84bf9727bd4f27ad7a22985d004bad3422c5188522ed13d246747ec55cc1bf4ca34ea26c1deddc42189f6ba7b321e8e965e844538cf80aa37698b6017741548919c6df04ea377ca1b1c48faf9cf49e85f4f850ae28f901bab704c9aebb7a63fb4ac5da45fcfe6d88a9690f74f268160765d0f247791b32a319f165ab25d8c1c29aa489c8e6fd3784070db77ecdde3d15705702de64998880584620570567686394ed3226f1dfe6df10eb362c43ccbc085b9611ebae1158059940cae05bb8c7f56be1cd25abf97f26a4cb0c67076b0908dc10b36b911d8d6285cea4ffe24b7180a9b0cd0c17c5cfb69bdcca24dc690bca64df2b1bad69a675b960252d082f9c40a5c0d28e03fc8fa959589d5a4be496c40b23ea86bb8d525b2c4fef1d3d7e7d6dc43017630fb3b8b5df74a897c9a35befccaf05701f08d3fa087327b475a974b82d266c2c42dea3f24f4a7f9a8b9e36ad91861a03b8c15	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\40CEF3046C916ED7AE557F60E76842828B51DE53	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ITSMService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ITSMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ITSMService.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30\DefaultFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\PackageName = "em_nrat4VVx_installer_Win7-Win11_x86_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDM\proxy = "false"	ITSMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductName = "Endpoint Manager Communication Client"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\ProductIcon = "C:\\Windows\\Installer\\{373FFE70-5FF7-492D-A2F4-0C6A15D8D503}\\icon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CDM	ITSMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\PackageCode = "D7076E96D3235814DB26ACC95D2BAD84"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Version = "151109272"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DD4D523EF099D7E42B1DBDFD40CF9061\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07EFF3737FF5D2942A4FC0A6518D5D30	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07EFF3737FF5D2942A4FC0A6518D5D30\AuthorizedLUAApp = "0"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
5840	ITSMAgent.exe
5924	ITSMAgent.exe
5972	ITSMAgent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1092	msiexec.exe
1092	msiexec.exe
2712	ITSMService.exe
2712	ITSMService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1868	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1868	msiexec.exe
Token: SeSecurityPrivilege	1092	msiexec.exe
Token: SeCreateTokenPrivilege	1868	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1868	msiexec.exe
Token: SeLockMemoryPrivilege	1868	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1868	msiexec.exe
Token: SeMachineAccountPrivilege	1868	msiexec.exe
Token: SeTcbPrivilege	1868	msiexec.exe
Token: SeSecurityPrivilege	1868	msiexec.exe
Token: SeTakeOwnershipPrivilege	1868	msiexec.exe
Token: SeLoadDriverPrivilege	1868	msiexec.exe
Token: SeSystemProfilePrivilege	1868	msiexec.exe
Token: SeSystemtimePrivilege	1868	msiexec.exe
Token: SeProfSingleProcessPrivilege	1868	msiexec.exe
Token: SeIncBasePriorityPrivilege	1868	msiexec.exe
Token: SeCreatePagefilePrivilege	1868	msiexec.exe
Token: SeCreatePermanentPrivilege	1868	msiexec.exe
Token: SeBackupPrivilege	1868	msiexec.exe
Token: SeRestorePrivilege	1868	msiexec.exe
Token: SeShutdownPrivilege	1868	msiexec.exe
Token: SeDebugPrivilege	1868	msiexec.exe
Token: SeAuditPrivilege	1868	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1868	msiexec.exe
Token: SeChangeNotifyPrivilege	1868	msiexec.exe
Token: SeRemoteShutdownPrivilege	1868	msiexec.exe
Token: SeUndockPrivilege	1868	msiexec.exe
Token: SeSyncAgentPrivilege	1868	msiexec.exe
Token: SeEnableDelegationPrivilege	1868	msiexec.exe
Token: SeManageVolumePrivilege	1868	msiexec.exe
Token: SeImpersonatePrivilege	1868	msiexec.exe
Token: SeCreateGlobalPrivilege	1868	msiexec.exe
Token: SeBackupPrivilege	5108	vssvc.exe
Token: SeRestorePrivilege	5108	vssvc.exe
Token: SeAuditPrivilege	5108	vssvc.exe
Token: SeBackupPrivilege	1092	msiexec.exe
Token: SeRestorePrivilege	1092	msiexec.exe
Token: SeRestorePrivilege	1092	msiexec.exe
Token: SeTakeOwnershipPrivilege	1092	msiexec.exe
Token: SeRestorePrivilege	1092	msiexec.exe
Token: SeTakeOwnershipPrivilege	1092	msiexec.exe
Token: SeBackupPrivilege	2828	srtasks.exe
Token: SeRestorePrivilege	2828	srtasks.exe
Token: SeSecurityPrivilege	2828	srtasks.exe
Token: SeTakeOwnershipPrivilege	2828	srtasks.exe
Token: SeBackupPrivilege	2828	srtasks.exe
Token: SeRestorePrivilege	2828	srtasks.exe
Token: SeSecurityPrivilege	2828	srtasks.exe
Token: SeTakeOwnershipPrivilege	2828	srtasks.exe
Token: SeRestorePrivilege	1092	msiexec.exe
Token: SeTakeOwnershipPrivilege	1092	msiexec.exe
Token: SeRestorePrivilege	1092	msiexec.exe
Token: SeTakeOwnershipPrivilege	1092	msiexec.exe
Token: SeRestorePrivilege	1092	msiexec.exe
Token: SeTakeOwnershipPrivilege	1092	msiexec.exe
Token: SeRestorePrivilege	1092	msiexec.exe
Token: SeTakeOwnershipPrivilege	1092	msiexec.exe
Token: SeRestorePrivilege	1092	msiexec.exe
Token: SeTakeOwnershipPrivilege	1092	msiexec.exe
Token: SeRestorePrivilege	1092	msiexec.exe
Token: SeTakeOwnershipPrivilege	1092	msiexec.exe
Token: SeRestorePrivilege	1092	msiexec.exe
Token: SeTakeOwnershipPrivilege	1092	msiexec.exe
Token: SeShutdownPrivilege	660	MsiExec.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1868	msiexec.exe
1868	msiexec.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe
5840	ITSMAgent.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
5840	ITSMAgent.exe
5924	ITSMAgent.exe
5972	ITSMAgent.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe
2712	ITSMService.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2828	1092	msiexec.exe	108
PID 1092 wrote to memory of 2828	1092	msiexec.exe	108
PID 1092 wrote to memory of 4380	1092	msiexec.exe	110
PID 1092 wrote to memory of 4380	1092	msiexec.exe	110
PID 1092 wrote to memory of 4380	1092	msiexec.exe	110
PID 1092 wrote to memory of 660	1092	msiexec.exe	111
PID 1092 wrote to memory of 660	1092	msiexec.exe	111
PID 1092 wrote to memory of 660	1092	msiexec.exe	111
PID 660 wrote to memory of 2860	660	MsiExec.exe	112
PID 660 wrote to memory of 2860	660	MsiExec.exe	112
PID 660 wrote to memory of 2860	660	MsiExec.exe	112
PID 2860 wrote to memory of 1768	2860	cmd.exe	114
PID 2860 wrote to memory of 1768	2860	cmd.exe	114
PID 2860 wrote to memory of 1768	2860	cmd.exe	114
PID 1768 wrote to memory of 3708	1768	python_x86_Lib.exe	115
PID 1768 wrote to memory of 3708	1768	python_x86_Lib.exe	115
PID 1768 wrote to memory of 3708	1768	python_x86_Lib.exe	115
PID 2712 wrote to memory of 5840	2712	ITSMService.exe	119
PID 2712 wrote to memory of 5840	2712	ITSMService.exe	119
PID 2712 wrote to memory of 5840	2712	ITSMService.exe	119
PID 2712 wrote to memory of 5924	2712	ITSMService.exe	120
PID 2712 wrote to memory of 5924	2712	ITSMService.exe	120
PID 2712 wrote to memory of 5924	2712	ITSMService.exe	120
PID 2712 wrote to memory of 5972	2712	ITSMService.exe	121
PID 2712 wrote to memory of 5972	2712	ITSMService.exe	121
PID 2712 wrote to memory of 5972	2712	ITSMService.exe	121
PID 2712 wrote to memory of 5800	2712	ITSMService.exe	129
PID 2712 wrote to memory of 5800	2712	ITSMService.exe	129
PID 2712 wrote to memory of 5800	2712	ITSMService.exe	129

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\em_nrat4VVx_installer_Win7-Win11_x86_x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3000,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
1⤵
PID:968

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AA69A111DD4834F295466DF604F56A48
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4380
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E09809C213441333F735E6BDBE4BEAEB E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:660
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe
      "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"
1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5840
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5924
- C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5972
- C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
  "C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe" --start
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5800

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5400

C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe
"C:\Program Files (x86)\COMODO\Endpoint Manager\RmmService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e589efb.rbs

Filesize
710KB

MD5
22b22358cd46365eb91d65faf35c9e7d

SHA1
f65a39994dbd3313df8162c9f33202681b0f2063

SHA256
03d68cbd22404ff7de79af726bde59c6d312d545e6271172da76cd10cbd87cec

SHA512
89c7f8a8cf1be0892ccf8ad970268a9bc673cebbbbe31453fe197d334bdc9063f5d681f08bd5f56b7209e7dd9164f2a3c1dc6897744fd06739142abc4f2672dd

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ApplicationManagement.dll

Filesize
87KB

MD5
25c603e78d833ff781442886c4a01fe6

SHA1
6808adc90eb5db03163103ec91f7bc58ee8aa6d0

SHA256
94afd301c1baa84b18e3b72d017b6a009145c16c6592891c92f50c127e55169e

SHA512
84e33be97d97ae341d74fc8273d191df519616f12bec8ac2f89454897c30a5f7bf9115f208c8dae78da83f0ca7bf9e5f07544d37d87b07f63408fbc91e449d54

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe

Filesize
3.0MB

MD5
a5b010d5b518932fd78fcfb0cb0c7aeb

SHA1
957fd0c136c9405aa984231a1ab1b59c9b1e904f

SHA256
5a137bfe1f0e6fc8a7b6957d5e9f10df997c485e0869586706b566015ff36763

SHA512
e0ca4b29f01f644ef64669ed5595965b853ae9eaa7c6c7d86df7634437041ef15ceb3c2d1ab9dec4171c80511684a7d7b06fc87b658e5a646699eb9523bc4994

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe

Filesize
8.4MB

MD5
6b4752088a02d0016156d9e778bb5349

SHA1
bd13b1f7b04e0fe23db6b3e4bd0aa91c810e1745

SHA256
f64f13bf19726624a9cbaedda03a156597737581d6bc025c24e80517f5cab011

SHA512
0fe982b0b551238fc881511cdd0656ee71f22aca3a5e83ef7ce41b3adf603f1be17ba3e2c10797ee3dfb5e15ff1ac3e8cf4e05c657e7c047f302f50baa42ba2d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Core.dll

Filesize
5.1MB

MD5
9356330cdf731eea1e628b215e599ce5

SHA1
88645c60b3c931314354d763231137a9ec650f1b

SHA256
ad045d1d084a88fe3f48c12aee48746b22cb3a579f9140840c54ae61f7af3478

SHA512
3d9ab9b1cdecad6809be96d82df2d1b9b8c9e1a7cf0ac79a820a92b11c8fa079f5a2c3875ba0b733503742c6977d6239ce22acec023a22038b2e7ee1ebd62d90

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Gui.dll

Filesize
5.2MB

MD5
d29d11da9f344f6d679a0de7b3174890

SHA1
b4cac4aa9c6b82e8d2d0c43991e8073261c13089

SHA256
079e3a248d169143a3d5da48d24dbcc0ce5fb8aaccbc02a6fce61c5fe2461b9f

SHA512
b43f2ef86d6fe4beb28a10e19834a4f76dbaddd071d16353b2641b72f2faa552a3bdba33a606da71a34ebb932f57dd142758b4a0a240231022c8bed8ee97cad6

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Network.dll

Filesize
1015KB

MD5
de150de21f1a2b72534eaa4aa4f03202

SHA1
39ed224cced1266d4adc5e68f6516979b8f52b33

SHA256
03871db7d626d14e84d8ebf007139aa2c08038cd3403ac6259f1a2eb01ae1477

SHA512
30eff193620724cda86e6de31c430f9d4426e677a553c7918f9b85dbfc67687acdecc2a29e45473666c01ce311b73833d9f79db8a93e80570c7ace8837ca531a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Sql.dll

Filesize
174KB

MD5
88aeafdcc3f3fa04b9b20022906745b0

SHA1
9dc03428234000d19bbc3cb437d370b8e1863329

SHA256
cd84c9c486c3e967ddd061718893ef5ee48eca24f77e3366b8fd3d2dd21f477f

SHA512
5ea87730f26b16215eb2b892a6da689524546ef6cfaf4e6c1f4e0afa083ceec3e8f00c9259d316d84ef4cb05b01023a1362b4a676d10b55e06ee365557ab7986

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Widgets.dll

Filesize
4.4MB

MD5
13f078d5c63cb192f68b45f5767a9e6f

SHA1
6149189a1553c2e0e6d715d3177c16c11af7d33a

SHA256
b0abf95a23e1616f3542a8cb794aac5b7463dff3db8621e3cd719ab1dd7f6226

SHA512
f3293fcdccb4901d4eb405706ad20da361140842a335e6f6a7ce54222fe028a1da2179be14ec40dbb5a1784ed5d33bd467174091606e6fcac12039dc0f48e52a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5Xml.dll

Filesize
163KB

MD5
4bac5e44b4b2f138f6608c661330dad0

SHA1
b08ff311b24d9bbc48d4014d7a0cd0de129a19e7

SHA256
59ba9deba38b1e652a046fd6b58847a58883f2d8c5c1e81acfa78d2daad98a1c

SHA512
74871aaaf8dc3fc006f7a1fdc42eabf5a86e34674d34362b2b00bdebe023d78fa0e6a5ef4676dc038178a6eeb01a0ba1676f68a1cc6828ac8d4ece550106ee0a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\Qt5XmlPatterns.dll

Filesize
2.2MB

MD5
e2749ff4266d5a933feb7685dfe375b2

SHA1
f09a432c67f45fc2ed27c762db4176b7dd47e908

SHA256
e4ee537b6a585ec7656afd9fc6fd3f655ff44bec6ff8ec291fc3e868caade27c

SHA512
4efc6b0b8d39b47d9c415fc3bc7460e4f738e3694fac691bf94569549569a8d65270a54488af3ae49de9fabdbe518250ceee83f6633e1da407636e6e02bac8bb

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\libcrypto-1_1.dll

Filesize
2.5MB

MD5
8f4ccd26ddd75c67e79ac60afa0c711f

SHA1
6a8b00598ac4690c194737a8ce27d1d90482bd8b

SHA256
ab7af6f3f78cf4d5ed4a2b498ef542a7efe168059b4a1077230a925b1c076a27

SHA512
9a52ac91876eea1d8d243c309dadb00dfae7f16705bde51aa22e3c16d99ccf7cc5d10b262a96cfbb3312981ac632b63a3787e8f1de27c9bb961b5be6ff2ba9f4

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\libssl-1_1.dll

Filesize
533KB

MD5
bf2cae7a6256b95e1ba1782e6a6c5015

SHA1
3fbdc3afa52673c7bdfab16b500bbe56f1db096b

SHA256
352d2fd16675855e20cc525b6376734933539b76bc4b40d679d3069008fe4cfc

SHA512
90755eb718ba404b0e48a6713d4680db252f8156328a58fc347e74d84b8bd53a7a6276755c672240c0e5d78200130e3ddf86990779ddd86c6d10cebf2bc02c9e

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\log4cplusU.dll

Filesize
471KB

MD5
0b03f7123e8bc93a38d321a989448dcc

SHA1
fc8bfdf092cdd6b9c1ec3b90389c035c37e50bd7

SHA256
a7fbfdb3100c164f139e9d0ebcf47282308e5173ab610dcb20a05b6e0615b54b

SHA512
6d00c65111c0f389ad189178705ed04712b2c6de8918f58de7c3747126a4b4e50b4a73525cc0993af02d35323b1430f34baf6f99712df822d6cdc63e24ed7ae5

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\msvcp140.dll

Filesize
426KB

MD5
8ff1898897f3f4391803c7253366a87b

SHA1
9bdbeed8f75a892b6b630ef9e634667f4c620fa0

SHA256
51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

SHA512
cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\proxy_settings.ini

Filesize
101B

MD5
273ec42863e3d9f999381f09c13d313b

SHA1
008d1954b2a7d1c692a697c891f9692f41f10481

SHA256
4dd2c699bbb8c398788067be6fc82edc68c8246b8f6765169776bb24ebd0c487

SHA512
940df3f73592ccabc27bf2cc77de98eade7eb8988d30144060c817eda614085e36eadb699b02123c63774416e827194c269acd1267fad1d560b7df86a79ed89b

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe

Filesize
7.2MB

MD5
dcebee7bb4e8b046b229edc10ded037f

SHA1
f9bdf0b478e21389800542165f721e5018d8eb29

SHA256
2eb0eefab534217953744c2cc36de2e1a1ced6ea882734e7b1f4b34a0b19689b

SHA512
9827600a19da5a816f1b0d93aa2629cb48f13f6e5fc42cd44bb1031ecd2e942854b34e7da44335acb85e42c44b1e720e9da8bc1d9ad23a9b1de0190f026f4d30

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\qdjango-db0.dll

Filesize
132KB

MD5
342249e8c50e8849b62c4c7f83c81821

SHA1
618aa180b34c50e243aefbf36bb6f69e36587feb

SHA256
07bc6eb017005500d39e2c346824eef79b3e06f60c46fb11572f98d4fe4083c5

SHA512
32a44252926881edf916ac517cb55d53b0b1b5adcc5952a674d1707d2c1431a68b27e593b4c4fcab0648e3cbeddf3d4e8024ff2a3385af9dbd2b2244e518340a

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
4d674fbc2f62ee0ba58b4362c7e2c751

SHA1
9a582c53415b0fed75b17a6eec2ea2c133d87d77

SHA256
db5550b565caf7eb13bfbd6073bbc197b575c0b5ba8a2afe5d8cf0b3d50f0a5d

SHA512
0913b86a4a0d13291fb2ddd7aae8c43e0829c78171b1aa5f4724076e7e8ea01f646d126cb4e971fbb3a5abfcbd3e5ecb2e8642dd0d96a2758b5b3ec32a93c3a5

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
4d818e49202a8df630ca20a5547c3488

SHA1
695442fd7e3e815acda331d2e8ca3a15c8f65c1e

SHA256
e2b0defc8c52ab5d7bd77b7c16ba7f9e49af4b2f8627f30dcdec2057538950ec

SHA512
2ccbd99810c9a2490cf884fbce0035f4024e082f824b24dfb2472f1014782a6ae9e1a22116df274fc579af2cf6dbcbf4a5fddcca6cb55671adae5e16e4e35096

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.1

Filesize
33KB

MD5
079a80e2175854f42919c9a49c5c6ecb

SHA1
d2763a6e03f08354ca03912a4bee689d0e914070

SHA256
090ea67e578fab52370c0fb3991385bfccc0b844b290bf79f946d80ffae6108f

SHA512
2a6958d5019b5037080c863c131c0d52d20a3c9c9d7d0675b47912dc0117b585e457741ca77fa5654613125e7a47a5a67215bb12ff29f63bbcecb0c8fc2e4122

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
32KB

MD5
e3dc98d92c1118ee444031d44f3b897e

SHA1
6c917dff47231ad934b5c22cedcab341dd8f2ce3

SHA256
bd79f738d64183acd2467694816c4ac12ddf787175ae8c400c4ae89fb8fa3385

SHA512
647f443d1684b53b4e566c1ef9782d0b8fb66216128025a413f37e580ee480081328b7912d9397a9eeb009546129ff41605d352d8841e94383afed6e16a500ab

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
6486c74a75118e62e61cc5debaeb9707

SHA1
40c6f7371f1adf2768404ff3e91fac8ed09be54b

SHA256
e4610ccc1bbb346fa869271a391a739ec89853197c3b32fed00f74b31240383b

SHA512
5bd5bfde97455201989d70d86e093b5af9e23d7bfbaf853d36d8388b709b76cacde795fac72bf6e8e4860c3e74fc7ff79bd3afb97f93e23c6718343d9e313cf1

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
3bdaaab23593cbfc0318d84a48e81529

SHA1
1b188f86ab00542e98f689dbf791824e9c6ac8a3

SHA256
10c8cedcc2022cdd2cbf2a2abd297292223d5c6053c937b70895eaa3b97800ae

SHA512
e44f93a3bd9f6cab9baed0127726b7e23d2cf2d9dd520bab7884ea0047ea04ea618f30b85fffba19fcc2528851a2dfe2fbdbf1a4f010f04240d46adfbb857fe9

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
c4c6ba8877d6e672a7998921b9a00a64

SHA1
40701c6061617fd4cfc64dbd6232034e5de330a0

SHA256
d022abdc542167dd34b8b0a22a2ddb3a9dceba2a2953f99bf080b3334fca6477

SHA512
e497e33da8a9f1d71a89afb1418962f349e42b34288a1b363910a7f7a5692141b8c39f3ba549c21fef22655a3f4aef5d0f9fde3f4569faa99232346cb369b2ef

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
2a650d237114293d43dde1ef7f0111b1

SHA1
8f876de4f9616840cc4161a56d9a38dbe42e08cc

SHA256
5f5aa7bba5c6988beafd70cf797573b757d1e73d81b110a4c4e349a006e991ba

SHA512
3cfe26e5f5d2005d775eed0e18f4caf6a62718d6828d03185652a27f1f92b5067da5175173e0874dae401358a42e32bf1bf40cbf3aaf6230e88d30e0332aa933

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
60d36b3e4094ef6b976764ee6df9a661

SHA1
91e911ac492cc77f3f39e35ff4cb18b3af734076

SHA256
0114635cad17b6bd9dfb6c8890a39675e37a403ec115ab9437004e57a184450c

SHA512
db35e76ae872406e1166f77a99afbc05d98de9298998ec469283e311a0b20af57e40392cc8357808db9845f4ad47eacfeec3f29d18bb0e4b8ee450eb93cf19d1

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
5079eb5056ea54e0fb25a5b114118184

SHA1
6313360c6521dd004d57e78f1f4760c4a8aa43af

SHA256
8709b083938bfded31c47c7413717eb3561bf703de377c2b578eb23bac33fdc5

SHA512
579428e6f34ccedfa77abd7f3fd440fb9f8fe4af2aef4de9ba9b18b94be6bcb6889b81745f827792bea10b9cd2921e54be9fd99b1d9e87909cc827c61c158278

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
3e96e7e69794948d6686823d6de9278f

SHA1
b5d894d40228911743a861519225bfed0f577106

SHA256
161d82c78563fc83126b8de102da775e12eb9a9f1d93ff3ee9dc083dff9d6bab

SHA512
7874d6c4fe0169e47fa89bd2c76f2dc8a221a47d15efe0e2b869e373c6549aaa4ca721cd57051f6dd2337b866fa5be9fd7c20cafe356205ec5c2f6e25b4c2456

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
eaf452e1445c93ae9dee7f4558fb7a14

SHA1
c4a8314c23658e11844e4c6135a6878a862e7024

SHA256
471f4f6fad0f4a0f6fdfb239bce4ccdc6495da6e6683ea4283ddc0233ebb3ca2

SHA512
0a7d7bf9ec68cec93af6ec30dc3839aab62a5d1b0f74094891fda81216d0c944aa9892b9ebfdfbfdff4b9466fc8cd274fdd520272673e74b36d2974b310f6ca4

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
9bedacea76304a7457087b1e5e0a3fcf

SHA1
b0be476d5eae8e67343ee7dd5aff344350267bef

SHA256
104656e3a63c5599a27a49abefe66f5f2573824e18ef478f936762db03a15031

SHA512
8948d0a8e7e76523ad49917eb40161ebad0e6ac0e58e0322fc13b4f98c5c0de6ff5d962c8827d1f1e89babd8a2ce1b0e7c769d5cf94e64f1c5530abaefd2b4a3

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
518316d943fe1473eeec7c3e373ab331

SHA1
dac2afe6dc8d94f05d99aa131dac71664d451fcb

SHA256
55d55c54cf1badf38a4155ca08a3d1b28feb1afe245e55ba79299ccd4d655754

SHA512
3ba0725eb7e8994630a216399cebee2957a05a2e3de48f293d641cc4dc25c10225daa09befefa8589d55c2f422c285585c2979819873114430acfcbe3565c81e

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
245ec93fed6bc469cd8a9be4d9fc056c

SHA1
1802d2f94c4d9b323e4fb65b298754e764d47ac5

SHA256
d2eb79050873df2aa0ea73980fd530259d0a5af5d59a0feeab32e1392cdf746f

SHA512
435dbb20fd797d1e4e86831aa245324d491d47b5f42101cf035304b375a93696de1db0a85c2c63b041a480e845fed1b1fb26e1fcb041d9ffc7b2665a53342266

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
d41d8d3943782706b89b10de373d10b5

SHA1
0ba103640726008c5cb49ec1e0235ed413643347

SHA256
5e1dbca3d4585856e5432914836ea8d6e4489bd30541753bbec0b211a74939ef

SHA512
099ccf0a1d6754a3362fc85fbfb53cb3ef9198d5d8e038ddd39d510287f6b7d6682fffd013e2ac9ba7469f6ca6372c7f62cfe7da06ed109a38a88a75b168dde8

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
393b0466824042c57cc62ec34eadcdab

SHA1
608c300c0712627578a7425af73eb80b87c07608

SHA256
f8651147c1656ce5ab84deac8e065cb47cdc28e1d21966700ad027b5859a15b9

SHA512
b85982c890c33b15c4954e3c7b4b338558f478f8d7f91350a064234e68eddd757a060e3e47d6619f27fc5f5ba852f2757ade89d2a275c9bcff2bf8b972b3e301

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
595f52889776b611804b77ce558ce8a5

SHA1
a9fa226fc72fa404899146d5b5ce62e39947cbcd

SHA256
3acc9e806cbfda75c098fb5dcf0438011a4a7a8992b507a5a3c01e14e2b11b1d

SHA512
fce4e8ddf2484712c7c63355988e3d01fa0007abff43b3fc7ad14a5c28d3de1d673da422a849f108f15d259f6e8150c8134a065091a172398cc5cbf9af79c02b

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
a2cfa2d7e9c5b924f7d0b1901fa04c9e

SHA1
f19f2373cd35f28af2857549d726923c1bb6cbff

SHA256
2207f6ab0fd975c06b1a42d6597e090103c8bd77f2157e5f400d4ae9e030753e

SHA512
1e9f895d2ae463496941cc0f8238aa22ea6860ca88c076106d33a17df14bc8cfbc63dbfbb8b52e47be70a8577770733a337bbb74fa6c8946204cc40401c0aa23

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
0d5a68e9afb91e9d55bfb5ea8087f33b

SHA1
e1c949d0c1c939910dc719237b035fec8baee49c

SHA256
4238655531a3c9c8eff2ad4a741970b708e0dcd07dc0451fba5486602c56149b

SHA512
663a832d0ec57dc389cedbb08c39b45b7d7661a51c9dcba50dd0f37b682465e3938c0b0ceff429c288a39fd7f91c050ca35f69aec4814c6730c1ba83f8e724a5

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
cd1b89cc3352bec9df354dbf43fd9865

SHA1
aec3383c0d1864a5da23dbce8db2fa5884e4a1b9

SHA256
09e61a448ee77ac61b69dced01284d6a0ea715802ede70ae2036b9b900a6e021

SHA512
40d7025323b8375822d04e7933ab8bcf8a858058eaa97ba6459fe4130333b7eca3eb4fc772e7f47ee8b8518b04ef269dc6b6d076f85537ef0ad87d5f93a1f3e6

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
9ba76690b8f33d41b75c67661a524b72

SHA1
49ed3f2bf576fa392d84a336d57228b9ebd175fb

SHA256
95e24ac63f7904089f7c2af877c05b5a28fe2112b0595b06fd9d60cc5f99b2e6

SHA512
51fcb9c1eb90a7a69b1f4a97505b1fe8d4ef597ce9c23aad1e53b1b1d9aea01aa50b39bf601f8c014e731950c0b5bfdf5b5f5f37862c6d8f0870e831aba25ec7

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
e61aa9ea74a9dd2119b4966d4cdac597

SHA1
05110dae068e30d8a48629ae1456b183756a6a04

SHA256
02cb28970eb35ce2d1255492991032df4fac245638edf691a3b9efd2e56613cf

SHA512
2aad6e303b58f2037a2d73bd531aa52209d1d93682cd8905cbacb155faf4327e676ace4ff3f5b91a71da6904be6931e4a550318002b3e4b51af71e31f9ea52e7

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
29d04ae2233845f95eb11687d4788106

SHA1
c6447dccfce4f5b92e55666a1f515ccc399b4685

SHA256
c82439b8e28b11b96b47042d82e120e8f429c959ed8690ba2b984a0d9d24be23

SHA512
6510356c31201bd819e10dd782bc9913b455d68801478059e4af758bbb3c0144fdf59245bccd4ac208010aa294065c5ab44a8797420585b83f05fe0a3f9e9822

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
7b2f4277fd1b84fefe4b13057f5626c8

SHA1
f47619028cde82b659080f0929b93ca6d1a3bbb8

SHA256
3e1d3e8b450d58793418a5917aeebcff4e9d20d2145384905a8e6cda4e80f346

SHA512
cdb22873867c6226e5919868adf5aed9feea7f4c5fd24352438fc96e121cef154647990fe35fff0b5142be36438d1de0d3429e0434e5ea0db544e734c149f08b

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmlogs\Rmm_Proxy_dll.log.4

Filesize
33KB

MD5
4c66cb30c32f92d49ef26c6c68d66ce5

SHA1
86977058a26fd5c037ceb2c98c4565dd9fe79d39

SHA256
7112ea9897e599a22d5a6519aa3a8f6d70af6f5909cdea9c0aae9140dbccd21a

SHA512
1a56ca9fd0eb0b1d86c331aa963d58c4eb63364f1d82d37e998d09c57f7c40a7b15a387dcebd6b61fdd0c83467a41fa92c2d2a6691bbaf98c9b316c82dc9f494

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\rmmproxy.dll

Filesize
154KB

MD5
84c848ca734892ea2e8ab90d84317ee3

SHA1
a1b38d4f1b466061481bdfde7628139c908f7ee5

SHA256
01c53abd5585992f9d62de40f4750899829b9e7e4a026b8d9f5d1cb1748a3fa9

SHA512
cec124435d6d4c76497e7886ca317a0c12a9d8e77200ba94cf6a699b318b91cb4db886eba5a5161941a7dd349f827cd3694abb864d6e37a9084a208276bee7df

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\sqldrivers\qsqlite.dll

Filesize
1.1MB

MD5
d9d7b0d7386cd57e4301d57cb7294b4b

SHA1
dcf385b8d3f9f99a07e1b7757508e5e4080f336c

SHA256
a4ee1bc55369a13b3e721aa48e44de31c6f00439838e923ab7a66438fbab4002

SHA512
e1568ce01edd46aabc795dd4eacab565ffc8dc0271129b5aa770f3763fba756a5de59aa4329510e65282bb19537874c6f307712a7fa2b6971f50dbee7b2664d7

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\token.ini

Filesize
8B

MD5
e1af0beb5efede7a536fb01e1060ec8a

SHA1
a33094f43c62804582eb336b9554936a441d690a

SHA256
10ed776d811173fc545766dfb892b18fa9b0b7f061685927d99543650ea8ecc8

SHA512
f1bdc44c297eba1115061e468e7835ceb47f6c3d1e60b69ce00a2dd1e99172d20d4780371b57f53567c1489cc5b0129748ddd91b390e0cd7f92cd2b45df70d23

Download Submit
C:\Program Files (x86)\COMODO\Endpoint Manager\vcruntime140.dll

Filesize
74KB

MD5
1a84957b6e681fca057160cd04e26b27

SHA1
8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

SHA256
9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

SHA512
5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
765B

MD5
0838a8204d4780f9f23ddd29e923a5f0

SHA1
975428f0c85c49be63c816a179def6b8a2388d90

SHA256
323d0350b7114cd1a2bb038dec2539e47fc60b183b89cad6cb2b50c7784520a8

SHA512
b8dcc34f6c1428bd3d12a5bd31bc8a5c87f4d16c51f73dd54eb73a1cffcc07d0113e918f5b4a9c40987901cd8f7f446867c9669126d84ac59697c0b9846d9f80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

Filesize
637B

MD5
76073e3449b1689314bc364bb5c4280a

SHA1
926aacca371e49acc069917a843fd9875ba5113f

SHA256
7fb5f20d4d7c437c9fcd105988dd2f48923e16166ca4bd60e765a66758623381

SHA512
af712029c81f492c0fd64ca4cfa9d4e38987af6007808a4c939d5eea05fc57800be5ea3173637f6a703f1e9ddb819c1e8a5098f926bece546252054235e075b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
1KB

MD5
75706d22cefe7f2618d31cff0bf616e5

SHA1
9ea2793506559b4d6283fad1e417ce4f4ef9230d

SHA256
26432ef46726510d348e0f10236a1aa3c37450435bbe8fd24401e217a236e0df

SHA512
65ec0433df7499c71b9671cadfed5f158d21e0e88f0c386153880eebc8c2d374a0964247e6e3b5e84378a46da4d73bb4bff17ecc10c144c6715ea63b70280e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
484B

MD5
06228ec2591ed5c93ce0057c7d26d056

SHA1
634becf46c7bd1c63c97d783b31b66c34707e7e8

SHA256
a1fdccbc65dd4944a2e331d85c1f2d4bbf34f1fc2e41cf7aaa3faa8378dde7a8

SHA512
63b386b10bc0c7816ec2725f698337718bf3410205fb29542900a1fcff7cb46db101b018ffef84f4da2c662d6c20e2b4c759f259118dbc8aa1a15a2f318ceb0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_D7025277F003EE88ED342C67F3525784

Filesize
480B

MD5
f8f98ee256992f64b57c4cbeb0b4790a

SHA1
b48336cb82111f881baabf9949e9ccae33982ef7

SHA256
66843429138953e093ebc36d55961b7b70512d433c68d9a4baf4bd131d8757a2

SHA512
e3d05a060248ef38042b0bbea9b679635c873de8e4f55f3768a44e4a55d9bf42dc81c14fc76680daa24d6799f9ad4d5975e5620a6ec03e43bb72969a0eedbe94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
482B

MD5
35a0329f8ec706537cbf96775432afbd

SHA1
08bbe450b181b0364c2d351a22291217f26f6e55

SHA256
3d1458d65069da759aa5e1e2b2dc1b8b8c39e01027668545ada6f1172ae7f4aa

SHA512
ece299892c4a87a8998552318dd084ad331feeda419ea2cc4644bb44f0705b2bcb7e3ffa4bb6a14da0f76cc3a5a706c3b91b462ff41da523712f35dda33d0a77

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
226B

MD5
feceaa82323f9de4d3578592d22f857d

SHA1
4c55c509e6d16466d1d4c31a0687ededf2eabc9a

SHA256
61480b43136b02965f59e3256b8de1bf35caa7c084a7bcb3ed5f4236451d4484

SHA512
82dac003d30eed4fc4e06ab4a426c9b7f355d777c243b710c5c0d3afc4c26d93874af2d0a542fca4a2038050b0d0fa8f63ed82e5f2771ae8a4de0f3b08d56d45

Download Submit
C:\Windows\Installer\MSIA11D.tmp

Filesize
285KB

MD5
82d54afa53f6733d6529e4495700cdd8

SHA1
b3e578b9edde7aaaacca66169db4f251ee1f06b3

SHA256
8f4894b9d19bfe5d8e54b5e120cef6c69abea8958db066cdd4905cc78ecd58b6

SHA512
22476e0f001b6cf37d26e15dfb91c826c4197603ea6e1fbb9143c81392e41f18fa10a2d2d1e25425baaf754bff7fd179ef1df34966c10985e16d9da12a445150

Download Submit
C:\Windows\Installer\MSIA6BC.tmp

Filesize
203KB

MD5
d53b2b818b8c6a2b2bae3a39e988af10

SHA1
ee57ec919035cf8125ee0f72bd84a8dd9e879959

SHA256
2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2

SHA512
3aaf8b993c0e8f8a833ef22ed7b106218c0f573dcd513c3609ead4daf90d37b7892d901a6881e1121f1900be3c4bbe9c556a52c41d4a4a5ec25c85db7f084d5e

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
e715103c8247529c52f12ae23c86ae40

SHA1
c192c40817e39cc5fe336c21cf231d2f44d17a80

SHA256
fd72ef88b6a7e7b8859ea451dc9be19edf505d9b1e351bcb19f7376c95b5aa90

SHA512
fb49957fdc5db7ebf5877a6311e5dfd16b28238609b15de143472c2b9cef78dce8468621d85e5d7416561191211d6edb73675fd37d5e355699b36e6f9238acdc

Download Submit
\??\Volume{ff3ab8f7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c92c6c5a-2441-4f37-adc1-3756855f2cff}_OnDiskSnapshotProp

Filesize
6KB

MD5
3f289f8be3f5728481244c4778cb3c9b

SHA1
3560163b6eff68b375e0865c7371c39734eb84b7

SHA256
f6e5bbcba188c6fa78adab032d3c96138eea46c9c46e1273d4c74c3a103963a4

SHA512
e1c8e3ca379e25ef11c75424fa931e6fda2236c7387d7161e3e7513659f29a80cb2905ba820d126e9efc4bdc8a279d26a04b88a60f715f6123082afccf4492e3

Download Submit