33633ef8abb63a5ed8bcd1cf78e90f80438bb0236afe59714bfff83d73410428

Analysis

max time kernel
118s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup1.vbs
Size 1KB
Sample260723-w22phahn4x
SHA256 33633ef8abb63a5ed8bcd1cf78e90f80438bb0236afe59714bfff83d73410428
MD5 0112c726a741f3351dcd1872ad6aa013
SHA1 7f9f98f388abdc938fc0c2d162233b93c822b809
SHA512 a2d1e96fe4f73772743e0f64d392515dccd124526fcd69c8607be71842bd95b8c184c58547c2f10f124ed1f9cdbb10466ecde7a2076b6d2ddd1f22630d9d1ac0
TLSH
T15431251B99644A07D4D2C65321F37C5C9F7A6A57000882B735A9DC9883D83639F5F237
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 31 IoCs

pid	Process
3848	dcagentregister.exe
2852	7za.exe
4548	dcagentservice.exe
5044	dcrdservice.exe
4576	dcstatusutil.exe
3708	dcinventory.exe
4828	dcagentservice.exe
3232	dcusbsummary.exe
3648	dcconfig.exe
4712	metroapps.exe
4300	dcusb64.exe
1776	dcstatusutil.exe
3392	dcondemand.exe
2688	dcswmeter.exe
2600	dcinventory.exe
3332	dcconfig.exe
2752	dcinventory.exe
1908	DCProcessMonitor.exe
2460	mdmregistrationhandler_64.exe
4656	dcwolsettings.exe
5484	dcondemand.exe
5492	dcagenttrayicon.exe
5548	dcagenttrayicon.exe
5840	dcondemand.exe
5968	7za.exe
2640	7za.exe
312	7za.exe
6008	7za.exe
3760	7za.exe
820	7za.exe
5448	7za.exe

Loads dropped DLL 58 IoCs

pid	Process
2380	MsiExec.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
4548	dcagentservice.exe
4548	dcagentservice.exe
5044	dcrdservice.exe
5044	dcrdservice.exe
4576	dcstatusutil.exe
4576	dcstatusutil.exe
4576	dcstatusutil.exe
3708	dcinventory.exe
3708	dcinventory.exe
4828	dcagentservice.exe
4828	dcagentservice.exe
3232	dcusbsummary.exe
3232	dcusbsummary.exe
3708	dcinventory.exe
4712	metroapps.exe
4712	metroapps.exe
4712	metroapps.exe
3648	dcconfig.exe
3648	dcconfig.exe
3648	dcconfig.exe
1776	dcstatusutil.exe
1776	dcstatusutil.exe
3392	dcondemand.exe
3392	dcondemand.exe
3392	dcondemand.exe
2688	dcswmeter.exe
2688	dcswmeter.exe
2600	dcinventory.exe
2600	dcinventory.exe
1776	dcstatusutil.exe
3392	dcondemand.exe
3392	dcondemand.exe
3332	dcconfig.exe
3332	dcconfig.exe
2752	dcinventory.exe
2752	dcinventory.exe
2752	dcinventory.exe
3332	dcconfig.exe
4656	dcwolsettings.exe
5492	dcagenttrayicon.exe
5492	dcagenttrayicon.exe
5484	dcondemand.exe
5484	dcondemand.exe
5484	dcondemand.exe
5548	dcagenttrayicon.exe
5548	dcagenttrayicon.exe
5484	dcondemand.exe
5484	dcondemand.exe
5840	dcondemand.exe
5840	dcondemand.exe
5840	dcondemand.exe
5840	dcondemand.exe
5840	dcondemand.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1216	msiexec.exe
7	1216	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Power Settings 1 TTPs 5 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4708	powercfg.exe
1288	powercfg.exe
3100	powercfg.exe
4952	powercfg.exe
5192	powercfg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	dcinventory.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22B32.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22BE6.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29DF9.tmp	omadmclient.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D734EC268DFD451C5CDE81AFDEC6411C6A90C565	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29AE3.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29B85.tmp	svchost.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	dcinventory.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22B0E.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22BE7.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22BE5.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29BBA.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22B8C.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\CRLs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29839.tmp	omadmclient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29C40.tmp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CM2B4C0.tmp	omadmclient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22BB0.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D734EC268DFD451C5CDE81AFDEC6411C6A90C565	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29B44.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22BD4.tmp	svchost.exe
File created	C:\Windows\SysWOW64\dcagenthttp.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF	dcinventory.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22B7B.tmp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CM292B6.tmp	omadmclient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29BA6.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22BAF.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29B95.tmp	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	dcagentregister.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	dcinventory.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\PushRouter\unauthmessages	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29588.tmp	omadmclient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29C0D.tmp	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log	dcagenttrayicon.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CM249C2.tmp	omadmclient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM2584B.tmp	omadmclient.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CM29809.tmp	omadmclient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22B69.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM231A6.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29953.tmp	omadmclient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29C3F.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29AB0.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29C41.tmp	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	dcagentregister.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	dcagentregister.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22B1E.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22B1F.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM2585B.tmp	omadmclient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29C62.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29C63.tmp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CM29839.tmp	omadmclient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29BA7.tmp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CM2AE94.tmp	omadmclient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22B6A.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22B9E.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM292B6.tmp	omadmclient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29C2E.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29C51.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Request\CTLs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29567.tmp	omadmclient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29AB1.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29B13.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM29BCB.tmp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\CM22B44.tmp	svchost.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4176	WScript.exe
5036	wscript.exe
4948	cscript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\wsClientSocket.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-security-setting.json	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz1052.tmp	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\hot_mover.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Warning_icon.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler64.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rdsrunasuser.exe.config	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwol.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\secaddoncrashanalyser.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf	dcinventory.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_devsummaryAcccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentupgrade.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcfilteraccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcollectionstatusaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\otp-lock.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\close_top_hover.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\messagebox_warning.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemandtasks.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\usbeDevicelist.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_user.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchdownloadaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log	DCProcessMonitor.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-winxp.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rapchat.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log	dcstatusutil.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvData\InventoryPost.data	dcinventory.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\antivirus_list.conf	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_rejected.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\invite.rgn	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dc_cad.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\file_system_watcher.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml1052.tmp	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\WakeOnLan.exe.config	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcscreenrec.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\systeminfo.log	cmd.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\UserAssignmentRules.json	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz1052.tmp	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ImageFactoraccess.log	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\secaddoncrashanalyser.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfservicedll.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcipscope.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcondemandaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientSocket.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf	dcinventory.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log	dcondemand.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\boundary-list.xml	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dropdown_hover.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcconfigexec.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcfilteraccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentslotrequest.log	dcstatusutil.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_troubleshooting_tool.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UIControls.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchdownloadaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\computer.log	dcconfig.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\e585d9c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e585d9d.mst	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}	msiexec.exe
File opened for modification	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json	dcagentregister.exe
File opened for modification	C:\Windows\Tasks\DCAgentUpdater.job	dcagentregister.exe
File opened for modification	C:\Windows\Installer\MSI6462.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6964.tmp	msiexec.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json	dcagentregister.exe
File created	C:\Windows\Tasks\DCAgentUpdater.job	dcagentregister.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID138.tmp	msiexec.exe
File created	C:\Windows\Installer\e585d9c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e585d9d.mst	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e585da4.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
420	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 8 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F0FF466E7A9CA9AAE59DBC9507090889B4F7DA21\Blob = 030000000100000014000000f0ff466e7a9ca9aae59dbc9507090889b4f7da21200000000100000029040000308204253082030da00302010202087b7c9525f964634a300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303631313038323630305a180f32313236303631313038323630305a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b9077558e05bd9e671d90ece54b0ffdc979cef42281cf5310a0d957fccd20fc5201712bac3ac9f7af1c17439c19305ef96e8d68340eb435713a1170d5d18b5962df0de7e8b7d2e9fff49686284182c867a1567d4f1a647218061646dd641bd5ec0b295bec55c50f779e6b02327a1f580cca306893d817aa8fc979c02d294a98588564ecb71d8540ba499f70cdd7316604d5d02fcaa9d5fb966f5a792699b5ecb43cb8d9b80f392771805a5150a6f875d3a35c41d3ba81269c64c06e9c8711ba792bd2a5a2b6359cb7df6fb96ddd9d578b756d42c22ca4fd0ce8a0e17f74c8072bd20a71586a8e1869f1aadff627c4924117678450e7565bfeee7c7239b8410350203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0301f0603551d23041830168014fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101001185242bf4008fd96814aeaf76d0bc97f05dcc438ba22e2f08c0bcf788afba3c965e463e1fc82a8492703b2b7000defb0b47fd331608593d7909e0040ae640fa89dcc2ec1a903a6272c691ba773f59875f63bed8dd94ed1a5869cfd177de2016f4a53fef06bae7997d49ee4d6c6699316fafeb143efa1700359b80865fc7f0bc26d9533996734308538352f25a3bc96b13cbd5ff4233a80559220e5846391201b5a8466bf817f737f4510d1512d1b4d43244b55666d2c8f6f999f1f42e5896cff936dc756f44a6bd13d9b39c794ba895c3e860514712ccff0d4803a49cca2c004e042977f0a70e7274cbf4efbfd424cb2913aff22545dfd898db7580a467c60d	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F0FF466E7A9CA9AAE59DBC9507090889B4F7DA21\Blob = 140000000100000014000000fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0030000000100000014000000f0ff466e7a9ca9aae59dbc9507090889b4f7da210f000000010000002000000033cc9f849733c66a8ebc240509eef379195829f0eaa456ca7adaff8112a57751200000000100000029040000308204253082030da00302010202087b7c9525f964634a300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303631313038323630305a180f32313236303631313038323630305a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b9077558e05bd9e671d90ece54b0ffdc979cef42281cf5310a0d957fccd20fc5201712bac3ac9f7af1c17439c19305ef96e8d68340eb435713a1170d5d18b5962df0de7e8b7d2e9fff49686284182c867a1567d4f1a647218061646dd641bd5ec0b295bec55c50f779e6b02327a1f580cca306893d817aa8fc979c02d294a98588564ecb71d8540ba499f70cdd7316604d5d02fcaa9d5fb966f5a792699b5ecb43cb8d9b80f392771805a5150a6f875d3a35c41d3ba81269c64c06e9c8711ba792bd2a5a2b6359cb7df6fb96ddd9d578b756d42c22ca4fd0ce8a0e17f74c8072bd20a71586a8e1869f1aadff627c4924117678450e7565bfeee7c7239b8410350203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0301f0603551d23041830168014fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101001185242bf4008fd96814aeaf76d0bc97f05dcc438ba22e2f08c0bcf788afba3c965e463e1fc82a8492703b2b7000defb0b47fd331608593d7909e0040ae640fa89dcc2ec1a903a6272c691ba773f59875f63bed8dd94ed1a5869cfd177de2016f4a53fef06bae7997d49ee4d6c6699316fafeb143efa1700359b80865fc7f0bc26d9533996734308538352f25a3bc96b13cbd5ff4233a80559220e5846391201b5a8466bf817f737f4510d1512d1b4d43244b55666d2c8f6f999f1f42e5896cff936dc756f44a6bd13d9b39c794ba895c3e860514712ccff0d4803a49cca2c004e042977f0a70e7274cbf4efbfd424cb2913aff22545dfd898db7580a467c60d	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AABAAE765985C3E84DC83C86E357041657F74D37\Blob = 140000000100000014000000bb1919f7a4fbe9bea36da34565eaf42bdf08d868030000000100000014000000aabaae765985c3e84dc83c86e357041657f74d370f000000010000002000000064024d920862786cea0ffa177ff73449425cc1aaf7b531d7dbe5d9edce07f5c32000000001000000af030000308203ab30820293a00302010202087f8550312f533e53300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303631313038323335315a180f32313236303631313038323335315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ee8637410c24343e7fcf5687132f91de20785b40629aaf0bcef87f7f8e0078e387178352d92b8d68411f69b0897ffe111cf59ac8cc4d92a9ce861df08d65af9a4e95517e9066de1a6c68845bceee39d6a3303096b925c7074776421509c61b274b1bb3b9d0f9f8bc1d2acb87d533ec62eb62d3942bea375218dafe3f49484387f270f66568c9b88d01dfb4fce598f171a15e88c5c7b19989ae5547d306763ff20e8c8fa8935c6232a059a15c8d4a295ae45035d4678fb6d991c7642a14b4b0037ef1196deb87a4af8e32dbc75972ada39e28d67a61d56079d22004f3ade4567e7fa47bcbcbd13525a13de0986bc9175f879aa90da602716b9adc52eba7fe17c90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414bb1919f7a4fbe9bea36da34565eaf42bdf08d868301f0603551d23041830168014bb1919f7a4fbe9bea36da34565eaf42bdf08d868300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b7cdc531522b00864f0fc0193c2868d7f767359153068c9f78e66d5822492f4d793037abae38fd34f58e298db8c3822e89d95149cd8a7b0f8ca05f807894cc81b5856c04d36933a5938cba1a26dbd984ace5f84f777f2c650d27ac2f257324fced2ccdd53ceaf55542c8139d0e7252ff9b4ede44c78e7c78ba2d98e584f82fe2aebeb93ffcc55c4daf016f8517bd55978702129a66ae0c387b7b638b1ed02bed845c845ae6ae7961c68ccc05fa9cc9f24290da3e0fe162fc26b0e9096e2617f77436c792de6b1714836fc11e1f8425c6be9f07010f38aa2cecb2248bde17440aa02f2bd15cf3a15726990e1168fcc8f5fefc436d483c6b0060413095fe65d51f	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AABAAE765985C3E84DC83C86E357041657F74D37\Blob = 040000000100000010000000b050d6913b886f2b32072897773768360f000000010000002000000064024d920862786cea0ffa177ff73449425cc1aaf7b531d7dbe5d9edce07f5c3030000000100000014000000aabaae765985c3e84dc83c86e357041657f74d37140000000100000014000000bb1919f7a4fbe9bea36da34565eaf42bdf08d8682000000001000000af030000308203ab30820293a00302010202087f8550312f533e53300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303631313038323335315a180f32313236303631313038323335315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ee8637410c24343e7fcf5687132f91de20785b40629aaf0bcef87f7f8e0078e387178352d92b8d68411f69b0897ffe111cf59ac8cc4d92a9ce861df08d65af9a4e95517e9066de1a6c68845bceee39d6a3303096b925c7074776421509c61b274b1bb3b9d0f9f8bc1d2acb87d533ec62eb62d3942bea375218dafe3f49484387f270f66568c9b88d01dfb4fce598f171a15e88c5c7b19989ae5547d306763ff20e8c8fa8935c6232a059a15c8d4a295ae45035d4678fb6d991c7642a14b4b0037ef1196deb87a4af8e32dbc75972ada39e28d67a61d56079d22004f3ade4567e7fa47bcbcbd13525a13de0986bc9175f879aa90da602716b9adc52eba7fe17c90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414bb1919f7a4fbe9bea36da34565eaf42bdf08d868301f0603551d23041830168014bb1919f7a4fbe9bea36da34565eaf42bdf08d868300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b7cdc531522b00864f0fc0193c2868d7f767359153068c9f78e66d5822492f4d793037abae38fd34f58e298db8c3822e89d95149cd8a7b0f8ca05f807894cc81b5856c04d36933a5938cba1a26dbd984ace5f84f777f2c650d27ac2f257324fced2ccdd53ceaf55542c8139d0e7252ff9b4ede44c78e7c78ba2d98e584f82fe2aebeb93ffcc55c4daf016f8517bd55978702129a66ae0c387b7b638b1ed02bed845c845ae6ae7961c68ccc05fa9cc9f24290da3e0fe162fc26b0e9096e2617f77436c792de6b1714836fc11e1f8425c6be9f07010f38aa2cecb2248bde17440aa02f2bd15cf3a15726990e1168fcc8f5fefc436d483c6b0060413095fe65d51f	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AABAAE765985C3E84DC83C86E357041657F74D37\Blob = 190000000100000010000000633960e020b8567a4c8dcc5d3d6016bf140000000100000014000000bb1919f7a4fbe9bea36da34565eaf42bdf08d868030000000100000014000000aabaae765985c3e84dc83c86e357041657f74d370f000000010000002000000064024d920862786cea0ffa177ff73449425cc1aaf7b531d7dbe5d9edce07f5c3040000000100000010000000b050d6913b886f2b32072897773768362000000001000000af030000308203ab30820293a00302010202087f8550312f533e53300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303631313038323335315a180f32313236303631313038323335315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ee8637410c24343e7fcf5687132f91de20785b40629aaf0bcef87f7f8e0078e387178352d92b8d68411f69b0897ffe111cf59ac8cc4d92a9ce861df08d65af9a4e95517e9066de1a6c68845bceee39d6a3303096b925c7074776421509c61b274b1bb3b9d0f9f8bc1d2acb87d533ec62eb62d3942bea375218dafe3f49484387f270f66568c9b88d01dfb4fce598f171a15e88c5c7b19989ae5547d306763ff20e8c8fa8935c6232a059a15c8d4a295ae45035d4678fb6d991c7642a14b4b0037ef1196deb87a4af8e32dbc75972ada39e28d67a61d56079d22004f3ade4567e7fa47bcbcbd13525a13de0986bc9175f879aa90da602716b9adc52eba7fe17c90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414bb1919f7a4fbe9bea36da34565eaf42bdf08d868301f0603551d23041830168014bb1919f7a4fbe9bea36da34565eaf42bdf08d868300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b7cdc531522b00864f0fc0193c2868d7f767359153068c9f78e66d5822492f4d793037abae38fd34f58e298db8c3822e89d95149cd8a7b0f8ca05f807894cc81b5856c04d36933a5938cba1a26dbd984ace5f84f777f2c650d27ac2f257324fced2ccdd53ceaf55542c8139d0e7252ff9b4ede44c78e7c78ba2d98e584f82fe2aebeb93ffcc55c4daf016f8517bd55978702129a66ae0c387b7b638b1ed02bed845c845ae6ae7961c68ccc05fa9cc9f24290da3e0fe162fc26b0e9096e2617f77436c792de6b1714836fc11e1f8425c6be9f07010f38aa2cecb2248bde17440aa02f2bd15cf3a15726990e1168fcc8f5fefc436d483c6b0060413095fe65d51f	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AABAAE765985C3E84DC83C86E357041657F74D37\Blob = 5c000000010000000400000000080000040000000100000010000000b050d6913b886f2b32072897773768360f000000010000002000000064024d920862786cea0ffa177ff73449425cc1aaf7b531d7dbe5d9edce07f5c3030000000100000014000000aabaae765985c3e84dc83c86e357041657f74d37140000000100000014000000bb1919f7a4fbe9bea36da34565eaf42bdf08d868190000000100000010000000633960e020b8567a4c8dcc5d3d6016bf2000000001000000af030000308203ab30820293a00302010202087f8550312f533e53300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303631313038323335315a180f32313236303631313038323335315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ee8637410c24343e7fcf5687132f91de20785b40629aaf0bcef87f7f8e0078e387178352d92b8d68411f69b0897ffe111cf59ac8cc4d92a9ce861df08d65af9a4e95517e9066de1a6c68845bceee39d6a3303096b925c7074776421509c61b274b1bb3b9d0f9f8bc1d2acb87d533ec62eb62d3942bea375218dafe3f49484387f270f66568c9b88d01dfb4fce598f171a15e88c5c7b19989ae5547d306763ff20e8c8fa8935c6232a059a15c8d4a295ae45035d4678fb6d991c7642a14b4b0037ef1196deb87a4af8e32dbc75972ada39e28d67a61d56079d22004f3ade4567e7fa47bcbcbd13525a13de0986bc9175f879aa90da602716b9adc52eba7fe17c90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414bb1919f7a4fbe9bea36da34565eaf42bdf08d868301f0603551d23041830168014bb1919f7a4fbe9bea36da34565eaf42bdf08d868300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b7cdc531522b00864f0fc0193c2868d7f767359153068c9f78e66d5822492f4d793037abae38fd34f58e298db8c3822e89d95149cd8a7b0f8ca05f807894cc81b5856c04d36933a5938cba1a26dbd984ace5f84f777f2c650d27ac2f257324fced2ccdd53ceaf55542c8139d0e7252ff9b4ede44c78e7c78ba2d98e584f82fe2aebeb93ffcc55c4daf016f8517bd55978702129a66ae0c387b7b638b1ed02bed845c845ae6ae7961c68ccc05fa9cc9f24290da3e0fe162fc26b0e9096e2617f77436c792de6b1714836fc11e1f8425c6be9f07010f38aa2cecb2248bde17440aa02f2bd15cf3a15726990e1168fcc8f5fefc436d483c6b0060413095fe65d51f	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F0FF466E7A9CA9AAE59DBC9507090889B4F7DA21\Blob = 1900000001000000100000009c5bfd79a56938bb1adca01dad6ca3eb0f000000010000002000000033cc9f849733c66a8ebc240509eef379195829f0eaa456ca7adaff8112a57751030000000100000014000000f0ff466e7a9ca9aae59dbc9507090889b4f7da21140000000100000014000000fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0200000000100000029040000308204253082030da00302010202087b7c9525f964634a300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303631313038323630305a180f32313236303631313038323630305a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b9077558e05bd9e671d90ece54b0ffdc979cef42281cf5310a0d957fccd20fc5201712bac3ac9f7af1c17439c19305ef96e8d68340eb435713a1170d5d18b5962df0de7e8b7d2e9fff49686284182c867a1567d4f1a647218061646dd641bd5ec0b295bec55c50f779e6b02327a1f580cca306893d817aa8fc979c02d294a98588564ecb71d8540ba499f70cdd7316604d5d02fcaa9d5fb966f5a792699b5ecb43cb8d9b80f392771805a5150a6f875d3a35c41d3ba81269c64c06e9c8711ba792bd2a5a2b6359cb7df6fb96ddd9d578b756d42c22ca4fd0ce8a0e17f74c8072bd20a71586a8e1869f1aadff627c4924117678450e7565bfeee7c7239b8410350203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0301f0603551d23041830168014fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101001185242bf4008fd96814aeaf76d0bc97f05dcc438ba22e2f08c0bcf788afba3c965e463e1fc82a8492703b2b7000defb0b47fd331608593d7909e0040ae640fa89dcc2ec1a903a6272c691ba773f59875f63bed8dd94ed1a5869cfd177de2016f4a53fef06bae7997d49ee4d6c6699316fafeb143efa1700359b80865fc7f0bc26d9533996734308538352f25a3bc96b13cbd5ff4233a80559220e5846391201b5a8466bf817f737f4510d1512d1b4d43244b55666d2c8f6f999f1f42e5896cff936dc756f44a6bd13d9b39c794ba895c3e860514712ccff0d4803a49cca2c004e042977f0a70e7274cbf4efbfd424cb2913aff22545dfd898db7580a467c60d	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AABAAE765985C3E84DC83C86E357041657F74D37\Blob = 030000000100000014000000aabaae765985c3e84dc83c86e357041657f74d372000000001000000af030000308203ab30820293a00302010202087f8550312f533e53300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303631313038323335315a180f32313236303631313038323335315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ee8637410c24343e7fcf5687132f91de20785b40629aaf0bcef87f7f8e0078e387178352d92b8d68411f69b0897ffe111cf59ac8cc4d92a9ce861df08d65af9a4e95517e9066de1a6c68845bceee39d6a3303096b925c7074776421509c61b274b1bb3b9d0f9f8bc1d2acb87d533ec62eb62d3942bea375218dafe3f49484387f270f66568c9b88d01dfb4fce598f171a15e88c5c7b19989ae5547d306763ff20e8c8fa8935c6232a059a15c8d4a295ae45035d4678fb6d991c7642a14b4b0037ef1196deb87a4af8e32dbc75972ada39e28d67a61d56079d22004f3ade4567e7fa47bcbcbd13525a13de0986bc9175f879aa90da602716b9adc52eba7fe17c90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414bb1919f7a4fbe9bea36da34565eaf42bdf08d868301f0603551d23041830168014bb1919f7a4fbe9bea36da34565eaf42bdf08d868300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b7cdc531522b00864f0fc0193c2868d7f767359153068c9f78e66d5822492f4d793037abae38fd34f58e298db8c3822e89d95149cd8a7b0f8ca05f807894cc81b5856c04d36933a5938cba1a26dbd984ace5f84f777f2c650d27ac2f257324fced2ccdd53ceaf55542c8139d0e7252ff9b4ede44c78e7c78ba2d98e584f82fe2aebeb93ffcc55c4daf016f8517bd55978702129a66ae0c387b7b638b1ed02bed845c845ae6ae7961c68ccc05fa9cc9f24290da3e0fe162fc26b0e9096e2617f77436c792de6b1714836fc11e1f8425c6be9f07010f38aa2cecb2248bde17440aa02f2bd15cf3a15726990e1168fcc8f5fefc436d483c6b0060413095fe65d51f	dcagentregister.exe

System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	metroapps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcondemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCProcessMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcondemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcswmeter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagenttrayicon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcwolsettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagenttrayicon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcondemand.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcstatusutil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcstatusutil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcrdservice.exe

Checks SCSI registry key(s) 3 TTPs 50 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0020	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0020	powercfg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0003	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002	powercfg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	powercfg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0002	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0003	powercfg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0002	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0020	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0100	powercfg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E	powercfg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E	powercfg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0003	powercfg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0020	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0100	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0002	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0003	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0100	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0002	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	powercfg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0100	powercfg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	powercfg.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1512	systeminfo.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	mdmregistrationhandler_64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	mdmregistrationhandler_64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dcondemand.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CImmersiveControlPanel%5Cresources.pri\1d5acde2d018dbc\a37dfe62\@{C:\Windows\ImmersiveControlPanel\resources.pri?ms-resource://windows.immersivecontrolpanel/resources/DisplayNam = "Settings"	metroapps.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcondemand.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mdmregistrationhandler_64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcondemand.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcstatusutil.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "44C40189C3AA44442AA780ED114A0026"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "167772210"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F0FF466E7A9CA9AAE59DBC9507090889B4F7DA21	dcagentregister.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AABAAE765985C3E84DC83C86E357041657F74D37	dcagentregister.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe
3848	dcagentregister.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4708	powercfg.exe
Token: SeCreatePagefilePrivilege	4708	powercfg.exe
Token: SeShutdownPrivilege	1288	powercfg.exe
Token: SeCreatePagefilePrivilege	1288	powercfg.exe
Token: SeShutdownPrivilege	3100	powercfg.exe
Token: SeCreatePagefilePrivilege	3100	powercfg.exe
Token: SeShutdownPrivilege	4952	powercfg.exe
Token: SeCreatePagefilePrivilege	4952	powercfg.exe
Token: SeShutdownPrivilege	4952	powercfg.exe
Token: SeCreatePagefilePrivilege	4952	powercfg.exe
Token: SeShutdownPrivilege	1540	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1540	msiexec.exe
Token: SeSecurityPrivilege	1216	msiexec.exe
Token: SeCreateTokenPrivilege	1540	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1540	msiexec.exe
Token: SeLockMemoryPrivilege	1540	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1540	msiexec.exe
Token: SeMachineAccountPrivilege	1540	msiexec.exe
Token: SeTcbPrivilege	1540	msiexec.exe
Token: SeSecurityPrivilege	1540	msiexec.exe
Token: SeTakeOwnershipPrivilege	1540	msiexec.exe
Token: SeLoadDriverPrivilege	1540	msiexec.exe
Token: SeSystemProfilePrivilege	1540	msiexec.exe
Token: SeSystemtimePrivilege	1540	msiexec.exe
Token: SeProfSingleProcessPrivilege	1540	msiexec.exe
Token: SeIncBasePriorityPrivilege	1540	msiexec.exe
Token: SeCreatePagefilePrivilege	1540	msiexec.exe
Token: SeCreatePermanentPrivilege	1540	msiexec.exe
Token: SeBackupPrivilege	1540	msiexec.exe
Token: SeRestorePrivilege	1540	msiexec.exe
Token: SeShutdownPrivilege	1540	msiexec.exe
Token: SeDebugPrivilege	1540	msiexec.exe
Token: SeAuditPrivilege	1540	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1540	msiexec.exe
Token: SeChangeNotifyPrivilege	1540	msiexec.exe
Token: SeRemoteShutdownPrivilege	1540	msiexec.exe
Token: SeUndockPrivilege	1540	msiexec.exe
Token: SeSyncAgentPrivilege	1540	msiexec.exe
Token: SeEnableDelegationPrivilege	1540	msiexec.exe
Token: SeManageVolumePrivilege	1540	msiexec.exe
Token: SeImpersonatePrivilege	1540	msiexec.exe
Token: SeCreateGlobalPrivilege	1540	msiexec.exe
Token: SeRestorePrivilege	1216	msiexec.exe
Token: SeTakeOwnershipPrivilege	1216	msiexec.exe
Token: SeRestorePrivilege	1216	msiexec.exe
Token: SeTakeOwnershipPrivilege	1216	msiexec.exe
Token: SeRestorePrivilege	1216	msiexec.exe
Token: SeTakeOwnershipPrivilege	1216	msiexec.exe
Token: SeRestorePrivilege	1216	msiexec.exe
Token: SeTakeOwnershipPrivilege	1216	msiexec.exe
Token: SeRestorePrivilege	1216	msiexec.exe
Token: SeTakeOwnershipPrivilege	1216	msiexec.exe
Token: SeRestorePrivilege	1216	msiexec.exe
Token: SeTakeOwnershipPrivilege	1216	msiexec.exe
Token: SeRestorePrivilege	1216	msiexec.exe
Token: SeTakeOwnershipPrivilege	1216	msiexec.exe
Token: SeRestorePrivilege	2852	7za.exe
Token: 35	2852	7za.exe
Token: SeSecurityPrivilege	2852	7za.exe
Token: SeSecurityPrivilege	2852	7za.exe
Token: SeDebugPrivilege	3232	dcusbsummary.exe
Token: SeRestorePrivilege	1216	msiexec.exe
Token: SeTakeOwnershipPrivilege	1216	msiexec.exe
Token: SeRestorePrivilege	1216	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3232	dcusbsummary.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 5036	4176	WScript.exe	85
PID 5036 wrote to memory of 4708	5036	wscript.exe	86
PID 5036 wrote to memory of 1288	5036	wscript.exe	88
PID 5036 wrote to memory of 3100	5036	wscript.exe	90
PID 5036 wrote to memory of 4952	5036	wscript.exe	92
PID 5036 wrote to memory of 1540	5036	wscript.exe	94
PID 1216 wrote to memory of 2380	1216	msiexec.exe	97
PID 1216 wrote to memory of 3848	1216	msiexec.exe	102
PID 3848 wrote to memory of 2852	3848	dcagentregister.exe	104
PID 3848 wrote to memory of 420	3848	dcagentregister.exe	110
PID 420 wrote to memory of 1512	420	cmd.exe	112
PID 3848 wrote to memory of 4576	3848	dcagentregister.exe	114
PID 3848 wrote to memory of 3708	3848	dcagentregister.exe	116
PID 4828 wrote to memory of 3232	4828	dcagentservice.exe	119
PID 4828 wrote to memory of 3648	4828	dcagentservice.exe	120
PID 3708 wrote to memory of 4712	3708	dcinventory.exe	122
PID 3232 wrote to memory of 4300	3232	dcusbsummary.exe	123
PID 4828 wrote to memory of 1776	4828	dcagentservice.exe	126
PID 4828 wrote to memory of 3392	4828	dcagentservice.exe	127
PID 4828 wrote to memory of 2688	4828	dcagentservice.exe	129
PID 4828 wrote to memory of 2600	4828	dcagentservice.exe	132
PID 4828 wrote to memory of 3332	4828	dcagentservice.exe	136
PID 3332 wrote to memory of 2752	3332	dcconfig.exe	142
PID 4828 wrote to memory of 1908	4828	dcagentservice.exe	148
PID 3332 wrote to memory of 2460	3332	dcconfig.exe	156
PID 3332 wrote to memory of 4656	3332	dcconfig.exe	171
PID 3332 wrote to memory of 4948	3332	dcconfig.exe	172
PID 4948 wrote to memory of 5192	4948	cscript.exe	175
PID 3388 wrote to memory of 5316	3388	svchost.exe	176
PID 4828 wrote to memory of 5484	4828	dcagentservice.exe	178
PID 3332 wrote to memory of 5492	3332	dcconfig.exe	179
PID 3332 wrote to memory of 5548	3332	dcconfig.exe	181
PID 4828 wrote to memory of 5840	4828	dcagentservice.exe	182
PID 3332 wrote to memory of 5968	3332	dcconfig.exe	184
PID 3332 wrote to memory of 2640	3332	dcconfig.exe	188
PID 3332 wrote to memory of 312	3332	dcconfig.exe	190
PID 3332 wrote to memory of 6008	3332	dcconfig.exe	193
PID 3332 wrote to memory of 3760	3332	dcconfig.exe	195
PID 3332 wrote to memory of 820	3332	dcconfig.exe	200
PID 3332 wrote to memory of 5448	3332	dcconfig.exe	202

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\setup1.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\setup1.vbs" /elevated
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /change standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /change standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /change hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3100
- - C:\Windows\System32\powercfg.exe
    "C:\Windows\System32\powercfg.exe" /hibernate off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1540

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6604C3C6AAC23F3CB856BE790E22A50C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2380
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
    3⤵
    - Drops file in Program Files directory
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:420
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo.exe
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:1512
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:4576
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
    bin\dcinventory.exe -i postinstallation 0 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
      metroapps.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      PID:4712

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4548

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5044

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:4300
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  7 0 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3648
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
  bin\dcstatusutil.exe RequestAgentSlotFromServer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:1776
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3392
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2688
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2600
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  3 0 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
    bin\dcinventory.exe -p processor compatibility
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:2752
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exe
    mdmregistrationhandler_64.exe -u "Admin" "https://202.61.160.183:8443/mdm/client/v1/enroll?encapiKey=c8d351a1&templateToken=d7ef04bbc2bef9e91c6d37b0aef693d6&action=discover" "7731" "8b2258ca"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2460
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwolsettings.exe
    bin\dcwolsettings.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4656
- - C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\cscript.exe DisableEnableEthernet.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg -devicequery wake_from_any
      4⤵
      Power Settings
      System Location Discovery: System Language Discovery
      Checks SCSI registry key(s)
      PID:5192
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
    dcagenttrayicon.exe -r
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:5492
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
    dcagenttrayicon.exe -s
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5548
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5968
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2640
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:312
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6008
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3760
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:820
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5448
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh
    3⤵
    PID:2164
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 9ff13e98-156a-40a8-a2f0-1966149487e5 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip" -c acp -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ApplicationControl-metadata.json" -a 1
      4⤵
      PID:3220
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip"
        5⤵
        
        PID:3032
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"
        5⤵
        
        PID:5724
      - C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"
        6⤵
        
        PID:4712
        
        C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\dcprocmon.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\dcprocmon.exe"
        7⤵
        
        PID:5756
        
        C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
        
        33 0 0
        7⤵
        
        PID:1304
        
        C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\ACPipelogServer.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\ACPipelogServer.exe"
        7⤵
        
        PID:5216
        
        C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe"
        7⤵
        
        PID:5220
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe
  DCProcessMonitor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1908
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:5484
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:5840

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WManSvc
1⤵
- Drops file in System32 directory
PID:3724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s dmwappushservice
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\system32\omadmprc.exe
  "C:\Windows\system32\omadmprc.exe"
  2⤵
  PID:5316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3436

C:\Windows\system32\deviceenroller.exe
C:\Windows\system32\deviceenroller.exe /o "CD0CAA1F-67FC-49F8-A25B-20D75600706B" /c
1⤵
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s EntAppSvc
1⤵
PID:5000

C:\Windows\system32\omadmclient.exe
C:\Windows\system32\omadmclient.exe
1⤵
PID:544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p
1⤵
PID:2864

C:\Windows\system32\DeviceEnroller.exe
C:\Windows\system32\deviceenroller.exe
1⤵
PID:632

C:\Windows\system32\omadmclient.exe
C:\Windows\system32\omadmclient.exe /serverid "CD0CAA1F-67FC-49F8-A25B-20D75600706B" /lookuptype 1 /initiator 0
1⤵
- Drops file in System32 directory
PID:5348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WManSvc
1⤵
- Drops file in System32 directory
PID:4216

C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys"
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e585da0.rbs

Path C:\Config.Msi\e585da0.rbs
Size 58KB
SHA256 f9414ac665d00cdec3d7b615c0445c18cc512699a96bbcdd8ca03716ac77b5b6
MD5 4d9d587cbee5d5a06abe01f3e11a3885
SHA1 2859c0415354e2d1e7765e1cedbf5515731e685a
SHA512 c953eb2b9c1bc7aaca0ceee419c98fb828019aaabedb4d841a69c19cc233d9745231244b2b6b5215b4e1498855aa91e17359f3e989e8a592ed19702cb62db05f
SSDEEP 768:qYOamH6jx6gZiypDO+uT0K2J1bQbGJVAadathiOVbm:JBsCx6xeDO+M2GcAaai2bm
TLSH
T101436266DB26E2CBD1151AF733826D1806094C7B66F0C43E1318AD3BD4DBA457EBF868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585da5.rbs

Path C:\Config.Msi\e585da5.rbs
Size 546B
SHA256 a60ff1e52764f0eeb1fc6fdeac0a82b5e30c736f842e609cd8d7e2e6d0a3f158
MD5 cfaa5aa9e1d3a3f00b7fac755b9ef0e7
SHA1 9892b292b2e15cf753be710abc09185425f44412
SHA512 b74c936f684488c50df1eab529591ae5449ea96d3f7bc6302bd4760db92a76e7db3a2b4b42f81615c28605f21a6a80ed0759977feea33d1539ad984e405d84a0
TLSH
T135F09E93A70845D2D6A06E3613436F451A3FE53AA15447792D846638AD2630A5EFF0CC
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

7za.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
Size 802KB
SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
MD5 8f57948e69c82bf98704f129c5460576
SHA1 33e277af0cea397252c23d310961f803be5cdf2b
SHA512 628cf68c9436721b874a87e1bff711d3b6fe5d4bd9b02411890059a7d32078a9592fc48e6e53761d17bdbd72c5eb66593b841470157a3e8b38f0b67525d73bc9
SSDEEP 24576:L48I9t/zu2QSM0TMzOCkY+we/86W5gXKxZ5:Le71MzuiehWIKxZ
TLSH
T1C9059E22BAE5D07BD2421132CA1C7BF591F9976D0B2048C763808F6D7B359D1DA3AE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAuthHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
Size 2.3MB
SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
MD5 2843aac7409fc7e54722c6238342f660
SHA1 3e40879eacf10473127386816c24e0cf245410f6
SHA512 f8a6e689f3b0c6761aa84f29d717d192fc0b34767a06d551a3937827a95f0cf740baada2a151b4ef6138a0fa626a93c94d45e34c235de63e265cebf32c9e70c2
SSDEEP 49152:8P5i/uH8WK6WK0Lh8tRjd4b39T9+LoSaEYLUzSPrBsFwZkmTbk8iE8phYhlJFxI:8P5i/uH8WK6WK0WtRU9TAodE0UzirBsH
TLSH
T17CB5BF23EA808032E4CE053692FD5BB65D3E9A10132CA9D3ABD53DB45E755E2663C34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Bold.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
Size 250KB
SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
MD5 a2fb219c999a8fa6b95ad7c24890072e
SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
TLSH
T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Medium.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
Size 245KB
SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
MD5 cecc32d267ee07ce3413637314b66ca0
SHA1 627b584f88033791f427091fff74c9310bdc2ef1
SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
TLSH
T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_binaries.7z

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
Size 14.6MB
SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
MD5 b26cb94e52dd0688c3a77b46e883f084
SHA1 27692088d8f3d321a6f9afb39395f6109f0469e9
SHA512 9823343c9c341b3a9c07ad9b3c89ec9c2efc8ea31f3937cfccd3c03724494ebddcd83a53a383087d2cc8e4aedff1e64aa7bcd76fc7d6a28fec4c6309bbd19311
SSDEEP 393216:FT+EJ+ygjrEhL2oJ/3u6xC/9HI7T3ebuRgzPNK:FT+U+nQhL2oJ/jI/WXeiKk
TLSH
T15FF633E9B4828A4BC5C889B0C64681C4E1CE41B5DC9A6CB6D5B167BFD3DA8C714DB3F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca-certs.zip

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
Size 160B
SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
MD5 7fe1c49c6da9570331515a2d300642e3
SHA1 13c824b889876a1ae1e94faeed430185329df502
SHA512 9de0c421861be17aa0e32ee5a3b603be946f075bb7178e7ee40d8b8639bedd3761e88114dfddc4aa0ab5ae20d6adfae5535b7205b8fa3674e6e8aaad27a0fb7a
TLSH
T1A0C0122AC1CA24F0EF077FB6B05613A34D0CC1FB020386570C4690401F81EAD8D2C406
MD5 SHA1 SHA512 TLSH

Submit Download

cfgUpdate.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
Size 62KB
SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
MD5 8e3d3fe805da01bc5abb251f2fb58705
SHA1 8adc16a8e417cfe1130c3b3e40495ea977374fdf
SHA512 8e742dc4122c3971f3a0175f648647ba0630fb87d0c1a415c5cd38178643a07a0e2e9ca5e360b3e1de530dba5ba323aa963de9daf204bb0ab19afaa38372311a
SSDEEP 768:KuhPgdGgqsgO0JRCXwvtLqhjgiWmZhSX0P+4EDsXnqmpif52TZaZTAMxkEYg:KuhP+dgv0AvUjymZhSEPF4k4xH
TLSH
T167537B27B390C432D462197458A9C2725E7B79620BF8D6C77788037E4FB13D0AEB935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cold_normal_msghldr.gif

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
Size 536B
SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
MD5 60f77c64f9c8a86fd24c8e64c20e009e
SHA1 e9299102aa662027b9e46246a5847074444ec1fd
SHA512 972afa85faba00ad96efad4951ec92ed90e60175dd80a388328c708975df2871655d8ae31ea750d60298ab1514c1a4b53b3b0304d5ace6118b4fea320c075f33
TLSH
T12BF075C0B546067A64170F3544351D4502476D06A57CA33ACC50FCDCD67E220B0229A7
MD5 SHA1 SHA512 TLSH

Submit Download

dcagentregister.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
Size 92KB
SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
MD5 2978f0ceba230877a2476d3d99739518
SHA1 a16ae5aa1bb6017d2732ee5cced1ede9b091816e
SHA512 5e8ccd699315e23ccc94b4541d568815f88ffc5736c39bdc29d4dc9c3dce3e8ee1b9c70e9f28d980b5433f5bc10d49658b13dc2e8947a415e45d1e4153001cc5
SSDEEP 1536:APLaK7cLtLWedH8rwkrsofXR1BjDrl7E2zzi0FNLGpxLzH:T66trH4wW3RE2zzieLGDT
TLSH
T1ED938E227690C032E456597468ACCA725E7FBD215BB8C4C77788477B1FA03C0AF7A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
Size 1.2MB
SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
MD5 9c1ac952bdfee44fed1ecf7165808e12
SHA1 8fee062be189b641b0ffcbbb7287697b9be16cae
SHA512 bb9720f816a1833769d083079a75913c7aef9a103c3edca122ff151acd94cfb586b3b8303720d305807f72f28c6370bf80d478c5a0e6beb734384a89e344685b
SSDEEP 24576:QSTpNU+Po5KeKA66v9cskz0LIU6iUKLO7N7EqyyF6FmR0OqZC0uNZtSTHytb0Dk:Q2F1ec5zu9LOx7yyF6FmR0OqTi+TStgw
TLSH
T13B559E22D7428031E7E200B7C57A86BAA938AB75131190E3E3D45DE85AEC5D17E3F25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcinventory.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
Size 2.0MB
SHA256 8e35a7064793a56a8d6f1e08050fa588571c8898f5bcea4f78228cf343ce5016
MD5 5956882d71ddb032bc14ce667b700d9e
SHA1 74224f6a2948baeab354e2e2a7e687ab6a65877d
SHA512 f7230ec387f95ab5aff516771b11ca00475adf460a293308a4dd9206a1ef2fc4a462c647ad8a4b0696209b7ed19e303c84667ff85bb2b4a06f4d4e90c15d5f6d
SSDEEP 49152:oc41Ly9rwBXp10lrzBSnwX0cLP65eP8Txvkd/TgVI3cYKNpe:ey96iSnwXpLP65Lvkdnco
TLSH
T137A57D11A742C437E5B304F6C97D86BE5438B930172490C3B3C42DAD9BF99D27A36A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcrdservice.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdservice.exe
Size 2.6MB
SHA256 1c0d5cd681debbeb1109cf96e667b405349ca36eca8ab189d2fac7cef9babd4c
MD5 6666b421742bd5a575ef8daa0a4acc46
SHA1 c025992302e13fadba94231cf702b829b29e108c
SHA512 ccca86f55c2a9e5b54960bcd5f38e566265b9fed006e663729baaa78c793305bce4a56b6dbb0d9694ddfa641bde6ace5fabea73ff2e8e577c463e2b9acb5a6f1
SSDEEP 49152:fqV9IT7CIQKylb8CA8UzHCUZnywvh3mIgq8r89IbS3EBUJ14wZYJ9w4fvY+hImrI:fqV9Ia1ZA8UTClwvh3mIgq8r89IbavZ3
TLSH
T1A6C5AF22BB818036D6B32172811EA3BDE97896301B3591C7A3D01E7D3E745D2AD3D69F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcstatusutil.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
Size 1.1MB
SHA256 b24ad0ae12c05931f11b66f26166c7ec41a7be318893aebe4cc2babe29bdb080
MD5 34bfd8a2cafc17cc6d77731137647ee3
SHA1 f759d53de2db6984ecc7604d0d655cb9324c71ab
SHA512 26772bdc4d88ba6ea664d47c5f1d96fe1b3c08cebf852c77c2a0513459f763edf17300e341f4e764da647649177e4812fc926dda15c640b91ccfd6d0f847ac34
SSDEEP 24576:yq6MTUXbn7CW4nVG2w30/JssVTlFLsWOq63IfHNpFw0wOzfTkqZgfVV:sn3/8FLsWOq63IfHX6NKTHZsV
TLSH
T1E135AF21EB024031E1E200B7C6B9D6BA7938A771271590D3E3C05DE96BA89D1BD3E75F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcusbsummary.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
Size 2.8MB
SHA256 4f8c591982de67c9211011e4a4a9560b93eabd6c08f2856d7638cc4c802a3b64
MD5 0187aacdbf886b531e61c5cd734a4b8d
SHA1 ce576911215f034eb889692b9614d80c04b216db
SHA512 60b48cd7ae6aa5a46b8e509f1181a44136f198fc6235d1531cdf8ef4e0555687fb227295776cb59bf5bc5aa62f022a5c22a06282782f61c47378bc45e7579b9d
SSDEEP 49152:ESkZ33X/kMdw4a0z6GbB7lyONDHSvlCi37AxvP7qm9cVKeKiIAXQSve4RSfoR2/5:EFZ33X/kvBGFlyO9Ski37AxvP7qm9cVm
TLSH
T177D5AE21BB41E036D2A32172855AA3B9A27DA630173591C7E2D05E7C2F745E2B93C73F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hot_mover_msghldr.gif

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
Size 172B
SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
MD5 c8a811d36876948a70fe7509b7f49925
SHA1 48541ac236da4f143154a8f71fb7fb3f3110bb38
SHA512 6bba69fa213b495a9faf4ea917788c43d888b3d96606db1644d7f8c456fb089f01d3e2582016a5043a49182ebd9767a2169aab94de05868ab0efeff5825c7578
TLSH
T115C0801594D652DB7498C735951537213919947F996DD12D404431F134785A0511FD64
MD5 SHA1 SHA512 TLSH

Submit Download

resources.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
Size 318KB
SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
MD5 4373ce1e6f57dc9df7a8ada69479d8ba
SHA1 f19deb28a0af966ad8c03db23cd21f75dfedda08
SHA512 e1c1cd77650e72652528b005da981a8ee3b28c995c41875a872202d0a00c75c612050f74b626dbf42f9e5412624860d182b7b6c98dde4df7c09a7f735834dd41
SSDEEP 6144:QnqKQ2Oq3ScuA05A+O4PlDfZIkbaRF30zG26Wdi9vhEsSCyAekfX6xgrNQi:mqhq3M5A+XfhaD3lV5SCyAe+XmCJ
TLSH
T19264CF2137E5C47BC692253089DC6BF970FAA7490F2448C723C49F2E5E35AE6D239729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

topmiddle.bmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
Size 1016B
SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
MD5 368947d319ac4823f5d542c8f723fb0c
SHA1 7d419d7c8b15f9abefc936f526e68ae2c535292f
SHA512 ed51660075cfeb5a3826231a0f0e2b1b165d0dc808cc5c1f309885dfa7903c914b76bebbb183ef38d67a789adf43b0e6e5223cfccfc362d50ab05b1becb15a60
TLSH
T188119AF0A1F0DCBAE7571660799EB42055D66AC03249424D340BF6286EB7715748CFA9
MD5 SHA1 SHA512 TLSH

Submit Download

ui-icons_444444_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
Size 6KB
SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
MD5 d10bc07005bb2d604f4905183690ac04
SHA1 69011104e870704cf45910d74bed5938f9062891
SHA512 c8df6ec5eb5684348613af6e8bc2e8d5759ff9912e9d36df42c09960739b0922c2830b56059ec0a95fc2ed7aa83fb3fe5a8673402544c4bd00daab457b9b97ab
SSDEEP 192:JfC8S1p4JW0bYmezNui5WP1UMIUN93GUO4:JK8AvOYmW1+BIg93P
TLSH
T102E19E87A4C2459E8EAA5CFF1D8E522DC17B8E1A9A1B50C52552D2C1071DFF8D483FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_555555_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
Size 6KB
SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
MD5 00dd0ec0a16a1085e714c7906ff8fb06
SHA1 244bd9b7c3b1c4f7ef72de31f67804faff213715
SHA512 163afece9ae9693c41324ffd89191132a8d2e42d73f962ace0b70b44a17d954c8f506cc25af152397e2536da6245e4336ae465708edf6ede955b4ad502af7a71
SSDEEP 96:gMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6KaP:zXTvYXQzy51nfmcuXibSralG/aP
TLSH
T166E18DE534F0C16898A14C3253536644D16EB3C3A8F7AD02C1B0AABAA465F3872FF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_777620_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
Size 4KB
SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
MD5 4e7e3e142f3939883cd0a7e00cabdaef
SHA1 d20567fd436991539eafd65c3bde77d82a656012
SHA512 d145a64f637f34d9f9fefaf7cef14ea277d0933e16c625234a9c1e0a54a7f3d0d820ab49b4b68d5d3e9853399d74efba9ff7771bfd3481f8c1c70e6dc6f50275
SSDEEP 96:7sHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:oHm231Nvu+wIqltWOe3nIH
TLSH
T1A7A13DE27BE7DCF495E62277BF9D5491E1542A41207047B4C4C4D11C695C99B1361E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_777777_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
Size 6KB
SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
MD5 40bf25799e4fec8079c7775083de09df
SHA1 4fc6b1449c73f5d10489c104225ebe326a4016ba
SHA512 51c9e46224098e9270bf51bec93e0528b5e726a632a1de57863fba531d914a9db1d3fb07d22cef756f6fc9e999bf08043e73bca6225a9ab7efffe2904105c388
SSDEEP 192:92XiIsTugcTnouLuIXdj7Z7rgmlWRI1ie+BVtNzDby:AmOTnwCnZftW61ie+BV3Xby
TLSH
T15DE19FC1E5F8C4E0DD58E668EE886209C7A658B9064742DBCF0485694B48D3186FAB8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_cc0000_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
Size 4KB
SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
MD5 093a819138276b446611d1d2a45b98a2
SHA1 1c7fc1ab71ed0d9fa051f07c7e8f43467121ebf7
SHA512 c886fae282a185b69a2cdd8593cc4c4e7ee463bc010bf59544058bb294cb0bc2ecc008a9dbdc6c7cd0e45bbb80bb9cdd5b7520c4a88779eb8ff2df56128d7b8d
SSDEEP 96:gHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:gHm231Nvu+wIqltWOe3nIH
TLSH
T187A17DE17B6BC4E4EBE7233FBFD95460A1542A01206073F480C0D1ECA98D9A71361E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_ffffff_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
Size 6KB
SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
MD5 ea4ebe072be75fbbea002631916836de
SHA1 1769aa84191332e981245146067080ee4faa592a
SHA512 85990dc5c32560e10cf380d0e10707a4d995ff58b35cc81bb0ebca5afec15c1ddd6cb0de8e7fb392f2384f2a7ef9482f2b1e47924556e983b9c5ff1a79c1e7de
SSDEEP 96:DcH4W00cRUjbz7dqG+sLo/Hh+U5cVH/lT3jmk/8fY44WtYHM4tNtldMJU/gl:oYW0YhqG+sLoPT+XjNQYbZNtfMJb
TLSH
T1B3D19E81D6CEA64BCB01DCC97EC73BD82588436B5A1A94EA15D2B0C8B52FA8CC50583F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dlp-consentsetting.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\dlp-resources\dlp-globalsettings\dlp-consentsetting.json
Size 45B
SHA256 44912bd9b29453180d9a68c47f277dab01bd24560fd83954cacae891d7575e46
MD5 78dbc9992bd73f6e7682ebb8ef737474
SHA1 0b35ab8b779fe4084d704206ea739632eaf963a9
SHA512 5cef4462bd987f1aabbfb8199758988b3a26e395c57e7685c62ddebed5cbd33f4e3aa3b1d8dc633155d202375de5b8d3d49be8b4223893fe02837e48553f8dcd
MD5 SHA1 SHA512

Submit Download

dlp-globalsetting.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\dlp-resources\dlp-globalsettings\dlp-globalsetting.json
Size 592B
SHA256 68c5114024d7b71c64615af68dc78431d47e64e46c65f9a8822cfbb4b79e2a7a
MD5 c4e27ed2675d4576ff76cb8f157ebdeb
SHA1 9adc6512de06824e1ca9d707212f36a240daf558
SHA512 0e26761689a904d9fbd4d4d744134fb6365f355855a9f32163322c27bba6b1110c4d4287807067d60a5810eb91b30b0579059c8ee28eac8cbfcfe3b019052d96
TLSH
T171F08BE38A080998FF4B1AE2D9B303D990FBF10D9FB31480B1FE19685056720DB4B64A
MD5 SHA1 SHA512 TLSH

Submit Download

global-meta-data.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml
Size 30KB
SHA256 b003235106012d8854130292516db23b394dde32c7d5fa4329eee8c159d99887
MD5 5b5aaa284fd4a24f46bd9c422bc650b2
SHA1 6fb05813fce1db25c2a32dbc411221215e883d97
SHA512 29b53e27bed3f52ebcfe58b92752c1e7a939fe7d94dba580ef9c9e45e1e6b005aba243e567efbc970e07f3d1b56c2c2cb0f72e0b90d184702f1091f0cf789eca
SSDEEP 768:1jLRtageXS9lz0SafjewyJpEN8qhq4OrRkD:1jLRtagmS9lz0SajewycN8qhq4OrRkD
TLSH
T19AD242E637D21A154551B0CE8BBD0F8192F7FBDF892A5BC830A06875931BAF73A47205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPMErrorCodes.xml.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\EPMErrorCodes.xml.gz
Size 7KB
SHA256 f98afedcadb662b4d445800cb2fb704c9432f6449a850db0de7626dc5e50e000
MD5 c70276f2b72556c0501bb6c8ce05d533
SHA1 f6aaf376581cf4405d0bcc4fed283b6279b79652
SHA512 10fd7ce87fc63190aefae117ccf1a839cd61ad28b630995d231bb01243e166d76c2f69647166149b9388983745aa09b51c36889dc4de63c831c8d73f9f90c2aa
SSDEEP 192:ROGetiEfnoWBJLfDa0AQROfcsvXPsWJSPVZxKnb:ROGgOWS3QIfcTaSPfgnb
TLSH
T199F1AE803AC8102EC460C95486965EE722551F0A77FEE12B081ED4E7CB7FC6A52753D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

applications.xml.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml.gz
Size 597KB
SHA256 4fe9ccaca0dc8e1c91b74277decc40a98a00749a9b7330c56d095bb2ead3dd59
MD5 d9364eee26f9a610374a0a278641e73d
SHA1 5e0866495a410205f91c71fa8473f387a868a98b
SHA512 d93e23a2b861f2e2bc86d8a05518575f0abd8c117e5d85bafcd99a984f74eb3e14bafcea7017f917969222e170257f82cea2506a40717e2e816fe5fafe0eceeb
SSDEEP 12288:pK0p8ZG2hNCT+jGJuEYVXXxoM4LmAQTP4tMxoJREF1ekRkkl56znKz:pKlZGp5JuX5BolLmA6/xocamFl9
TLSH
T192D423F90A1A1C59B8C0D25DDE23988A02717E0054978DA87FB4969FDFC74CE5CEE127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcdriverupdates.dll.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz
Size 365KB
SHA256 b51efd8fde309d36a38e2174db59bc7633473df450627fdfea437816cfe42c05
MD5 c2c5b2c043b6aa50648858f0626ebb17
SHA1 01b8a07a67c614c77669588dacb95deb5a00fcbe
SHA512 6a4cd400b7b36162c147dadeed8f6dc0274c80bf6dfa6a672dd8fbdfb72f7dcaa1367ca807bb34799bf513eaa86a065c80339f3d4d3a7fcef222f266e9f76368
SSDEEP 6144:OBwZzMQNINGrcc2pfNCI0Z7Nx5rkxKpNdXg7KMCgX2mdO4+VwBMBswbI7H:cwrINGrc5pfNE5g0PUKMCgXxO47cIb
TLSH
T1D7842300EA8216561FFDC5C1E40FC4B3C6BA17DFC1DBA2E628663D8DF24DA02A9755C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcpatchutils.dll.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz
Size 516KB
SHA256 a80de7283baa35b09e93ae6d98c1b56df4fca3a39c866a991c0e5ba01982ea54
MD5 ec127913c51f40be0bd68ae5b97519c6
SHA1 cb7a36e47051b8a75196e154f5b1ca2ecc07b252
SHA512 65f38229d24cde9ab3a8840fba1fd9dcda80181390f1d08da56c11c8103df1d19ef8b93ef02b3669ff5d039399190da79d580d3baf5ccd25810828946d99ac8b
SSDEEP 12288:7n5KTIX39WRSNaMppIBohwl0IOaRYwq/nYSVaMBP3aXaLDLtAUrZ:7n5KcX8S88jOl5+YsBnLDBz
TLSH
T1DBB423827ABB8AD5C00FA53AD7FFB772D2427654F68122A4E4660E13FC31B9D4392171
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drvforceupdate.exe.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz
Size 120KB
SHA256 76bb3afb0c8746b57f118fdc4ea24c7daa04ab6bbe364650f359de24cc31ff4c
MD5 90d7b5f00a0b07950ec7b46c6a5b3e1f
SHA1 c12af4cfefcb384db1d7b59f4a8b41d4c192555d
SHA512 bcec9518131b645800e0e15870c781abf966dbb0912366400dd70f47e786517edb5105f08acfad924013f0ea6dba5007522b7dc7b0675a86aafe2137ade95204
SSDEEP 3072:4HPUIWm8r6tjwLbLQmLLhgYcrVFv0Fe31TuCX80fpemxog3xcm6V3kR:OWmIgjwLQmLivB90Fe5ul0fptx963G
TLSH
T1FFC3120843D0959467BCB5C9C4ED78BFDFB3595031A98BDB68A4021297CDDB22EAF342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hardware.json.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz
Size 117KB
SHA256 e3224a07918a12c8ed3b62d81350aa624859abafde58d6dd8d473738dbad79ce
MD5 aa1779be7666475710590f72b458488b
SHA1 e330bcbedcc85388cd3dfe9f19364afce3206d0e
SHA512 8fe6bad43573f0e5ba01ec3849dd5ea67fd2d94feb95b6de9a01da9fb611413b2bb1b93c23da1b8ed9a345a2f224fbe7e1c167f07b9414884f963ad5b955808c
SSDEEP 3072:vQINYtPGxyzXXF0Y24YXb8WqEnO4IdR1dd:oIOtPII0Y24YXbi4APdd
TLSH
T196C39E7F939643AB583C9111F365A89E7915ED0127989ECB1A8DBBFB082CB8C44F170D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patch-dependency-details.xml.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-dependency-details.xml.gz
Size 98KB
SHA256 06f94ae156236c1ed21bdfa45d0511056005b406efbe05081dca9a6f0e96560c
MD5 32e24b36b9386e8f5c91eccb0f61f8a2
SHA1 3cb405d2e9935bc258b0fc2e7c3b1c3720c98d93
SHA512 dbe11cd82d4a4dfed67ded14d70c8a29ed5f9bbe70bb96049747dfff18297b41dfba28b30fe0c4bb2857a1c5e6a6a07b657f2a8be8facd9ec05c38f28ed6b410
SSDEEP 1536:+p1V+d+sdH/cuJB6TcK6SHQu0H+jcT+ycTFBlSMzXRq++3dg2:yV+d+iC6o0WcTwRXM+2
TLSH
T174A31241F8C48F3684EA6675CE463B509837F61C8A0C9131E6AEF61291FC5521EFB1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patch-scan-data.xml.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-scan-data.xml.gz
Size 221KB
SHA256 53f498432d7d303a8c5b0a18baab3f84bb603c7a825c71697728438d98adc53d
MD5 49735e929b5a1358b0ba89474d98c83d
SHA1 ef03c2b0f5857683940f1b218c811bf20785b7a8
SHA512 47b6120d64ff60ebf00e09f448f6cbc2bfc16808f6b2aa1aed822b8990c80e4876fece4af6018b702d42008d14a509cceb374e3e39188abcba27c42fbdd0ca0c
SSDEEP 6144:4wsjs7QQVmEP3X7b8mQo+lBRY8kLDOy8tzc+q0kJVV:kj0QQVP/XXZ+lnkL/8a
TLSH
T1FC2413D93AC117A0ECA2C56183ED9F9D6E480F461A4CF2A94B476FCF06A4A31C2F715D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patchresource.xml.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.xml.gz
Size 144KB
SHA256 128a2e5aad292adb2b993496dba4c930274903e38f50252b35f8865189d9325a
MD5 230f17d530d9a0d7e14e59b447778aa1
SHA1 e07f1dc6dd53236400c15602985b1a9b6671896a
SHA512 ade1491ac62b8ac4e09efabcaa76c0e16cadc6db2bd68b92067c59bde6b9c45533abdc964662fd1bd9a5dd9ae89f4f87d9864536593a7247336e694b38891c56
SSDEEP 3072:Nqth4UT02eNcF/9E8JfJB4HH8pB0rbAcCk/iFOPJ2p:cth4enIGFfP4HH8pB0rZi2u
TLSH
T162E312981F35CD9B00CD69C851C7CFCF81AE353B542CD531658FB20874B26A7EA62B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patchtodepfiles.xml.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml.gz
Size 3KB
SHA256 95128c1074f990457988a05fbd04395d3fc6940aca42c1314038737f37f9e9c5
MD5 5d942495ea721d965a856a4c05e38aca
SHA1 5fb64642a5d87e673b301ab1177721db248ffc59
SHA512 57c49d11f4da5c88453a96f04439348f01a67def188930520483f60bbfe7ca5c119df8f7bfde772c97038b4dd8316c69ba40b832a69703d9fc1ef31c1f645e78
TLSH
T1EE816D8FFC249E82AF2601C5E8828D045C773A66AE8319C483DCC61B0A85AEB7D35D43
MD5 SHA1 SHA512 TLSH

Submit Download

patchutils.json.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchutils.json.gz
Size 340B
SHA256 16d745bb671edcc34b3af1f7f08afe9b9562ad5b514fe0fa9918190c6dbab527
MD5 88b93a1f2b7b689d6f79b0227c7781f3
SHA1 d6c2dccd694389e9140e004a353bb1d854caaebf
SHA512 ca45ff419d0af21316c0fc14a5857dc1dfc42360d216536a4fa8124101100878732d556a1d3d271e0df5737b77d94f10f8ed7fac70c354d8726905e5e29ecfbc
TLSH
T12BE02DD4F140BE9087A058ED39E32689023F828B860030B383F28E830B010FCD0CF6C8
MD5 SHA1 SHA512 TLSH

Submit Download

quick-updates.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json
Size 100KB
SHA256 6e7415c4110fdfe2bec13af104695f4c024f7c37f1dacd3b04d60facfb62199e
MD5 9c1c6e17f857bebcd81aab3d162774e2
SHA1 146ada7dfc283329b5805979523ad4c8ecaf129d
SHA512 60148254d6688aab14ea85f2dc97f80ee9abe1f10f02cbec80416d1a71b7f8bfdda99218dfc64995af49fd8a5d7697f2de3de1b40e8b8ede7019395eb7d16e30
SSDEEP 192:rwlxuxN35H9nBXyixJ1lZRF188hBhBxxRRimB99BBll/JINzGZW0k4NM+FFxAVfo:15HNOc5CzexHcd6xz/8K
TLSH
T18BA3AC19DB60DE47960AA3B250088D01722E137BBD89BFE4379E653C9F4C11F197E29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

server-applications.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\server-applications.xml
Size 62B
SHA256 dc3ba306133d36aca2f8529d71b2c11cff1ef1b322d036aa44fb4ad8215ec9c7
MD5 66e501fe40026e8fd15851d95e6772a6
SHA1 f86b2c5e644c360bf83aaf421416831904fa467f
SHA512 d932cc5629137b815c18641dfd3043c04e7209bb337a0ebb0f298e2c9ec94c890203c41ae9cc453d180e4ff59700893083e8be1d9651b8354e2f0e3a46250ded
TLSH
T100A002D5631191674BD155664769C0A8937D711A38A00D454D9149A706560490B46156
MD5 SHA1 SHA512 TLSH

Submit Download

superseded-tree-scan-data.7z

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.7z
Size 325KB
SHA256 be91032686ef48136bb8a631c9a2f1b9d4880adecae375047c607aab86a6aed4
MD5 7858b9d3456c7225f33ab3015034870e
SHA1 b9a74ca31a079602ae4d32098a925b57be75afcb
SHA512 2821904dac342952511cd015d649fd14f0528daf2fc744f662f46f555d9d6ae625ff9e37f891367912eece6835900f3348a7d70d84f5734d465ae10fb530ec01
SSDEEP 6144:8lq44kEJGbiDT3Jl5sQAwvw8dSOEQKQvdr938lApGvgGtJUp3Ebw+:2SJXPZ74qSVQKCdrilApkHU6p
TLSH
T1C66423D86A5CCC91EA611D1F1E16C8418CD41B3BC9E9ADA8E7A410326ECCDCE39574DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MisconfigEngine.dll.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz
Size 464KB
SHA256 330c26d95b59deb9cc893537bc91e1b8852d1ff4c99219c968ded6e93440c009
MD5 d9fe4142d10fdca3ffa4c1b13c0793de
SHA1 da0cd0fe875fe19e60f2701aa35d3d1a23c0fd71
SHA512 fe4f9a114b34a0fd8d0c8dbbc0964450bb225686ec113fb638f8fb21a76cb357a0bda3e67e7675c1eaebf055ded845e105d2c33710f16589cd99223a25709c5b
SSDEEP 12288:KAv6dZ+cXAx11I/fMN9fgR/o8GlPfmenWO4pU9GC:WwlxPI/EIRXGmYp4pU9GC
TLSH
T116A4235525FCE71799A2FA4A5EAE80925BD293040ED0C671EC7A7034829276DEF3FC50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServerDetectionChecks.dll.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz
Size 201KB
SHA256 0e38c0611ca05835971a71b2f460ddfe8a936b2b5c02d6611b09854c6cdce2a3
MD5 42198bc0b5a873ae4542e21ca7a55ccd
SHA1 db6e99be06fb5162f0fd2c5c4aa4a27964b8b5b2
SHA512 94750d83c9de6017fd39bec8e05e1ea6daeb40722afb471079267a1477a95a43f89639ef023fc401c8c6a6040246d3fc23970c8f476a17ca3ce6872a50514da0
SSDEEP 3072:9KnpnnBDOTA7Um0byMAI/OZfzRb2hWxZqZz81JeXSZU//OtHesb+NC6a13MJS09/:AxnsTrm0byMOZfzRrxrJa9araY6wMSCH
TLSH
T1841423634D00599F10ACDBA561FBC60636953EF7815BBB741BD6B9CE3BE0F8442B9012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

applications-vul.xml.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\applications-vul.xml.gz
Size 139KB
SHA256 043dad4ab09f3353d1611e5fbd39a3b062eda724a3a0c7e1cf03c5d949f24f01
MD5 d9f585c4a06b8b2c786f460faa231082
SHA1 7e4b307945402ed3de4e7b9a4ef45c506c79bcf8
SHA512 0615574ef232949e44c5f484d499ba495e4c196c36738cc0bc581cd0bc1875d861c7966938c25c2c63946521ded5b846d32b6abc9b96596f8da71f4b719784ee
SSDEEP 3072:92IMy65TWDqu1sIpsz5J0O3FmX21Rqxx+x2G+4IRqPtV:fMLTpTCs1JJ3xRHMqPtV
TLSH
T148D312390FC5A7CB7260D7328939E681183EAE5A4CEF02B53C657684FDCA50DE73485A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misconfig-scan-data.xml.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz
Size 47KB
SHA256 67e14a184e1e5adcf3587b672b631aef1bd7b772e5f6d91ded2583c200251523
MD5 e264a9f2f6d5611f7c505dbbe14570b4
SHA1 910875e04c820bb1b0f82f4098089aef7336a783
SHA512 5b6ca84818a2d85e1ac2f6871e488971ac0a37c8e80a4aa4bef0cb7db42ca99369ceb75e7cea8dfdb2bb930c654200522cc26f2df6509dac5e7f0d146e067574
SSDEEP 768:PWkBWchO+RjGIXpKnZGVIFt/r3r08uAerr7inRWMkSmL8jSCqhdGRSO5SlUxsWff:PDBzh/jGIXpKnAV6t/r3r08uAJMVdIjb
TLSH
T19C23F260D87AC26049048938F7B9540D5BDCFE5EFD0DFD527C80D5E7420A75AAACEA2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patchresource-vul.xml.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz
Size 27KB
SHA256 d8cc4230e267f8698fafb5bea15c211a99d9d3cc18c17c727b2156beaaa13b2a
MD5 6178476ba2dee90b7cfea6b77f11f3e0
SHA1 d2d767eb456ff7bd75837cd104cd7f626d1ca5d8
SHA512 ba57a9cf2fc9b51fcd55fb5258eb739c3ae8ce394e27d9463d2e558e2229fed35278b4f664b64156f869da0082d4f97e836090fb6eb6da1d1a04de7cfd70a755
SSDEEP 768:2LzmVfmgQfyqAN+nGoKik/VYYERAvMDU3:umO6qw+nhTclvCQ
TLSH
T118C2F24A20814874FCA0E3326EFA5F10C3B915602E2EEFB4E9D52011791627BDB439F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vulnerable-patch-scan-data.xml.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz
Size 37KB
SHA256 f1eaa6ea9dd453ed4555ba8ad2f0f0d1c67bcf103195f46e58f283c6c907634a
MD5 24e517f88c910e6434e944b768cf81e0
SHA1 cad485ba1199e19f73ca128f331acceb8da05a95
SHA512 9214f501872ba1596300bee4890d5c074a2704a9cd3a57dbbe290d8845aa12afc19e2370ed031b78bf9b88256c6314e2515c9ffa43682716d7e826516087edca
SSDEEP 768:dYEY2TLisp2fTjyBtATZvZrqKgh2bgp507dueqch25ctE+Tjy3zoTpP:dYd2TLispugATZv5qKgMbgbmdhFhYcDr
TLSH
T19F03F1417E953368F4215BB166891E63FABC586FFA2CB601D015728F500B6E786E0F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vulnerable-scan-data.xml.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz
Size 105KB
SHA256 7ca31496cab1a1286215c0f7cd2e9bfc378a2a479b035cdb61e9f5fe40a02ab3
MD5 a2313cfebbbe83d734796b68bb473dd6
SHA1 be48dec45c60b5d469cfd00bbba221c1b93e2e13
SHA512 552979f9d5338a41d662a895f36ba9c11e0fcbddd6828d80ad9c4514cb2c8d83680fcb7581674194ad95e5f74265e13ef88a1127041feac80ebd212aa81a9325
SSDEEP 1536:Eug/57gkP04k9wCqSyULNyRp3qHurMZurZZqyiuWQ4haeDvWmV75D2SZnPTiDD5r:bg/57ghw3fUL8n6OrAu2cWceD99DZnmt
TLSH
T1C7B312F47C7D0FC7B7FE12091C54672337EBD7211296AB2AAB2847AC20A54F25E90516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources.properties4608.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties4608.tmp
Size 98KB
SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
MD5 c340fdd54a3956f567a1b3b5bf0ad58e
SHA1 3c620fd4efda92ddcb42fedd600d4ceb1d940a97
SHA512 d5e3171d3b11bb56fcf35de8ad596fb37008f21d9e8dfa18444c1460490fdffde3149981ab7fa45a144ce1daa28a5c588230b58fc802ccd30568dc2383b38f3a
SSDEEP 3072:UyfCAIeTx7UYwyKlWF/VPKWl+DE09phQl1mWSDj8kS:VfCAIMBUYwyKlAVPKc+LDj8kS
TLSH
T16AA3735AD1766F7E33C6132BF4392BD176B20D648741A9E87988E8F4D63C84121BB4B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApplicationControl-metadata.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ApplicationControl-metadata.json
Size 513B
SHA256 d125f6e877d8c02b91a2fabaad5ac43686f793380aee17e8ea3736dd6c42ab4e
MD5 d8e43bf9a142c5c8681b6c5d13ebe8e0
SHA1 63849c96cd381f4a5c4dc649004bed7d7d78818d
SHA512 5b1fc257a04c9fa4c0afad18c9af0300cc1b85f46a72829980bd377c132842dd590ad604e4a1b6aa6ebbba36f2c1b7478cc35537319a794fe29d085d57648bc7
TLSH
T182F00ED35A23557763E1AF0BE622340160B3254C88DF04083E4600948EE613F0E03243
MD5 SHA1 SHA512 TLSH

Submit Download

DeviceControl-metadata.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json
Size 753B
SHA256 2b4b191c84b370692fafa646c83ae75725523e1098a7e59539a5731a5a27d5aa
MD5 00d3ac2b88861b5ca9fadb2b4094dff1
SHA1 431a5e35b752c1bac83fa088f21e3a3dd77e101f
SHA512 a945df2226aee19e20641c21b96a73798b14984ff3dd6e29faa473814fc7a4c22698c5486ffc8a9a04bd3bc203caa3c0ef24e644bb48157ffead775f50d29be6
TLSH
T16A0190C249335BF70BF797EDB551581A45F3250C44EB05097E48DC915DF197C480322B
MD5 SHA1 SHA512 TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
Size 15KB
SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
MD5 783b02208909201added3870096ecb7e
SHA1 f912be0d056a40d9ffc49aeff5287d258048664c
SHA512 a3b95b96082621a06f1b3df0dde7b50b4c84172f8f5a48889f766fab9594e3dc41a86ab47553bc8ef4a01c29103bfc59ace36f1135e4aedc0d7079faad513589
SSDEEP 96:jSOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:jBhBAO8b0Obx9nFLnnmI
TLSH
T1E662C593A51D099F0222039999DF7AD3A1BC94344C7328FEF8C259256FDAC1923737B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
Size 28KB
SHA256 86dbea70ab491553aee7fbb1b46bed39f3b74e7cc898c447acaa48316befb670
MD5 5d53def373581955466056e0aae46496
SHA1 b65739abe37900169a65a697e58d2474d367bedb
SHA512 74c2d26b063fe3f454178a41ed90f8a01608d5291408998dbdcb9b6204c0a746a0f11836e7650c582d36d50e630b8fd9ebdad52141a65f54a7ce1225458beedb
SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEx:0PY/X
TLSH
T1B6D24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz
Size 2KB
SHA256 55534670de4cffcf5b5e4ced1b89cccf44ce34ff42d58901bfb8d35d766ca646
MD5 47afa88579c0771d10115d29cc6a5197
SHA1 2a7a5de82dd3fa4a3d68310c65fcbdd7b339f981
SHA512 9c862bffa6817b874ea78cfdef448547c622f10622cd25ea3c79598b12260d21b7d9e71606bb3de6827495de526eec9a6355da0973d85bf256f654700634bd6a
TLSH
T122515C522CF97E5B3441864775C2BCF59C97866820DD688CA45C6F0C539367B3B61C86
MD5 SHA1 SHA512 TLSH

Submit Download

UserAssignmentRules.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\UserAssignmentRules.json
Size 685B
SHA256 0bf381444b40c44e7f423d886bf370fccf27e4dee6ceb81ede86082b8bc9c166
MD5 c916c60a0b298b4fbecc82cbd9de32cf
SHA1 31d767348014f94880f483b30f622102fccd5961
SHA512 83076a432acaef99c1e8698ef3ec6e050e08dcefcfee3b4e6b6a01d09be0f6929db3e6702411b810307ea1c8741001695b0ce0018432171e2b1a46e68039a1a8
TLSH
T137014C65E0E98E2725D013A8D0ADE2071310484FCE9C7C02F64E948D5F6CD3D117821C
MD5 SHA1 SHA512 TLSH

Submit Download

agent-security-setting.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-security-setting.json
Size 203B
SHA256 bae269b9a73b0b7744ea8210737698348869f7e63c6b2aa468818b8d24764757
MD5 7a2a1b0468f02308b6375dde12c591d0
SHA1 6bcfcac0d19e2152ab2ab0b19bf31e6123bc7337
SHA512 4cccd0b78e365c04a0a38fb140484e2d036f0d1d0cbb76e015448c6f2030986a77bab3cd5e25410aed0d5ce3474764670b18ab814558f2f585abab9c42a21c09
TLSH
T157D022058082AA6D03A2020E00CA61C34545802EF9442868C110BE3120823EE6F57F35
MD5 SHA1 SHA512 TLSH

Submit Download

agent-settings.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
Size 4KB
SHA256 9e856f8c6bf45d415546b81c7b92ae65b18c136bdc3b5f3155343bfa3d8ac2f3
MD5 902b7cc056ef01b1720e179a698128cd
SHA1 51d5a73ee8588674bfbac635c91475c71d9aebcd
SHA512 bd5d7ec24aa6e161634d1f621798d3e4b0551ba51d602bdc6efbdcfd1ec3dc78cfae9173e84e0aeec0473d3dfa365b21bcee3b6fe4255a792e76e3b06bd97c31
SSDEEP 96:CWdtFTwjDdcG5cNsS4cVFEpP4W+XIQGxKhg4Z:NiRFF/6n7n
TLSH
T13D814111A0B0C72D0374776CDE56F719CE4606952A190B0AF06D34FB0F7AAD17AAB4F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

application-agent-store.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\application-agent-store.json
Size 1KB
SHA256 141c9327dae622889bfa66265dc91c3fb8db15e3964fcf6d61678935a219c871
MD5 2326df490dffb2ebad0e6bdb0e5ed13f
SHA1 ade7a63363479acae9ec6929f3b5ba6465ffdaa1
SHA512 0f2707f4674846ae2348c55b447523639d919b801a98602fc38229e7da95b4aa64aa9fa8aa6e6ec107fbb3303f457bee2e0bf5cb38eada050e89246c1f4d8c0c
TLSH
T133317BE7A0871ABE8B86521EF449C6A516B62C3D48F629443D8A2E2C0FC42FC675B014
MD5 SHA1 SHA512 TLSH

Submit Download

boundary-list.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\boundary-list.xml
Size 151B
SHA256 c2a1dc31de85104f2886919cf34a59ee1a17186a436ce1b405897b6216942bc4
MD5 ef0735064ec072984edb016433ed5cc6
SHA1 3d189f48eba00bd041b5d76a4a6c13f8ff212c83
SHA512 1c3bf8a9d681e99a5ec4ceb094fc08cd53d79044f3fd64fe884497cefeb8bf31a9177d4dda52126222b29a064457fdab49ccc4c123aa1a14bbf2ecd7697a2e83
TLSH
T1D4C08C08A000D8344BB2C0324BE8A022AEECF50A15E04051EC2A0267061859909DCA34
MD5 SHA1 SHA512 TLSH

Submit Download

configuration-settings-dc-win10.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
Size 242KB
SHA256 1a388c11ac7b14c44ecb605da1f6111274beb11d947442311c5ef1a88d6e4b68
MD5 80ff33c99dd10147ea596dc25319a780
SHA1 04bada413072751276f871286071cf691b5073ff
SHA512 ae0ff8a43d19cc0b4a26cf10e7fa28779d803d984639d2e6a5304a6e737635a440a5551633a1026be8b3a9d847ac0f7e125e1f00f0edeb5fb03bc5afefa6e44c
SSDEEP 768:HDVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAaS:HDzZZ1uSNABIpkIU1
TLSH
T13E3418969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer-meta-data.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json
Size 898B
SHA256 4f2c57eac4da1c7b6ac0ca730163f9c9618726926bf98330d6b6d0d63127ddf9
MD5 b17a83735a1a842301292138077cb09f
SHA1 2bcebf872b457ef7aaec55e45bda5d4493ad6404
SHA512 a89e2a37be502fac3b3b6725d70a91f89ef2b93843a4e8c55e081e48f2f17e4a4d6db733bb97024648f51cd36fe062bfc4b1153f3a29aa281144d904286a3b6f
TLSH
T1E111A0E4B0AF4CFD42C7F559AD8DD16AB6A9F622D0E89C0C7659F9088EC6088B3D1514
MD5 SHA1 SHA512 TLSH

Submit Download

data-dictionary-framework.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
Size 415KB
SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
MD5 d1a1e51389e6663e8e53933731adf46f
SHA1 9ada91a587210f7f67ce5e805d7c35ba1c4201eb
SHA512 14208064c56b6fd9998f10b7a534b3c48ddc1539ca4ae63521e5ccced1824e3a2e7ecc0c2e592138bf17d4ef07d253ba537215d8fc095b0d2a55842887624a99
SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZn2FYYh:6fufQiiNJY7tYiSYh
TLSH
T13E94B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-onpremise.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
Size 109KB
SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
MD5 b39316c180a11c7cbefd08019ad9c97d
SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
TLSH
T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
Size 1.6MB
SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
MD5 415d608384f186f24717c62056111c99
SHA1 85a8d23411db39acaaa00a7efb974535f74bfb26
SHA512 f72b81cddefac677b27d41380fbc647c83a1cd22ac3d319659f569d64907103cbaa5ca3ab877c97fb54f3f0f37b5a6a3a7afa96f6c4c7bee02aaa275473b7ceb
SSDEEP 49152:L8vq3hwELiWbHTKR0NDZK+/0KfEDKJKzK5xFKOQFKNoDKpW83wKFC+KFE2v:4vqxwEeWbHTK+hZK+/0KfEDKJKzK5xF8
TLSH
T13E75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deployment-policies.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml
Size 6KB
SHA256 858f10f0ffce121bd5ae5d46330c0e114773ea526eaaf340285e676d5097ce1d
MD5 47f23071a4f2bc26ca9b4e6efad4f417
SHA1 24e9e1a2d8409539fce6f3e977b2986f468b5546
SHA512 a1c492eb6b112af5c0a2f9c6dff313a6177ae9d27b5b46308e04891b9ab54594e7bec1757d5be798181522489a65218c2617b210ff9ccbb09649936c4f47cfa1
SSDEEP 192:lKE/KWadKrvKDeRKaBeTKRUGBKpmvK5vKtk9:UpWxmD/aBxWGIz4t8
TLSH
T10CE1BE6DA19C9E190A7328D7B71733D573A1421A05C4011378DFB1A82B72BE385AF6F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ds-server-info.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-info.xml
Size 1KB
SHA256 588d1f70a4d88dcdd3eae4daf45853424e03fded812205366229592971ae4a51
MD5 f74882f77755515f6d8bc07311f2f0b5
SHA1 9d561bda6138016d73f59675d92b5b078e5053b5
SHA512 322fd812422adc51195e4b3b7b375220a4cda5166e759ce6029043476b704f0bde18899a2d40f5d46a27a3e537c7df6a03e19dd3c380ce9aca5ae3e2431b9802
TLSH
T1393112127C839DE52363BB88178D88169E542466721F2C9471517E858D7EF931C7347B
MD5 SHA1 SHA512 TLSH

Submit Download

dynamic-variables.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
Size 28KB
SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
MD5 889d10168a96d01a40af825a606ffbe8
SHA1 d1a75fea9d9aedd31dd581b8cdf7b45791d790d8
SHA512 4536452db3e0d32cc7129bab4180a509b71d5affa0fb98599cf7ae4d21671cce0fcb7335cc891a0ce247de2a6674197f6ba74409a14b6bfc15a7a03d1511b90b
SSDEEP 768:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYOXNe/pR71KRa2GG4q+V5No5hVMKD4idqH:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYL
TLSH
T10AD2753E61A0FC4CBAD0E85C14CC8A188855D313518D7AF1FBE84F2E0BA59A5525FDFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdm-enrollment-settings.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\mdm-enrollment-settings.json
Size 139B
SHA256 767920959f261563912c25fccc6a3b4720b5073aacd58e83b07e50e0be8d45c4
MD5 2eaef9787ef3dfe5eee341e0fade9144
SHA1 7a283b81df5845a670a4e15a7c6bdf032c174032
SHA512 b83eb384d276b2de5268251a8ce0b08eb789ae847a65cf1bf73a5d8f48d37aec3866f2a7d59f8e96451df12d94de17aa0797a2b0a9b4fbea0da2fce528b6c1e8
TLSH
T1A4C09B91C7552FF04F6D7CDC549D65C91CA4A2536E4A70B5F020515E5F4C35D3C318D2
MD5 SHA1 SHA512 TLSH

Submit Download

meta-data.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml
Size 10KB
SHA256 44492bdf9c5ad4b0a5c1bff9b461b81d676c491e7be66e5d27b32c16931d4404
MD5 8a26a1d7c2ab4897d02a35e70cc65ceb
SHA1 a1a5dd2bfff180bb1c7645b1950a702c6cc82ea6
SHA512 6e3a393720c74a85ebeae0ea8fcde42244e6301848b3eb1a42d97346ff1417408b26520a64a51e660498c4c311613fe4637eaf1b1a70d27d14c17a6591dfb1b9
SSDEEP 192:GUKUEUAURUwuUHUrAU2UAUdUZU+UAUlUHUhUrU7UaU5/UYUsUSUoUAU/UJUTUKUo:GN9dm6m+An1669zkiQSSXK/9tfhtM0GL
TLSH
T1902267A06BCB9CF80194FA0C9E499920F9B5F71721AD101535D8BC488EFB8E73DB6169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ns-status-details.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ns-status-details.xml
Size 1KB
SHA256 bed18ac9df66eeb02d52a9e77f9626e26fab5adb39d48624ffd1d491fbff4fc1
MD5 f798036f879004b8df4ee4478b1a7695
SHA1 94490df43c2c54b81af932fc6b6b3dd7c432c2f0
SHA512 d134d09d77ac1b8d37dbd151c3b78df3c4c2cabb42212e06b127fe7ddf71b50eae265d21ee1cc2798ecaa6c6874ca39ed547492daa76f4fd97bdc3d3b8fad1e5
TLSH
T127418211A8839CE92357BF942D8E89229C5D1867322F2DA0B151BE91563FFD31C734BA
MD5 SHA1 SHA512 TLSH

Submit Download

vmware-names.conf

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf
Size 55B
SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
MD5 87cadf1716a7a89b6a5e95707bbe0e5c
SHA1 677e32f23bfbaa64b2eeb562a24b9153eff29c7d
SHA512 92c72d63eb92952cde4bf2dd01cff2ace0b531d28b3d53ade8b5912ee796d2313b08f4a7ee172efcaca8f2951386d3c8916796ac736801ece831bc6d7ae2ca76
TLSH
T18290026DD52E681112675D0E66488F43C51A50C1198D582B1A2C1826A0B417D5A50153
MD5 SHA1 SHA512 TLSH

Submit Download

dcagent.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
Size 3.1MB
SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
MD5 7e12fdfa73e292f21d91fab687229213
SHA1 092919df467205f4b81337a73e1d8602c77d92ee
SHA512 5e41cf585b2e549330b21d8e9f414fbe7588fe405c1b80d32053c14b98b45a001384c93ac32e7253910f01285f1c6efc0d46e163c1b0c3f017fd04f5bda20ad7
SSDEEP 49152:8594T6Iiya9PlJdUI11loQlxI6Uh8Zvu4d7TmunCQ/XHaT9eGfcph9yv3fxJuQ:8P4uIiya9PeHQlxdQ4dGunCQfUer9yvr
TLSH
T19AE5AF13EB418031E5DA00B6C27A9B7A9D396730132590D7E7D06DE86EB45E27A3E34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcconfig.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
Size 7.0MB
SHA256 27800f916566d2a564e48eb543d1c511c72b344765ff4f9bdafb113d13669f01
MD5 210c7ad0f6111a77a81dda1c6af5fd40
SHA1 8278e855060fafb2d5542b11ea4a1d68553895c4
SHA512 19d4aefc458d07d0826f6e0d0bd6f7c53c5706c88c5363545e18c5765a6f999e1a22be3d6c97b18609ba18459b6f2d8585faa5b4c8c8e7ffae2bc641c541777c
SSDEEP 196608:Mcm9rt6qX04B1RlXiuzOBhuVAOZouCDuQcf9VY0:+m4BX1iuzO32rouCDuf9VY0
TLSH
T16576AE22EE068136F5C100B7927C5BBB6879AB301725A0D3E6945DEC59F48D2623FB1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato.woff

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
Size 36KB
SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
MD5 171937a8fad6a1c8a37344d09d4fc20c
SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
TLSH
T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop_down_icon.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
Size 449B
SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
MD5 60bd20b51eb0483e93aa6f4cb0a84288
SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
TLSH
T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
MD5 SHA1 SHA512 TLSH

Submit Download

info.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
Size 2KB
SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
MD5 d4893659007e98de701a47cd39991be3
SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
TLSH
T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
MD5 SHA1 SHA512 TLSH

Submit Download

Network_Connection.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
Size 436B
SHA256 d302afef78d4104ed12f386c6a386362eae608798ca34a9369c7813c24e66ad4
MD5 b90e2a5d59070565a67bab0d4d21af0e
SHA1 04b318c0e975a8f08bee65eddae54bfeedb1eafa
SHA512 c7b721be49df2b968e5758d91cfb12cc51d3d2bf49693a68c971d7e17ca02573108812c733c3fa2e815677e165c82e17000ad1d3049058276b06def66da12485
TLSH
T1D6E02BA4B5F540C7217A02440344BD319CE0048C51E782F3165E412C807BD83E8F0FF1
MD5 SHA1 SHA512 TLSH

Submit Download

Network_Connection.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
Size 1KB
SHA256 84db364e122538fbe58b2e9bd6edf75f5d9d92b5c07369d01018f151d290ebe5
MD5 8cbfc379a8cb43d3daf6493aa8520fe1
SHA1 5667aff7635002b3a13e02708b8ecb13bec417ce
SHA512 a221d9237076a7cf2ebb9104308182d0e778f9163b8e6fef180d3f2c88b1f9aa1d31fab8f253be57ae5c4afb17fa443dcb1fccf545c9eaf82303a8cdb663adde
TLSH
T1FB21F0B1B1F520C7267A024152547C32ECD4094D13A381F3564E922CA17FE97EAF6BB5
MD5 SHA1 SHA512 TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 102KB
SHA256 a730d34fbeb601ccfa25fd49d0f7b719238ac64258e9a86dc66cb4bddf27b21b
MD5 9895f25b20a710effe74fe61e20a27e5
SHA1 544b500adfa26bdb5222a6828ec5e6b701d85e30
SHA512 a33de827b3c6e2683bb07c666be5d7ac9ba10ecb10117663cfebb1637091bd609dbee015bc6900803e8936078017924ee76355428810161753efd13a23fa5f7b
SSDEEP 768:tg4fVD37zq35v9XxETIhw290KEGFGvvGWGpG/Gpbr8xhz6tUo33saw:NDGFG3GWGpG/GF/dw
TLSH
T10CA3694129BA30F6536A8947BE061B8BC6CF744C11A7FEA0736CB884579D8471FFE690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentservice.log
Size 6KB
SHA256 1985bb7375ba2d4ccfde5c5c3b60700415c0893254d865e2db80acd86df00a7c
MD5 1a5fa5584e26c7b7fef3c04204e8536f
SHA1 d611c5c2cbe7af9211d35c007c7bbc41e81fb6bf
SHA512 c4e98326e8e59d57a429db913722b1da02d157116f6833da9759a9054f4e3c9daee8d3b32c7425772c2c2219c98839454a72ab28c210be08a25e784bdbefb062
SSDEEP 192:P3eMzooooooooooooooooooooo1gZPXVXFmgX:aXXXXXXXXXXoPlh
TLSH
T1E4D1464124AB3CE3426B4D41AD130FD362CB746C116BA9D1337DBD958E7C99B8FAE290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcdatatransferdown.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
Size 4KB
SHA256 174d83ece348ca173eaccd0a597ac264871cf20736da3402cbcaa3214427731a
MD5 95b51bd59efc4191de617a4159efb1f0
SHA1 2baf504f9bf52de2973d76185a730ef192c86d56
SHA512 0c23643b4bd6e57eee29701b52daecf211fb63ba590b2d7fb68fba441139455d869a7287d5cc9092a9df65d23901d397c5095de8c3e2b33bf75158b3f52dd44c
SSDEEP 48:+7h1me+c23/EX24JhxEett2fcxZ2tsEm2miEgy2WuEG25p2VZz2j4PEP23Cp2P9S:+nmAriee8h3hD5hsMj16ejv
TLSH
T15CA12F6D179C84BA976D0ACFB15ED910C7D07C8BA2F12094FB448407D7E2B52FAF8A04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcdatatransferup.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferup.log
Size 453B
SHA256 56ef9b48b86817545b062e1f95d7ca1efc452c364ca7424a07953a6495650752
MD5 b84fd3ea45d3c67c9e0b710dd2970060
SHA1 0b296bf1034d4da00261e580347d95395cdbdcbb
SHA512 a3178103e5ed229f6c97b506d5b23ef57081ac60e05a0b5ec4997bea40fb1408e19b7902bf25de0619a408edbcf238046e93238ef7b4e8541d522a5cece46a14
TLSH
T17AF0D4190728647E84E54D8DF01BC044F7D56046506100D4F958D0438764FE75FF5708
MD5 SHA1 SHA512 TLSH

Submit Download

acp_component.zip

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip
Size 4.3MB
SHA256 15d89c01e1b9aaeaa3452004513419c221790f11315d17885f980313d81f2175
MD5 b8bb69272035b6d223710ac16630478a
SHA1 943b235c182d1ab7a48b8e328243a622864131f9
SHA512 1180efb2df668a67f6e557e5a2fdc3263c88a9fdbb69eabca38f1872ce72d83d4d6969e1892fadf139307f02e34c56b08fca29696ee06bd7f0a1e7cac5740ca2
SSDEEP 98304:t7JJB7mmzX5W48wOh2eJcCr2SvxujX7LlP8IKLVpAQQFe2WGY2w:HTX5W48wO+S5urx3w
TLSH
T15C2633C6C5DB7E58AA2012A76AFBA3D173F15D9830E753672806F9C0BCDCB5614B980C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.p12_749_4608

Path C:\Users\Admin\AppData\Local\Temp\Certificates\client.p12_749_4608
Size 1002B
SHA256 3977ebc5ffe2b05c6f6d3cb4f7531c0dc21c5c4a880fa90631db88d21d47a49c
MD5 2b4a5b6e35d75d2f60434c50ea88298f
SHA1 6a696ac284894b4ccbf8bd3aa090cfae2e647582
SHA512 255fb0b00a57b0e5f3803b78e7d36b0f6068191d836c55132c314db756ed99356455acea811a63709cccc79614c9be1d5e2fc65c3412dab4f97e4b23f77891e1
TLSH
T18511A536A82C1E5438EDDCCEA31D178314C5A3A24D0859F7D1F2A2C2295AF24B54CA68
MD5 SHA1 SHA512 TLSH

Submit Download

MSI6462.tmp

Path C:\Windows\Installer\MSI6462.tmp
Size 81KB
SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
MD5 e9b3f881f3855718fe6a4ed7855bae30
SHA1 cf19171cc1b2186c5e046c0a3195ce47532b215a
SHA512 50c04cc4ff234bb97192af5b437838f81e3930b1c2024dc13bd292ff85f6ddbaa670c7e2c2a1ca90d2c9e8de1b0ec4c1e7c2aa49ada80a0f4a42f9e461f41c26
SSDEEP 1536:A+xCoJw5hZFi1QmA2uFQW9z/gkcWBxk40OExFyoxM:nJw51i1PburjM+xEOExFy9
TLSH
T102837C117350C872E49A693468A9C7326D397D625EF884C77FD907794FA03C1AE3932B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585da4.msi

Path C:\Windows\Installer\e585da4.msi
Size 31.8MB
SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
MD5 db7ca603d463a06806ff1660979f406d
SHA1 823ade4e43d36416436a115c48ba562d94fa696f
SHA512 8e2527478514cf5ec8b40fa0ffc53d91ae72a1ba75a8c96800e06282b5e76e2f2f61f4b9e979c15f691591ee4f926b17aa07aebf31de68638b13e94db702b8d5
SSDEEP 786432:juvkjbX98hUIlkZpqcvX4kp1h1HnX6Jx5L3gxKF:ivk3X98hUUspqcvokD3yxU6
TLSH
T1FD77337234438836D5C26CB095E6C364D2A60D508EB42453A677B2BBDAF37C296F73E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagenthttp.dll

Path C:\Windows\SysWOW64\dcagenthttp.dll
Size 3.6MB
SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
MD5 c943a1cdbcd28058068b921cc8daa04e
SHA1 2694d3588167cc0f940a30a5f4b13793e0cf181e
SHA512 d5bee6a3a43d4b04e41d177af022ff03ac8a2971f0cc79265e00d027294e56b1de289773e487dba60664a6c9ba3d9f2f26bdd5453cc9220cd8313adf1868fd24
SSDEEP 49152:eGvD7zfSmnd1o2Mm0A1qga6zN/zuNscwOWbKikCDp9ZqljvLQTeDTtJb83ph9h7Q:1D7zqmnd1oT4XN/zuNsSikq6Lzbs9VQ
TLSH
T1D106BF11FF82C176FECE1176827A4F7E4D3A9744076649C767A43AB80E311E26A3E247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dclibxml2.dll

Path C:\Windows\SysWOW64\dclibxml2.dll
Size 2.1MB
SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
MD5 67cc424838fda84bad295b4459107c8b
SHA1 404f865e84e6338735a0c38617d73031195c520f
SHA512 1a3232bed3826065416a50866d02827765c66104ed49c533324f0cb614745028411bda63784f4f8c3819f9a72e65016171179d80d484d10e52300eaffbd44397
SSDEEP 49152:e9DUM26DYbVgzTtuKlKuuGaXKbj/BAUZLYM7:TMfQgRBBAUZLT
TLSH
T1F9A5AE15F981C176E5E6807486FEEBB6982ECD31232460E376A639D45E341E232BD34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CM22B57.tmp

Path C:\Windows\System32\config\systemprofile\AppData\Local\CM22B57.tmp
Size 1KB
SHA256 0ed81b6a3507e2ea087cd92494a43ae25bee30c345842836d982db6cba1a8aa5
MD5 0c537a0f77f299315fe430df0dfdc399
SHA1 065e3237839f1ebd9f427af73dc0502b56d717c1
SHA512 d9bc93f314ab123e0cc413ae44babf3adf022438c3d45047fe0db73c40530bddc2f4bdb191d7e550c059adb22b0df8119548ee8c48bb449f595e3d47eaa7b65c
TLSH
T19121240977FA774CF0E2A7B8DA3703274631EE3AAC45814D0360660948A6D10AF77B77
MD5 SHA1 SHA512 TLSH

Submit Download

unauthmessages

Path C:\Windows\System32\config\systemprofile\AppData\Local\PushRouter\unauthmessages
Size 18B
SHA256 b507c40082bc7bbbc2c490c5201205e107ae346819a61d430c592ada958b3fb0
MD5 715530d9baf1e14bbb43f88c9a17e57c
SHA1 15ef0737f2a53ca2552941cc6618ae76c5cdd7bd
SHA512 6a1b7eaccfe039561e6d06a501d88e7da4fd26d63cc01ebec5a090d7b478c455d83bb24a03c9a48ee76ee07dcf4484007c0b511dd79cf7d779b2ccb178e946cd
MD5 SHA1 SHA512

Submit Download

unauthmessages.out

Path C:\Windows\System32\config\systemprofile\AppData\Local\PushRouter\unauthmessages.out
Size 803B
SHA256 e816a9a2e940ea34de8b2add945ea04ae1294166a659e0cce3ecd58ca6db7042
MD5 147afec09c48926198b20606c45b25b6
SHA1 a8b9c622c2d0c75f3139a6e436168f8c9d64906d
SHA512 ba98bf18f681b429736ed77d654664e17a73a720c521a5f232a6ed8c40edf67d846cbc000d76f607a5f0d1dd030bdd8c8ba3b6715370da8f2e4579f2730faf05
TLSH
T138018E75FA64B9698F7B72916ADA5CA81CD0134B47B208A3B781C432BD8690CCA0336C
MD5 SHA1 SHA512 TLSH

Submit Download

D734EC268DFD451C5CDE81AFDEC6411C6A90C565

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D734EC268DFD451C5CDE81AFDEC6411C6A90C565
Size 1KB
SHA256 70bcb2a55e6168cf12e892478610f528078d4f63fa7c376216c81af4346cb4ac
MD5 f72d244c9dcbb50e72cd5aca70509782
SHA1 280ea6e0068d465015e4ad477e81ab63df0e08f2
SHA512 e9ac18ab3fc15f6b30bb0b688da062068a5fa7205912320e40d6b2b47df12ab8e8135ccd8ba41eb798a5ae1b2de07acbd01f3194a6974a4a6376b30bdfe5d22a
TLSH
T1972186635F682847FAC1BC37AC424F3406B2F971C2588889205A01661E602D1272320F
MD5 SHA1 SHA512 TLSH

Submit Download