Overview
overview
8Static
static
1README.html
windows10-2004-x64
3README.html
windows11-ltsc_2024-x64
3RemCom.exe
windows10-2004-x64
3RemCom.exe
windows11-ltsc_2024-x64
3UEMSAgent.msi
windows10-2004-x64
7UEMSAgent.msi
windows11-ltsc_2024-x64
7dcremagent...er.exe
windows10-2004-x64
3dcremagent...er.exe
windows11-ltsc_2024-x64
3setup.bat
windows10-2004-x64
3setup.bat
windows11-ltsc_2024-x64
3setup1.vbs
windows10-2004-x64
7setup1.vbs
windows11-ltsc_2024-x64
8Analysis
- max time kernel
135s - max time network
158s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
README.html
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
README.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
RemCom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
RemCom.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
UEMSAgent.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral6
Sample
UEMSAgent.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
dcremagentinstaller.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
dcremagentinstaller.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
setup.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
setup.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
setup1.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral12
Sample
setup1.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
29 signatures
150 seconds
General
- Target setup1.vbs
- Size 1KB
- Sample260723-w22phahn4x
- SHA256 33633ef8abb63a5ed8bcd1cf78e90f80438bb0236afe59714bfff83d73410428
- MD5 0112c726a741f3351dcd1872ad6aa013
- SHA1 7f9f98f388abdc938fc0c2d162233b93c822b809
- SHA512 a2d1e96fe4f73772743e0f64d392515dccd124526fcd69c8607be71842bd95b8c184c58547c2f10f124ed1f9cdbb10466ecde7a2076b6d2ddd1f22630d9d1ac0
- TLSH T15431251B99644A07D4D2C65321F37C5C9F7A6A57000882B735A9DC9883D83639F5F237
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\DCFAFilter.sys driversetup64.exe File opened for modification C:\Windows\system32\DRIVERS\SET2E21.tmp driversetup64.exe File created C:\Windows\system32\DRIVERS\SET2E21.tmp driversetup64.exe - Executes dropped EXE 55 IoCs
pid Process 3620 dcagentregister.exe 5580 7za.exe 5384 dcagentservice.exe 5076 dcstatusutil.exe 1884 dcagentservice.exe 3044 dcinventory.exe 5504 dcusbsummary.exe 3412 dcconfig.exe 4972 dcusb64.exe 5776 dcstatusutil.exe 2668 dcondemand.exe 4564 dcswmeter.exe 976 dcinventory.exe 2112 metroapps.exe 1712 dcconfig.exe 1992 dcinventory.exe 5520 DCProcessMonitor.exe 3612 7za.exe 2264 7za.exe 4348 7za.exe 6068 7za.exe 1156 7za.exe 2540 7za.exe 2324 7za.exe 4460 meaap.exe 5376 meaaphelper.exe 2468 7za.exe 5060 VerifyTrustedFiles.exe 4236 VerifyTrustedFiles.exe 1440 dcprocmon.exe 2540 dcconfig.exe 4432 NotifDriver_W10x64.sys 2924 ACPipelogServer.exe 1360 Privilager.exe 4224 meaaphelper.exe 1540 7za.exe 1740 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 2280 7za.exe 2112 uesAgentService.exe 4328 driversetup64.exe 5816 driversetup64.exe 252 uesFaUser.exe 4116 uesDevCtrlSummary.exe 3008 devctrlaction64.exe 4316 DCFAFilter.sys 2500 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 4764 meaaphelper.exe 3024 7za.exe 4792 7za.exe 4192 meaaphelper.exe 4808 meaaphelper.exe 6048 7za.exe 5360 bmagent.exe - Loads dropped DLL 64 IoCs
pid Process 240 MsiExec.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 5384 dcagentservice.exe 5384 dcagentservice.exe 5076 dcstatusutil.exe 5076 dcstatusutil.exe 5076 dcstatusutil.exe 1884 dcagentservice.exe 1884 dcagentservice.exe 3044 dcinventory.exe 3044 dcinventory.exe 5504 dcusbsummary.exe 5504 dcusbsummary.exe 3044 dcinventory.exe 3412 dcconfig.exe 3412 dcconfig.exe 3412 dcconfig.exe 5776 dcstatusutil.exe 5776 dcstatusutil.exe 2668 dcondemand.exe 2668 dcondemand.exe 5776 dcstatusutil.exe 2668 dcondemand.exe 4564 dcswmeter.exe 4564 dcswmeter.exe 976 dcinventory.exe 976 dcinventory.exe 2668 dcondemand.exe 2668 dcondemand.exe 976 dcinventory.exe 2112 metroapps.exe 2112 metroapps.exe 2112 metroapps.exe 2112 metroapps.exe 2112 metroapps.exe 1712 dcconfig.exe 1712 dcconfig.exe 1992 dcinventory.exe 1992 dcinventory.exe 1712 dcconfig.exe 4460 meaap.exe 4460 meaap.exe 4460 meaap.exe 5376 meaaphelper.exe 5376 meaaphelper.exe 5376 meaaphelper.exe 2540 dcconfig.exe 2540 dcconfig.exe 4224 meaaphelper.exe 4224 meaaphelper.exe 4224 meaaphelper.exe 1740 dcagenttrayicon.exe 1740 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 4224 meaaphelper.exe 4224 meaaphelper.exe 2500 dcagenttrayicon.exe 2500 dcagenttrayicon.exe 1852 dcagenttrayicon.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 3 3940 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 5816 powercfg.exe 5064 powercfg.exe 2988 powercfg.exe 5752 powercfg.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{1d0ff0a3-985e-5244-beac-256cd9d04451} DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0972B7C417F696E06E186AEB26286F01_6DEFC1B0F00B73D870DAEE9AD78095DA dcprocmon.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini meaaphelper.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content dcagentregister.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1d0ff0a3-985e-5244-beac-256cd9d04451}\DCFAFilter.sys DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8BD11C4A2318EC8E5A82462092971DEA dcprocmon.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI meaaphelper.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600 dcprocmon.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1d0ff0a3-985e-5244-beac-256cd9d04451}\DCFAFilter.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5F3BC5C5F7FAA52EBA878B0B3A4A5C86 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5F3BC5C5F7FAA52EBA878B0B3A4A5C86 dcprocmon.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D dcprocmon.exe File created C:\Windows\System32\DriverStore\Temp\{1d0ff0a3-985e-5244-beac-256cd9d04451}\SET2DC3.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8BD11C4A2318EC8E5A82462092971DEA dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_986C7EDF85F5859081F49AE7B6205CDD dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C3E814D1CB223AFCD58214D14C3B7EAB dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3D0AC26322348780E90E022EA217C58C dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\398EE64D66758B5715368AA94044B13A dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\229169D96B9C20761B929D428962A0A2_E1B17CAB62C1FF675B22B2FC5D3FEABF dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\229169D96B9C20761B929D428962A0A2_E724097EF7BBA8B1CB3228AA4D2ED312 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1d0ff0a3-985e-5244-beac-256cd9d04451}\SET2DC3.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3D0AC26322348780E90E022EA217C58C dcprocmon.exe File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1d0ff0a3-985e-5244-beac-256cd9d04451}\DCFAFilter.cat DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\229169D96B9C20761B929D428962A0A2_FC65190A8D1232A1711F16F9F20C5149 dcprocmon.exe File created C:\Windows\SysWOW64\dcagenthttp.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A dcprocmon.exe File created C:\Windows\System32\DriverStore\Temp\{1d0ff0a3-985e-5244-beac-256cd9d04451}\SET2DD4.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\229169D96B9C20761B929D428962A0A2_E1B17CAB62C1FF675B22B2FC5D3FEABF dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\398EE64D66758B5715368AA94044B13A dcprocmon.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_a1fe82a86eaecabd\keyboard.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC dcprocmon.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1d0ff0a3-985e-5244-beac-256cd9d04451}\SET2DD4.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1d0ff0a3-985e-5244-beac-256cd9d04451}\SET2DD5.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_7AA1872B10F7F2428A1288E96F0B99FA dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_986C7EDF85F5859081F49AE7B6205CDD dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\229169D96B9C20761B929D428962A0A2_FC65190A8D1232A1711F16F9F20C5149 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8 dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0972B7C417F696E06E186AEB26286F01_6DEFC1B0F00B73D870DAEE9AD78095DA dcprocmon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_E93D4349D1D2AF4AE2F3CBFF382A5C9D dcprocmon.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5424 WScript.exe 6096 wscript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\icon_software.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\messagebox_warning.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf dcinventory.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-info.xml dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\Native-Messaging-Host-Manifest.json meaaphelper.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\Firefox_manifest.json meaaphelper.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\3\uesAgentTrayIcon.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\sspicon.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dropdown_hover.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\approval_status.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_agentserviceaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_agentserviceaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\ec_acp64service.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentupgrade.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DetouredDll64.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\secaddoncrashanalyser.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\MANIFEST-000001 VerifyTrustedFiles.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcswmeteraccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\PocoCrypto.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesFaService.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\4\Newtonsoft.Json.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ns-status-details.xml5024.tmp dcondemand.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\PocoCrypto.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json4492.tmp meaap.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcipscope.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_agentaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcfilteraccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win7\DCFAFilter.inf 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\InitCmd.bat msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rdsrunasuser.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\ACPAccessGranted.svg 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaphelper.log meaaphelper.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\tools_reboot_alert.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UIControls.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip4492.tmp meaap.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\reboot_alert.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcPrivateKeys.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcconfigaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\msvcr110.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_agentaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaphelper.log meaaphelper.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcswmetercollector.log dcswmeter.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\3\BitlockerMgmt.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W7x86.sys 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\3\EncryptionManager.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_computer.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win8.1\dcfafilter.cat 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\wsClientSocket.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentslotrequest.log dcstatusutil.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\LOCK VerifyTrustedFiles.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\AppControlEvent.json VerifyTrustedFiles.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win8\DCFAFilter.sys 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\msvcp110.dll 7za.exe - Drops file in Windows directory 23 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI697F.tmp msiexec.exe File created C:\Windows\Installer\e595ee0.mst msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\Installer\MSIC84A.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFB5A5E2F85AD87C33.TMP msiexec.exe File created C:\Windows\Installer\e595edf.msi msiexec.exe File opened for modification C:\Windows\Installer\e595edf.msi msiexec.exe File created C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\e595ee0.mst msiexec.exe File opened for modification C:\Windows\Installer\MSI6586.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File created C:\Windows\SystemTemp\~DF2E71D2C84837A3DC.TMP msiexec.exe File opened for modification C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\SystemTemp\~DF28147F92EDFE3219.TMP msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File created C:\Windows\Installer\e595ee7.msi msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File created C:\Windows\SystemTemp\~DF1286B282956069B9.TMP msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log driversetup64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2992 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 8 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F0FF466E7A9CA9AAE59DBC9507090889B4F7DA21\Blob = 030000000100000014000000f0ff466e7a9ca9aae59dbc9507090889b4f7da21200000000100000029040000308204253082030da00302010202087b7c9525f964634a300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303631313038323630305a180f32313236303631313038323630305a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b9077558e05bd9e671d90ece54b0ffdc979cef42281cf5310a0d957fccd20fc5201712bac3ac9f7af1c17439c19305ef96e8d68340eb435713a1170d5d18b5962df0de7e8b7d2e9fff49686284182c867a1567d4f1a647218061646dd641bd5ec0b295bec55c50f779e6b02327a1f580cca306893d817aa8fc979c02d294a98588564ecb71d8540ba499f70cdd7316604d5d02fcaa9d5fb966f5a792699b5ecb43cb8d9b80f392771805a5150a6f875d3a35c41d3ba81269c64c06e9c8711ba792bd2a5a2b6359cb7df6fb96ddd9d578b756d42c22ca4fd0ce8a0e17f74c8072bd20a71586a8e1869f1aadff627c4924117678450e7565bfeee7c7239b8410350203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0301f0603551d23041830168014fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101001185242bf4008fd96814aeaf76d0bc97f05dcc438ba22e2f08c0bcf788afba3c965e463e1fc82a8492703b2b7000defb0b47fd331608593d7909e0040ae640fa89dcc2ec1a903a6272c691ba773f59875f63bed8dd94ed1a5869cfd177de2016f4a53fef06bae7997d49ee4d6c6699316fafeb143efa1700359b80865fc7f0bc26d9533996734308538352f25a3bc96b13cbd5ff4233a80559220e5846391201b5a8466bf817f737f4510d1512d1b4d43244b55666d2c8f6f999f1f42e5896cff936dc756f44a6bd13d9b39c794ba895c3e860514712ccff0d4803a49cca2c004e042977f0a70e7274cbf4efbfd424cb2913aff22545dfd898db7580a467c60d dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F0FF466E7A9CA9AAE59DBC9507090889B4F7DA21\Blob = 140000000100000014000000fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0030000000100000014000000f0ff466e7a9ca9aae59dbc9507090889b4f7da210f000000010000002000000033cc9f849733c66a8ebc240509eef379195829f0eaa456ca7adaff8112a57751200000000100000029040000308204253082030da00302010202087b7c9525f964634a300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303631313038323630305a180f32313236303631313038323630305a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b9077558e05bd9e671d90ece54b0ffdc979cef42281cf5310a0d957fccd20fc5201712bac3ac9f7af1c17439c19305ef96e8d68340eb435713a1170d5d18b5962df0de7e8b7d2e9fff49686284182c867a1567d4f1a647218061646dd641bd5ec0b295bec55c50f779e6b02327a1f580cca306893d817aa8fc979c02d294a98588564ecb71d8540ba499f70cdd7316604d5d02fcaa9d5fb966f5a792699b5ecb43cb8d9b80f392771805a5150a6f875d3a35c41d3ba81269c64c06e9c8711ba792bd2a5a2b6359cb7df6fb96ddd9d578b756d42c22ca4fd0ce8a0e17f74c8072bd20a71586a8e1869f1aadff627c4924117678450e7565bfeee7c7239b8410350203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0301f0603551d23041830168014fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101001185242bf4008fd96814aeaf76d0bc97f05dcc438ba22e2f08c0bcf788afba3c965e463e1fc82a8492703b2b7000defb0b47fd331608593d7909e0040ae640fa89dcc2ec1a903a6272c691ba773f59875f63bed8dd94ed1a5869cfd177de2016f4a53fef06bae7997d49ee4d6c6699316fafeb143efa1700359b80865fc7f0bc26d9533996734308538352f25a3bc96b13cbd5ff4233a80559220e5846391201b5a8466bf817f737f4510d1512d1b4d43244b55666d2c8f6f999f1f42e5896cff936dc756f44a6bd13d9b39c794ba895c3e860514712ccff0d4803a49cca2c004e042977f0a70e7274cbf4efbfd424cb2913aff22545dfd898db7580a467c60d dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AABAAE765985C3E84DC83C86E357041657F74D37\Blob = 140000000100000014000000bb1919f7a4fbe9bea36da34565eaf42bdf08d868030000000100000014000000aabaae765985c3e84dc83c86e357041657f74d370f000000010000002000000064024d920862786cea0ffa177ff73449425cc1aaf7b531d7dbe5d9edce07f5c32000000001000000af030000308203ab30820293a00302010202087f8550312f533e53300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303631313038323335315a180f32313236303631313038323335315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ee8637410c24343e7fcf5687132f91de20785b40629aaf0bcef87f7f8e0078e387178352d92b8d68411f69b0897ffe111cf59ac8cc4d92a9ce861df08d65af9a4e95517e9066de1a6c68845bceee39d6a3303096b925c7074776421509c61b274b1bb3b9d0f9f8bc1d2acb87d533ec62eb62d3942bea375218dafe3f49484387f270f66568c9b88d01dfb4fce598f171a15e88c5c7b19989ae5547d306763ff20e8c8fa8935c6232a059a15c8d4a295ae45035d4678fb6d991c7642a14b4b0037ef1196deb87a4af8e32dbc75972ada39e28d67a61d56079d22004f3ade4567e7fa47bcbcbd13525a13de0986bc9175f879aa90da602716b9adc52eba7fe17c90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414bb1919f7a4fbe9bea36da34565eaf42bdf08d868301f0603551d23041830168014bb1919f7a4fbe9bea36da34565eaf42bdf08d868300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b7cdc531522b00864f0fc0193c2868d7f767359153068c9f78e66d5822492f4d793037abae38fd34f58e298db8c3822e89d95149cd8a7b0f8ca05f807894cc81b5856c04d36933a5938cba1a26dbd984ace5f84f777f2c650d27ac2f257324fced2ccdd53ceaf55542c8139d0e7252ff9b4ede44c78e7c78ba2d98e584f82fe2aebeb93ffcc55c4daf016f8517bd55978702129a66ae0c387b7b638b1ed02bed845c845ae6ae7961c68ccc05fa9cc9f24290da3e0fe162fc26b0e9096e2617f77436c792de6b1714836fc11e1f8425c6be9f07010f38aa2cecb2248bde17440aa02f2bd15cf3a15726990e1168fcc8f5fefc436d483c6b0060413095fe65d51f dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AABAAE765985C3E84DC83C86E357041657F74D37\Blob = 6b00000001000000200000004d33a23e41dc94a8ce800881f2dc62da66c6a28f38ac7698654729bb494a69d30f000000010000002000000064024d920862786cea0ffa177ff73449425cc1aaf7b531d7dbe5d9edce07f5c3030000000100000014000000aabaae765985c3e84dc83c86e357041657f74d37140000000100000014000000bb1919f7a4fbe9bea36da34565eaf42bdf08d8682000000001000000af030000308203ab30820293a00302010202087f8550312f533e53300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303631313038323335315a180f32313236303631313038323335315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ee8637410c24343e7fcf5687132f91de20785b40629aaf0bcef87f7f8e0078e387178352d92b8d68411f69b0897ffe111cf59ac8cc4d92a9ce861df08d65af9a4e95517e9066de1a6c68845bceee39d6a3303096b925c7074776421509c61b274b1bb3b9d0f9f8bc1d2acb87d533ec62eb62d3942bea375218dafe3f49484387f270f66568c9b88d01dfb4fce598f171a15e88c5c7b19989ae5547d306763ff20e8c8fa8935c6232a059a15c8d4a295ae45035d4678fb6d991c7642a14b4b0037ef1196deb87a4af8e32dbc75972ada39e28d67a61d56079d22004f3ade4567e7fa47bcbcbd13525a13de0986bc9175f879aa90da602716b9adc52eba7fe17c90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414bb1919f7a4fbe9bea36da34565eaf42bdf08d868301f0603551d23041830168014bb1919f7a4fbe9bea36da34565eaf42bdf08d868300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b7cdc531522b00864f0fc0193c2868d7f767359153068c9f78e66d5822492f4d793037abae38fd34f58e298db8c3822e89d95149cd8a7b0f8ca05f807894cc81b5856c04d36933a5938cba1a26dbd984ace5f84f777f2c650d27ac2f257324fced2ccdd53ceaf55542c8139d0e7252ff9b4ede44c78e7c78ba2d98e584f82fe2aebeb93ffcc55c4daf016f8517bd55978702129a66ae0c387b7b638b1ed02bed845c845ae6ae7961c68ccc05fa9cc9f24290da3e0fe162fc26b0e9096e2617f77436c792de6b1714836fc11e1f8425c6be9f07010f38aa2cecb2248bde17440aa02f2bd15cf3a15726990e1168fcc8f5fefc436d483c6b0060413095fe65d51f dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AABAAE765985C3E84DC83C86E357041657F74D37\Blob = 190000000100000010000000633960e020b8567a4c8dcc5d3d6016bf140000000100000014000000bb1919f7a4fbe9bea36da34565eaf42bdf08d868030000000100000014000000aabaae765985c3e84dc83c86e357041657f74d370f000000010000002000000064024d920862786cea0ffa177ff73449425cc1aaf7b531d7dbe5d9edce07f5c36b00000001000000200000004d33a23e41dc94a8ce800881f2dc62da66c6a28f38ac7698654729bb494a69d32000000001000000af030000308203ab30820293a00302010202087f8550312f533e53300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303631313038323335315a180f32313236303631313038323335315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ee8637410c24343e7fcf5687132f91de20785b40629aaf0bcef87f7f8e0078e387178352d92b8d68411f69b0897ffe111cf59ac8cc4d92a9ce861df08d65af9a4e95517e9066de1a6c68845bceee39d6a3303096b925c7074776421509c61b274b1bb3b9d0f9f8bc1d2acb87d533ec62eb62d3942bea375218dafe3f49484387f270f66568c9b88d01dfb4fce598f171a15e88c5c7b19989ae5547d306763ff20e8c8fa8935c6232a059a15c8d4a295ae45035d4678fb6d991c7642a14b4b0037ef1196deb87a4af8e32dbc75972ada39e28d67a61d56079d22004f3ade4567e7fa47bcbcbd13525a13de0986bc9175f879aa90da602716b9adc52eba7fe17c90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414bb1919f7a4fbe9bea36da34565eaf42bdf08d868301f0603551d23041830168014bb1919f7a4fbe9bea36da34565eaf42bdf08d868300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b7cdc531522b00864f0fc0193c2868d7f767359153068c9f78e66d5822492f4d793037abae38fd34f58e298db8c3822e89d95149cd8a7b0f8ca05f807894cc81b5856c04d36933a5938cba1a26dbd984ace5f84f777f2c650d27ac2f257324fced2ccdd53ceaf55542c8139d0e7252ff9b4ede44c78e7c78ba2d98e584f82fe2aebeb93ffcc55c4daf016f8517bd55978702129a66ae0c387b7b638b1ed02bed845c845ae6ae7961c68ccc05fa9cc9f24290da3e0fe162fc26b0e9096e2617f77436c792de6b1714836fc11e1f8425c6be9f07010f38aa2cecb2248bde17440aa02f2bd15cf3a15726990e1168fcc8f5fefc436d483c6b0060413095fe65d51f dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AABAAE765985C3E84DC83C86E357041657F74D37\Blob = 5c0000000100000004000000000800006b00000001000000200000004d33a23e41dc94a8ce800881f2dc62da66c6a28f38ac7698654729bb494a69d30f000000010000002000000064024d920862786cea0ffa177ff73449425cc1aaf7b531d7dbe5d9edce07f5c3030000000100000014000000aabaae765985c3e84dc83c86e357041657f74d37140000000100000014000000bb1919f7a4fbe9bea36da34565eaf42bdf08d868190000000100000010000000633960e020b8567a4c8dcc5d3d6016bf2000000001000000af030000308203ab30820293a00302010202087f8550312f533e53300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303631313038323335315a180f32313236303631313038323335315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ee8637410c24343e7fcf5687132f91de20785b40629aaf0bcef87f7f8e0078e387178352d92b8d68411f69b0897ffe111cf59ac8cc4d92a9ce861df08d65af9a4e95517e9066de1a6c68845bceee39d6a3303096b925c7074776421509c61b274b1bb3b9d0f9f8bc1d2acb87d533ec62eb62d3942bea375218dafe3f49484387f270f66568c9b88d01dfb4fce598f171a15e88c5c7b19989ae5547d306763ff20e8c8fa8935c6232a059a15c8d4a295ae45035d4678fb6d991c7642a14b4b0037ef1196deb87a4af8e32dbc75972ada39e28d67a61d56079d22004f3ade4567e7fa47bcbcbd13525a13de0986bc9175f879aa90da602716b9adc52eba7fe17c90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414bb1919f7a4fbe9bea36da34565eaf42bdf08d868301f0603551d23041830168014bb1919f7a4fbe9bea36da34565eaf42bdf08d868300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b7cdc531522b00864f0fc0193c2868d7f767359153068c9f78e66d5822492f4d793037abae38fd34f58e298db8c3822e89d95149cd8a7b0f8ca05f807894cc81b5856c04d36933a5938cba1a26dbd984ace5f84f777f2c650d27ac2f257324fced2ccdd53ceaf55542c8139d0e7252ff9b4ede44c78e7c78ba2d98e584f82fe2aebeb93ffcc55c4daf016f8517bd55978702129a66ae0c387b7b638b1ed02bed845c845ae6ae7961c68ccc05fa9cc9f24290da3e0fe162fc26b0e9096e2617f77436c792de6b1714836fc11e1f8425c6be9f07010f38aa2cecb2248bde17440aa02f2bd15cf3a15726990e1168fcc8f5fefc436d483c6b0060413095fe65d51f dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F0FF466E7A9CA9AAE59DBC9507090889B4F7DA21\Blob = 1900000001000000100000009c5bfd79a56938bb1adca01dad6ca3eb0f000000010000002000000033cc9f849733c66a8ebc240509eef379195829f0eaa456ca7adaff8112a57751030000000100000014000000f0ff466e7a9ca9aae59dbc9507090889b4f7da21140000000100000014000000fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0200000000100000029040000308204253082030da00302010202087b7c9525f964634a300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303631313038323630305a180f32313236303631313038323630305a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b9077558e05bd9e671d90ece54b0ffdc979cef42281cf5310a0d957fccd20fc5201712bac3ac9f7af1c17439c19305ef96e8d68340eb435713a1170d5d18b5962df0de7e8b7d2e9fff49686284182c867a1567d4f1a647218061646dd641bd5ec0b295bec55c50f779e6b02327a1f580cca306893d817aa8fc979c02d294a98588564ecb71d8540ba499f70cdd7316604d5d02fcaa9d5fb966f5a792699b5ecb43cb8d9b80f392771805a5150a6f875d3a35c41d3ba81269c64c06e9c8711ba792bd2a5a2b6359cb7df6fb96ddd9d578b756d42c22ca4fd0ce8a0e17f74c8072bd20a71586a8e1869f1aadff627c4924117678450e7565bfeee7c7239b8410350203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0301f0603551d23041830168014fcd32c6fc635c4ddd136e3a1b83ab1cf242c6bd0300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101001185242bf4008fd96814aeaf76d0bc97f05dcc438ba22e2f08c0bcf788afba3c965e463e1fc82a8492703b2b7000defb0b47fd331608593d7909e0040ae640fa89dcc2ec1a903a6272c691ba773f59875f63bed8dd94ed1a5869cfd177de2016f4a53fef06bae7997d49ee4d6c6699316fafeb143efa1700359b80865fc7f0bc26d9533996734308538352f25a3bc96b13cbd5ff4233a80559220e5846391201b5a8466bf817f737f4510d1512d1b4d43244b55666d2c8f6f999f1f42e5896cff936dc756f44a6bd13d9b39c794ba895c3e860514712ccff0d4803a49cca2c004e042977f0a70e7274cbf4efbfd424cb2913aff22545dfd898db7580a467c60d dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AABAAE765985C3E84DC83C86E357041657F74D37\Blob = 030000000100000014000000aabaae765985c3e84dc83c86e357041657f74d372000000001000000af030000308203ab30820293a00302010202087f8550312f533e53300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303631313038323335315a180f32313236303631313038323335315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ee8637410c24343e7fcf5687132f91de20785b40629aaf0bcef87f7f8e0078e387178352d92b8d68411f69b0897ffe111cf59ac8cc4d92a9ce861df08d65af9a4e95517e9066de1a6c68845bceee39d6a3303096b925c7074776421509c61b274b1bb3b9d0f9f8bc1d2acb87d533ec62eb62d3942bea375218dafe3f49484387f270f66568c9b88d01dfb4fce598f171a15e88c5c7b19989ae5547d306763ff20e8c8fa8935c6232a059a15c8d4a295ae45035d4678fb6d991c7642a14b4b0037ef1196deb87a4af8e32dbc75972ada39e28d67a61d56079d22004f3ade4567e7fa47bcbcbd13525a13de0986bc9175f879aa90da602716b9adc52eba7fe17c90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414bb1919f7a4fbe9bea36da34565eaf42bdf08d868301f0603551d23041830168014bb1919f7a4fbe9bea36da34565eaf42bdf08d868300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b7cdc531522b00864f0fc0193c2868d7f767359153068c9f78e66d5822492f4d793037abae38fd34f58e298db8c3822e89d95149cd8a7b0f8ca05f807894cc81b5856c04d36933a5938cba1a26dbd984ace5f84f777f2c650d27ac2f257324fced2ccdd53ceaf55542c8139d0e7252ff9b4ede44c78e7c78ba2d98e584f82fe2aebeb93ffcc55c4daf016f8517bd55978702129a66ae0c387b7b638b1ed02bed845c845ae6ae7961c68ccc05fa9cc9f24290da3e0fe162fc26b0e9096e2617f77436c792de6b1714836fc11e1f8425c6be9f07010f38aa2cecb2248bde17440aa02f2bd15cf3a15726990e1168fcc8f5fefc436d483c6b0060413095fe65d51f dcagentregister.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCProcessMonitor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcprocmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VerifyTrustedFiles.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uesFaUser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagenttrayicon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcswmeter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bmagent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language metroapps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uesDevCtrlSummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VerifyTrustedFiles.exe - Checks SCSI registry key(s) 3 TTPs 30 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 uesFaUser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 uesFaUser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 uesFaUser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom uesFaUser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags uesFaUser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 uesFaUser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom uesFaUser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags uesFaUser.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ACPipelogServer.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ACPipelogServer.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2816 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs VerifyTrustedFiles.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcprocmon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{7A643118-6DFC-41D3-B3AA-A96A1A5EC338}User meaaphelper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs VerifyTrustedFiles.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects meaaphelper.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root VerifyTrustedFiles.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates bmagent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs bmagent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcprocmon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcprocmon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes metroapps.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs bmagent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs VerifyTrustedFiles.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs bmagent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs VerifyTrustedFiles.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcstatusutil.exe - Modifies registry class 23 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "167772210" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "44C40189C3AA44442AA780ED114A0026" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AABAAE765985C3E84DC83C86E357041657F74D37 dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F0FF466E7A9CA9AAE59DBC9507090889B4F7DA21 dcagentregister.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe 3620 dcagentregister.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 812 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5816 powercfg.exe Token: SeCreatePagefilePrivilege 5816 powercfg.exe Token: SeShutdownPrivilege 5064 powercfg.exe Token: SeCreatePagefilePrivilege 5064 powercfg.exe Token: SeShutdownPrivilege 2988 powercfg.exe Token: SeCreatePagefilePrivilege 2988 powercfg.exe Token: SeShutdownPrivilege 5752 powercfg.exe Token: SeCreatePagefilePrivilege 5752 powercfg.exe Token: SeShutdownPrivilege 5752 powercfg.exe Token: SeCreatePagefilePrivilege 5752 powercfg.exe Token: SeShutdownPrivilege 916 msiexec.exe Token: SeIncreaseQuotaPrivilege 916 msiexec.exe Token: SeSecurityPrivilege 3940 msiexec.exe Token: SeCreateTokenPrivilege 916 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 916 msiexec.exe Token: SeLockMemoryPrivilege 916 msiexec.exe Token: SeIncreaseQuotaPrivilege 916 msiexec.exe Token: SeMachineAccountPrivilege 916 msiexec.exe Token: SeTcbPrivilege 916 msiexec.exe Token: SeSecurityPrivilege 916 msiexec.exe Token: SeTakeOwnershipPrivilege 916 msiexec.exe Token: SeLoadDriverPrivilege 916 msiexec.exe Token: SeSystemProfilePrivilege 916 msiexec.exe Token: SeSystemtimePrivilege 916 msiexec.exe Token: SeProfSingleProcessPrivilege 916 msiexec.exe Token: SeIncBasePriorityPrivilege 916 msiexec.exe Token: SeCreatePagefilePrivilege 916 msiexec.exe Token: SeCreatePermanentPrivilege 916 msiexec.exe Token: SeBackupPrivilege 916 msiexec.exe Token: SeRestorePrivilege 916 msiexec.exe Token: SeShutdownPrivilege 916 msiexec.exe Token: SeDebugPrivilege 916 msiexec.exe Token: SeAuditPrivilege 916 msiexec.exe Token: SeSystemEnvironmentPrivilege 916 msiexec.exe Token: SeChangeNotifyPrivilege 916 msiexec.exe Token: SeRemoteShutdownPrivilege 916 msiexec.exe Token: SeUndockPrivilege 916 msiexec.exe Token: SeSyncAgentPrivilege 916 msiexec.exe Token: SeEnableDelegationPrivilege 916 msiexec.exe Token: SeManageVolumePrivilege 916 msiexec.exe Token: SeImpersonatePrivilege 916 msiexec.exe Token: SeCreateGlobalPrivilege 916 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe Token: SeRestorePrivilege 5580 7za.exe Token: 35 5580 7za.exe Token: SeSecurityPrivilege 5580 7za.exe Token: SeSecurityPrivilege 5580 7za.exe Token: SeDebugPrivilege 5504 dcusbsummary.exe Token: SeDebugPrivilege 4564 dcswmeter.exe Token: SeRestorePrivilege 3940 msiexec.exe Token: SeTakeOwnershipPrivilege 3940 msiexec.exe - Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 5704 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe - Suspicious use of SendNotifyMessage 29 IoCs
pid Process 5704 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 5704 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe 1852 dcagenttrayicon.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 916 msiexec.exe 3940 msiexec.exe 240 MsiExec.exe 5504 dcusbsummary.exe - Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 5424 wrote to memory of 6096 5424 WScript.exe 89 PID 6096 wrote to memory of 5816 6096 wscript.exe 90 PID 6096 wrote to memory of 5064 6096 wscript.exe 92 PID 6096 wrote to memory of 2988 6096 wscript.exe 94 PID 6096 wrote to memory of 5752 6096 wscript.exe 96 PID 6096 wrote to memory of 916 6096 wscript.exe 98 PID 3940 wrote to memory of 240 3940 msiexec.exe 100 PID 3940 wrote to memory of 3620 3940 msiexec.exe 101 PID 3620 wrote to memory of 5580 3620 dcagentregister.exe 103 PID 3620 wrote to memory of 2992 3620 dcagentregister.exe 108 PID 2992 wrote to memory of 2816 2992 cmd.exe 110 PID 3620 wrote to memory of 5076 3620 dcagentregister.exe 112 PID 3620 wrote to memory of 3044 3620 dcagentregister.exe 115 PID 1884 wrote to memory of 5504 1884 dcagentservice.exe 117 PID 1884 wrote to memory of 3412 1884 dcagentservice.exe 118 PID 5504 wrote to memory of 4972 5504 dcusbsummary.exe 120 PID 1884 wrote to memory of 5776 1884 dcagentservice.exe 122 PID 1884 wrote to memory of 2668 1884 dcagentservice.exe 124 PID 1884 wrote to memory of 4564 1884 dcagentservice.exe 126 PID 1884 wrote to memory of 976 1884 dcagentservice.exe 128 PID 3044 wrote to memory of 2112 3044 dcinventory.exe 131 PID 1884 wrote to memory of 1712 1884 dcagentservice.exe 132 PID 1712 wrote to memory of 1992 1712 dcconfig.exe 134 PID 1884 wrote to memory of 5520 1884 dcagentservice.exe 137 PID 1712 wrote to memory of 3612 1712 dcconfig.exe 143 PID 1712 wrote to memory of 2264 1712 dcconfig.exe 145 PID 1712 wrote to memory of 4348 1712 dcconfig.exe 147 PID 1712 wrote to memory of 6068 1712 dcconfig.exe 149 PID 1712 wrote to memory of 1156 1712 dcconfig.exe 151 PID 1712 wrote to memory of 2540 1712 dcconfig.exe 153 PID 1712 wrote to memory of 2324 1712 dcconfig.exe 155 PID 1712 wrote to memory of 4460 1712 dcconfig.exe 157 PID 4460 wrote to memory of 5376 4460 meaap.exe 159 PID 5376 wrote to memory of 2468 5376 meaaphelper.exe 161 PID 5376 wrote to memory of 5060 5376 meaaphelper.exe 163 PID 5060 wrote to memory of 4236 5060 VerifyTrustedFiles.exe 165 PID 4236 wrote to memory of 1440 4236 VerifyTrustedFiles.exe 167 PID 4236 wrote to memory of 2540 4236 VerifyTrustedFiles.exe 170 PID 4236 wrote to memory of 2924 4236 VerifyTrustedFiles.exe 173 PID 4236 wrote to memory of 1360 4236 VerifyTrustedFiles.exe 175 PID 4460 wrote to memory of 4224 4460 meaap.exe 177 PID 4224 wrote to memory of 1540 4224 meaaphelper.exe 179 PID 4224 wrote to memory of 1740 4224 meaaphelper.exe 181 PID 4224 wrote to memory of 5704 4224 meaaphelper.exe 182 PID 4224 wrote to memory of 2280 4224 meaaphelper.exe 183 PID 2112 wrote to memory of 4328 2112 uesAgentService.exe 186 PID 2112 wrote to memory of 5816 2112 uesAgentService.exe 189 PID 2112 wrote to memory of 252 2112 uesAgentService.exe 191 PID 2112 wrote to memory of 4116 2112 uesAgentService.exe 193 PID 4116 wrote to memory of 3008 4116 uesDevCtrlSummary.exe 196 PID 4224 wrote to memory of 2500 4224 meaaphelper.exe 199 PID 4224 wrote to memory of 1852 4224 meaaphelper.exe 200 PID 4460 wrote to memory of 4764 4460 meaap.exe 201 PID 4764 wrote to memory of 3024 4764 meaaphelper.exe 203 PID 4764 wrote to memory of 4792 4764 meaaphelper.exe 205 PID 4460 wrote to memory of 4192 4460 meaap.exe 207 PID 4460 wrote to memory of 4808 4460 meaap.exe 209 PID 4808 wrote to memory of 6048 4808 meaaphelper.exe 211 PID 4808 wrote to memory of 5360 4808 meaaphelper.exe 214 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\setup1.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\setup1.vbs" /elevated2⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /change standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5816
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /change standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /change hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /hibernate off3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5752
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt" /qn3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:916
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FD6CE4C1D5BF2D44B6AF1BF79FE89CA52⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:240
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5580
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe4⤵
- System Location Discovery: System Language Discovery
- Gathers system information
PID:2816
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5076
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exemetroapps.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2112
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5384
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4972
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3412
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5776
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2668
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:976
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -p processor compatibility3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1992
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3612
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2264
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4348
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6068
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1156
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2540
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 9ff13e98-156a-40a8-a2f0-1966149487e5 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip" -c acp -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ApplicationControl-metadata.json" -a 14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2468
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\dcprocmon.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\dcprocmon.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1440
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe33 0 07⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2540
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\ACPipelogServer.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\ACPipelogServer.exe"7⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2924
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe"7⤵
- Executes dropped EXE
PID:1360
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" bin\dccomponentregister.dll5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1540
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1740
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5704
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2280
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2500
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1852
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" bin\dccomponentregister.dll5⤵
- Executes dropped EXE
PID:3024
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4792
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 7093261d-e605-4137-be02-f2a185eeaad2 -f "--" -c val-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\Vulnerability-metadata.json" -a 14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4192
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 882cffd5-0f27-44fc-883d-77846fc9cccf -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\bsp_component.7z" -c bsp-native -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BrowserSecurity-metadata.json" -a 14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\bsp_component.7z"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:6048
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\bmagent.exebin\bmagent.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5360
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n dd65fe8a-c3a8-45d0-9747-05463d2b8ded -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DlpCommonComponents.zip" -c dlp_win_neutral -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointDLP-metadata.json" -a 14⤵PID:1724
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DlpCommonComponents.zip"5⤵PID:4548
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5520
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:552
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys"1⤵
- Executes dropped EXE
PID:4432
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -install "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driver\x64\Win10\DCFAFilter.inf"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
PID:4328
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -start2⤵
- Executes dropped EXE
PID:5816
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesFaUser.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\uesFaUser.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:252
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe-s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe-c 93⤵
- Executes dropped EXE
PID:3008
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Windows\TEMP\{33309194-f7cd-1e4f-810f-77cc85c58a08}\DCFAFilter.inf" "9" "4ca28cc43" "000000000000018C" "Service-0x0-3e7$\Default" "0000000000000190" "208" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1504
-
C:\Windows\system32\DRIVERS\DCFAFilter.syssystem32\DRIVERS\DCFAFilter.sys1⤵
- Executes dropped EXE
PID:4316
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:3460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:5372
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e595ee3.rbs
- Size 58KB
- SHA256 aa08c560e8342571738863d89cdd2868c9c731d5e49b2094b1ae868668169d3b
- MD5 ae8940f70d54a26610d0f61c5f6eb01f
- SHA1 b0deac3070b59dc51658fcf08fe410865131c764
- SHA512 f1f6586b73c82b0545434fe30466dd496c85fccf08521dc621c85c38aff11c3881cfc089fb5ca3e7638c9f34ffce7585179ff7f34af639573a1d97dde922b58d
- SSDEEP 768:lPOamH6jx6gZiypDO+uTcKoJlhQbGJjadafhiOVbm:tBsCx6xeDO+Mog8a6i2bm
- TLSH T1B7436266DB26E2CBD1151AF733826D1806094C7B66F0C43E1318AD3BD4DBA457EBF868
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e595ee8.rbs
- Size 546B
- SHA256 a79fe3fbfd1624f5e9dd32ecd80afbf45e35b35b9ffe63abac8f922b4c6e0750
- MD5 48a4872a43e29ad619ccd979016106f9
- SHA1 edbef7341b20d562734621a0e7503306b36cf173
- SHA512 3f140d1b39ffa04ede3757dc881afd29845c3bd0f6f714b39a74114802d2c48edee5fcc281511fd22c4090b5f935a1764d901d6e33bbbc391a1b6a3d086089d2
- TLSH T140F09E93A70845E2D5A06E3313431F46193FE57AA19483752D882734AD2631A1EFB0CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1002B
- SHA256 c12acfd5a8efc3697635866e048648caaa24707af39ea5b2cb4649c0d776909e
- MD5 75b18b599795e3aae5f75fbff7db5370
- SHA1 8445cd86b41ade8add41b48fe51e64647375fd7c
- SHA512 bdb57e944f1ef932a062efbbd8e47fa9609972af521c8b8695683bd02a9ef48303b7a80a00160e9bbb26285d213886861e72481fd19563566cd2c9b4ebe56354
- TLSH T1971165EED87E1121ADEADA9D721D5A0B24B1A3584E5811BFC22624D61D35E86314CA14
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\InstalledSoftwareScanData.json
- Size 6KB
- SHA256 3958e035c652c8b31a3bff2428ddfcf49013d929951a64eb4278f53be0b46180
- MD5 56c36aad12c38ca8ded118092a603c53
- SHA1 b89948a93599f42bacba207dc60f646a8eb1148b
- SHA512 7969d2e6510089a59808d3436c32a6db3f8902ea47c7a27157e9403a8a2de0beb554ca034ac671b93a5ac72bf1678dc17eea848ed98b6cf2e0707b282de19fca
- SSDEEP 96:2FHMCbAUtKJFEF5JCbwUtKxbC7AgZL3ReC70TLLz/C7/ZLYFoC7wZLrvg4fCGcVD:2FHvgFEF5YvLBSLzQLYFYLrY4L8D00
- TLSH T131D10E06C4528C0B51F09BDA2A204892F550571F83C09C4B76BEB94D5FFBA3D6BBB678
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 802KB
- SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
- MD5 8f57948e69c82bf98704f129c5460576
- SHA1 33e277af0cea397252c23d310961f803be5cdf2b
- SHA512 628cf68c9436721b874a87e1bff711d3b6fe5d4bd9b02411890059a7d32078a9592fc48e6e53761d17bdbd72c5eb66593b841470157a3e8b38f0b67525d73bc9
- SSDEEP 24576:L48I9t/zu2QSM0TMzOCkY+we/86W5gXKxZ5:Le71MzuiehWIKxZ
- TLSH T1C9059E22BAE5D07BD2421132CA1C7BF591F9976D0B2048C763808F6D7B359D1DA3AE1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 2.3MB
- SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
- MD5 2843aac7409fc7e54722c6238342f660
- SHA1 3e40879eacf10473127386816c24e0cf245410f6
- SHA512 f8a6e689f3b0c6761aa84f29d717d192fc0b34767a06d551a3937827a95f0cf740baada2a151b4ef6138a0fa626a93c94d45e34c235de63e265cebf32c9e70c2
- SSDEEP 49152:8P5i/uH8WK6WK0Lh8tRjd4b39T9+LoSaEYLUzSPrBsFwZkmTbk8iE8phYhlJFxI:8P5i/uH8WK6WK0WtRU9TAodE0UzirBsH
- TLSH T17CB5BF23EA808032E4CE053692FD5BB65D3E9A10132CA9D3ABD53DB45E755E2663C34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
- Size 250KB
- SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
- MD5 a2fb219c999a8fa6b95ad7c24890072e
- SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
- SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
- SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
- TLSH T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
- Size 245KB
- SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
- MD5 cecc32d267ee07ce3413637314b66ca0
- SHA1 627b584f88033791f427091fff74c9310bdc2ef1
- SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
- SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
- TLSH T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
- Size 14.6MB
- SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
- MD5 b26cb94e52dd0688c3a77b46e883f084
- SHA1 27692088d8f3d321a6f9afb39395f6109f0469e9
- SHA512 9823343c9c341b3a9c07ad9b3c89ec9c2efc8ea31f3937cfccd3c03724494ebddcd83a53a383087d2cc8e4aedff1e64aa7bcd76fc7d6a28fec4c6309bbd19311
- SSDEEP 393216:FT+EJ+ygjrEhL2oJ/3u6xC/9HI7T3ebuRgzPNK:FT+U+nQhL2oJ/jI/WXeiKk
- TLSH T15FF633E9B4828A4BC5C889B0C64681C4E1CE41B5DC9A6CB6D5B167BFD3DA8C714DB3F0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
- Size 160B
- SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
- MD5 7fe1c49c6da9570331515a2d300642e3
- SHA1 13c824b889876a1ae1e94faeed430185329df502
- SHA512 9de0c421861be17aa0e32ee5a3b603be946f075bb7178e7ee40d8b8639bedd3761e88114dfddc4aa0ab5ae20d6adfae5535b7205b8fa3674e6e8aaad27a0fb7a
- TLSH T1A0C0122AC1CA24F0EF077FB6B05613A34D0CC1FB020386570C4690401F81EAD8D2C406
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
- Size 62KB
- SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
- MD5 8e3d3fe805da01bc5abb251f2fb58705
- SHA1 8adc16a8e417cfe1130c3b3e40495ea977374fdf
- SHA512 8e742dc4122c3971f3a0175f648647ba0630fb87d0c1a415c5cd38178643a07a0e2e9ca5e360b3e1de530dba5ba323aa963de9daf204bb0ab19afaa38372311a
- SSDEEP 768:KuhPgdGgqsgO0JRCXwvtLqhjgiWmZhSX0P+4EDsXnqmpif52TZaZTAMxkEYg:KuhP+dgv0AvUjymZhSEPF4k4xH
- TLSH T167537B27B390C432D462197458A9C2725E7B79620BF8D6C77788037E4FB13D0AEB935A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
- Size 536B
- SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
- MD5 60f77c64f9c8a86fd24c8e64c20e009e
- SHA1 e9299102aa662027b9e46246a5847074444ec1fd
- SHA512 972afa85faba00ad96efad4951ec92ed90e60175dd80a388328c708975df2871655d8ae31ea750d60298ab1514c1a4b53b3b0304d5ace6118b4fea320c075f33
- TLSH T12BF075C0B546067A64170F3544351D4502476D06A57CA33ACC50FCDCD67E220B0229A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 92KB
- SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
- MD5 2978f0ceba230877a2476d3d99739518
- SHA1 a16ae5aa1bb6017d2732ee5cced1ede9b091816e
- SHA512 5e8ccd699315e23ccc94b4541d568815f88ffc5736c39bdc29d4dc9c3dce3e8ee1b9c70e9f28d980b5433f5bc10d49658b13dc2e8947a415e45d1e4153001cc5
- SSDEEP 1536:APLaK7cLtLWedH8rwkrsofXR1BjDrl7E2zzi0FNLGpxLzH:T66trH4wW3RE2zzieLGDT
- TLSH T1ED938E227690C032E456597468ACCA725E7FBD215BB8C4C77788477B1FA03C0AF7A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.2MB
- SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
- MD5 9c1ac952bdfee44fed1ecf7165808e12
- SHA1 8fee062be189b641b0ffcbbb7287697b9be16cae
- SHA512 bb9720f816a1833769d083079a75913c7aef9a103c3edca122ff151acd94cfb586b3b8303720d305807f72f28c6370bf80d478c5a0e6beb734384a89e344685b
- SSDEEP 24576:QSTpNU+Po5KeKA66v9cskz0LIU6iUKLO7N7EqyyF6FmR0OqZC0uNZtSTHytb0Dk:Q2F1ec5zu9LOx7yyF6FmR0OqTi+TStgw
- TLSH T13B559E22D7428031E7E200B7C57A86BAA938AB75131190E3E3D45DE85AEC5D17E3F25F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
- Size 2.0MB
- SHA256 8e35a7064793a56a8d6f1e08050fa588571c8898f5bcea4f78228cf343ce5016
- MD5 5956882d71ddb032bc14ce667b700d9e
- SHA1 74224f6a2948baeab354e2e2a7e687ab6a65877d
- SHA512 f7230ec387f95ab5aff516771b11ca00475adf460a293308a4dd9206a1ef2fc4a462c647ad8a4b0696209b7ed19e303c84667ff85bb2b4a06f4d4e90c15d5f6d
- SSDEEP 49152:oc41Ly9rwBXp10lrzBSnwX0cLP65eP8Txvkd/TgVI3cYKNpe:ey96iSnwXpLP65Lvkdnco
- TLSH T137A57D11A742C437E5B304F6C97D86BE5438B930172490C3B3C42DAD9BF99D27A36A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
- Size 1.1MB
- SHA256 b24ad0ae12c05931f11b66f26166c7ec41a7be318893aebe4cc2babe29bdb080
- MD5 34bfd8a2cafc17cc6d77731137647ee3
- SHA1 f759d53de2db6984ecc7604d0d655cb9324c71ab
- SHA512 26772bdc4d88ba6ea664d47c5f1d96fe1b3c08cebf852c77c2a0513459f763edf17300e341f4e764da647649177e4812fc926dda15c640b91ccfd6d0f847ac34
- SSDEEP 24576:yq6MTUXbn7CW4nVG2w30/JssVTlFLsWOq63IfHNpFw0wOzfTkqZgfVV:sn3/8FLsWOq63IfHX6NKTHZsV
- TLSH T1E135AF21EB024031E1E200B7C6B9D6BA7938A771271590D3E3C05DE96BA89D1BD3E75F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
- Size 2.8MB
- SHA256 4f8c591982de67c9211011e4a4a9560b93eabd6c08f2856d7638cc4c802a3b64
- MD5 0187aacdbf886b531e61c5cd734a4b8d
- SHA1 ce576911215f034eb889692b9614d80c04b216db
- SHA512 60b48cd7ae6aa5a46b8e509f1181a44136f198fc6235d1531cdf8ef4e0555687fb227295776cb59bf5bc5aa62f022a5c22a06282782f61c47378bc45e7579b9d
- SSDEEP 49152:ESkZ33X/kMdw4a0z6GbB7lyONDHSvlCi37AxvP7qm9cVKeKiIAXQSve4RSfoR2/5:EFZ33X/kvBGFlyO9Ski37AxvP7qm9cVm
- TLSH T177D5AE21BB41E036D2A32172855AA3B9A27DA630173591C7E2D05E7C2F745E2B93C73F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
- Size 172B
- SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
- MD5 c8a811d36876948a70fe7509b7f49925
- SHA1 48541ac236da4f143154a8f71fb7fb3f3110bb38
- SHA512 6bba69fa213b495a9faf4ea917788c43d888b3d96606db1644d7f8c456fb089f01d3e2582016a5043a49182ebd9767a2169aab94de05868ab0efeff5825c7578
- TLSH T115C0801594D652DB7498C735951537213919947F996DD12D404431F134785A0511FD64
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
- Size 318KB
- SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
- MD5 4373ce1e6f57dc9df7a8ada69479d8ba
- SHA1 f19deb28a0af966ad8c03db23cd21f75dfedda08
- SHA512 e1c1cd77650e72652528b005da981a8ee3b28c995c41875a872202d0a00c75c612050f74b626dbf42f9e5412624860d182b7b6c98dde4df7c09a7f735834dd41
- SSDEEP 6144:QnqKQ2Oq3ScuA05A+O4PlDfZIkbaRF30zG26Wdi9vhEsSCyAekfX6xgrNQi:mqhq3M5A+XfhaD3lV5SCyAe+XmCJ
- TLSH T19264CF2137E5C47BC692253089DC6BF970FAA7490F2448C723C49F2E5E35AE6D239729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
- Size 1016B
- SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
- MD5 368947d319ac4823f5d542c8f723fb0c
- SHA1 7d419d7c8b15f9abefc936f526e68ae2c535292f
- SHA512 ed51660075cfeb5a3826231a0f0e2b1b165d0dc808cc5c1f309885dfa7903c914b76bebbb183ef38d67a789adf43b0e6e5223cfccfc362d50ab05b1becb15a60
- TLSH T188119AF0A1F0DCBAE7571660799EB42055D66AC03249424D340BF6286EB7715748CFA9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
- Size 6KB
- SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
- MD5 d10bc07005bb2d604f4905183690ac04
- SHA1 69011104e870704cf45910d74bed5938f9062891
- SHA512 c8df6ec5eb5684348613af6e8bc2e8d5759ff9912e9d36df42c09960739b0922c2830b56059ec0a95fc2ed7aa83fb3fe5a8673402544c4bd00daab457b9b97ab
- SSDEEP 192:JfC8S1p4JW0bYmezNui5WP1UMIUN93GUO4:JK8AvOYmW1+BIg93P
- TLSH T102E19E87A4C2459E8EAA5CFF1D8E522DC17B8E1A9A1B50C52552D2C1071DFF8D483FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
- Size 6KB
- SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
- MD5 00dd0ec0a16a1085e714c7906ff8fb06
- SHA1 244bd9b7c3b1c4f7ef72de31f67804faff213715
- SHA512 163afece9ae9693c41324ffd89191132a8d2e42d73f962ace0b70b44a17d954c8f506cc25af152397e2536da6245e4336ae465708edf6ede955b4ad502af7a71
- SSDEEP 96:gMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6KaP:zXTvYXQzy51nfmcuXibSralG/aP
- TLSH T166E18DE534F0C16898A14C3253536644D16EB3C3A8F7AD02C1B0AABAA465F3872FF7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
- Size 4KB
- SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
- MD5 4e7e3e142f3939883cd0a7e00cabdaef
- SHA1 d20567fd436991539eafd65c3bde77d82a656012
- SHA512 d145a64f637f34d9f9fefaf7cef14ea277d0933e16c625234a9c1e0a54a7f3d0d820ab49b4b68d5d3e9853399d74efba9ff7771bfd3481f8c1c70e6dc6f50275
- SSDEEP 96:7sHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:oHm231Nvu+wIqltWOe3nIH
- TLSH T1A7A13DE27BE7DCF495E62277BF9D5491E1542A41207047B4C4C4D11C695C99B1361E11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
- Size 6KB
- SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
- MD5 40bf25799e4fec8079c7775083de09df
- SHA1 4fc6b1449c73f5d10489c104225ebe326a4016ba
- SHA512 51c9e46224098e9270bf51bec93e0528b5e726a632a1de57863fba531d914a9db1d3fb07d22cef756f6fc9e999bf08043e73bca6225a9ab7efffe2904105c388
- SSDEEP 192:92XiIsTugcTnouLuIXdj7Z7rgmlWRI1ie+BVtNzDby:AmOTnwCnZftW61ie+BV3Xby
- TLSH T15DE19FC1E5F8C4E0DD58E668EE886209C7A658B9064742DBCF0485694B48D3186FAB8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
- Size 4KB
- SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
- MD5 093a819138276b446611d1d2a45b98a2
- SHA1 1c7fc1ab71ed0d9fa051f07c7e8f43467121ebf7
- SHA512 c886fae282a185b69a2cdd8593cc4c4e7ee463bc010bf59544058bb294cb0bc2ecc008a9dbdc6c7cd0e45bbb80bb9cdd5b7520c4a88779eb8ff2df56128d7b8d
- SSDEEP 96:gHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:gHm231Nvu+wIqltWOe3nIH
- TLSH T187A17DE17B6BC4E4EBE7233FBFD95460A1542A01206073F480C0D1ECA98D9A71361E21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
- Size 6KB
- SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
- MD5 ea4ebe072be75fbbea002631916836de
- SHA1 1769aa84191332e981245146067080ee4faa592a
- SHA512 85990dc5c32560e10cf380d0e10707a4d995ff58b35cc81bb0ebca5afec15c1ddd6cb0de8e7fb392f2384f2a7ef9482f2b1e47924556e983b9c5ff1a79c1e7de
- SSDEEP 96:DcH4W00cRUjbz7dqG+sLo/Hh+U5cVH/lT3jmk/8fY44WtYHM4tNtldMJU/gl:oYW0YhqG+sLoPT+XjNQYbZNtfMJb
- TLSH T1B3D19E81D6CEA64BCB01DCC97EC73BD82588436B5A1A94EA15D2B0C8B52FA8CC50583F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties
- Size 98KB
- SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
- MD5 c340fdd54a3956f567a1b3b5bf0ad58e
- SHA1 3c620fd4efda92ddcb42fedd600d4ceb1d940a97
- SHA512 d5e3171d3b11bb56fcf35de8ad596fb37008f21d9e8dfa18444c1460490fdffde3149981ab7fa45a144ce1daa28a5c588230b58fc802ccd30568dc2383b38f3a
- SSDEEP 3072:UyfCAIeTx7UYwyKlWF/VPKWl+DE09phQl1mWSDj8kS:VfCAIMBUYwyKlAVPKc+LDj8kS
- TLSH T16AA3735AD1766F7E33C6132BF4392BD176B20D648741A9E87988E8F4D63C84121BB4B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 15KB
- SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
- MD5 783b02208909201added3870096ecb7e
- SHA1 f912be0d056a40d9ffc49aeff5287d258048664c
- SHA512 a3b95b96082621a06f1b3df0dde7b50b4c84172f8f5a48889f766fab9594e3dc41a86ab47553bc8ef4a01c29103bfc59ace36f1135e4aedc0d7079faad513589
- SSDEEP 96:jSOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:jBhBAO8b0Obx9nFLnnmI
- TLSH T1E662C593A51D099F0222039999DF7AD3A1BC94344C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 86dbea70ab491553aee7fbb1b46bed39f3b74e7cc898c447acaa48316befb670
- MD5 5d53def373581955466056e0aae46496
- SHA1 b65739abe37900169a65a697e58d2474d367bedb
- SHA512 74c2d26b063fe3f454178a41ed90f8a01608d5291408998dbdcb9b6204c0a746a0f11836e7650c582d36d50e630b8fd9ebdad52141a65f54a7ce1225458beedb
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEx:0PY/X
- TLSH T1B6D24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz52.tmp
- Size 2KB
- SHA256 55534670de4cffcf5b5e4ced1b89cccf44ce34ff42d58901bfb8d35d766ca646
- MD5 47afa88579c0771d10115d29cc6a5197
- SHA1 2a7a5de82dd3fa4a3d68310c65fcbdd7b339f981
- SHA512 9c862bffa6817b874ea78cfdef448547c622f10622cd25ea3c79598b12260d21b7d9e71606bb3de6827495de526eec9a6355da0973d85bf256f654700634bd6a
- TLSH T122515C522CF97E5B3441864775C2BCF59C97866820DD688CA45C6F0C539367B3B61C86
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
- Size 4KB
- SHA256 9e856f8c6bf45d415546b81c7b92ae65b18c136bdc3b5f3155343bfa3d8ac2f3
- MD5 902b7cc056ef01b1720e179a698128cd
- SHA1 51d5a73ee8588674bfbac635c91475c71d9aebcd
- SHA512 bd5d7ec24aa6e161634d1f621798d3e4b0551ba51d602bdc6efbdcfd1ec3dc78cfae9173e84e0aeec0473d3dfa365b21bcee3b6fe4255a792e76e3b06bd97c31
- SSDEEP 96:CWdtFTwjDdcG5cNsS4cVFEpP4W+XIQGxKhg4Z:NiRFF/6n7n
- TLSH T13D814111A0B0C72D0374776CDE56F719CE4606952A190B0AF06D34FB0F7AAD17AAB4F2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
- Size 242KB
- SHA256 1a388c11ac7b14c44ecb605da1f6111274beb11d947442311c5ef1a88d6e4b68
- MD5 80ff33c99dd10147ea596dc25319a780
- SHA1 04bada413072751276f871286071cf691b5073ff
- SHA512 ae0ff8a43d19cc0b4a26cf10e7fa28779d803d984639d2e6a5304a6e737635a440a5551633a1026be8b3a9d847ac0f7e125e1f00f0edeb5fb03bc5afefa6e44c
- SSDEEP 768:HDVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAaS:HDzZZ1uSNABIpkIU1
- TLSH T13E3418969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json4492.tmp
- Size 898B
- SHA256 4f2c57eac4da1c7b6ac0ca730163f9c9618726926bf98330d6b6d0d63127ddf9
- MD5 b17a83735a1a842301292138077cb09f
- SHA1 2bcebf872b457ef7aaec55e45bda5d4493ad6404
- SHA512 a89e2a37be502fac3b3b6725d70a91f89ef2b93843a4e8c55e081e48f2f17e4a4d6db733bb97024648f51cd36fe062bfc4b1153f3a29aa281144d904286a3b6f
- TLSH T1E111A0E4B0AF4CFD42C7F559AD8DD16AB6A9F622D0E89C0C7659F9088EC6088B3D1514
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 415KB
- SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
- MD5 d1a1e51389e6663e8e53933731adf46f
- SHA1 9ada91a587210f7f67ce5e805d7c35ba1c4201eb
- SHA512 14208064c56b6fd9998f10b7a534b3c48ddc1539ca4ae63521e5ccced1824e3a2e7ecc0c2e592138bf17d4ef07d253ba537215d8fc095b0d2a55842887624a99
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZn2FYYh:6fufQiiNJY7tYiSYh
- TLSH T13E94B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
- MD5 415d608384f186f24717c62056111c99
- SHA1 85a8d23411db39acaaa00a7efb974535f74bfb26
- SHA512 f72b81cddefac677b27d41380fbc647c83a1cd22ac3d319659f569d64907103cbaa5ca3ab877c97fb54f3f0f37b5a6a3a7afa96f6c4c7bee02aaa275473b7ceb
- SSDEEP 49152:L8vq3hwELiWbHTKR0NDZK+/0KfEDKJKzK5xFKOQFKNoDKpW83wKFC+KFE2v:4vqxwEeWbHTK+hZK+/0KfEDKJKzK5xF8
- TLSH T13E75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml
- Size 6KB
- SHA256 858f10f0ffce121bd5ae5d46330c0e114773ea526eaaf340285e676d5097ce1d
- MD5 47f23071a4f2bc26ca9b4e6efad4f417
- SHA1 24e9e1a2d8409539fce6f3e977b2986f468b5546
- SHA512 a1c492eb6b112af5c0a2f9c6dff313a6177ae9d27b5b46308e04891b9ab54594e7bec1757d5be798181522489a65218c2617b210ff9ccbb09649936c4f47cfa1
- SSDEEP 192:lKE/KWadKrvKDeRKaBeTKRUGBKpmvK5vKtk9:UpWxmD/aBxWGIz4t8
- TLSH T10CE1BE6DA19C9E190A7328D7B71733D573A1421A05C4011378DFB1A82B72BE385AF6F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
- Size 28KB
- SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
- MD5 889d10168a96d01a40af825a606ffbe8
- SHA1 d1a75fea9d9aedd31dd581b8cdf7b45791d790d8
- SHA512 4536452db3e0d32cc7129bab4180a509b71d5affa0fb98599cf7ae4d21671cce0fcb7335cc891a0ce247de2a6674197f6ba74409a14b6bfc15a7a03d1511b90b
- SSDEEP 768:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYOXNe/pR71KRa2GG4q+V5No5hVMKD4idqH:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYL
- TLSH T10AD2753E61A0FC4CBAD0E85C14CC8A188855D313518D7AF1FBE84F2E0BA59A5525FDFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf3120.tmp
- Size 55B
- SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
- MD5 87cadf1716a7a89b6a5e95707bbe0e5c
- SHA1 677e32f23bfbaa64b2eeb562a24b9153eff29c7d
- SHA512 92c72d63eb92952cde4bf2dd01cff2ace0b531d28b3d53ade8b5912ee796d2313b08f4a7ee172efcaca8f2951386d3c8916796ac736801ece831bc6d7ae2ca76
- TLSH T18290026DD52E681112675D0E66488F43C51A50C1198D582B1A2C1826A0B417D5A50153
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 3.1MB
- SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
- MD5 7e12fdfa73e292f21d91fab687229213
- SHA1 092919df467205f4b81337a73e1d8602c77d92ee
- SHA512 5e41cf585b2e549330b21d8e9f414fbe7588fe405c1b80d32053c14b98b45a001384c93ac32e7253910f01285f1c6efc0d46e163c1b0c3f017fd04f5bda20ad7
- SSDEEP 49152:8594T6Iiya9PlJdUI11loQlxI6Uh8Zvu4d7TmunCQ/XHaT9eGfcph9yv3fxJuQ:8P4uIiya9PeHQlxdQ4dGunCQfUer9yvr
- TLSH T19AE5AF13EB418031E5DA00B6C27A9B7A9D396730132590D7E7D06DE86EB45E27A3E34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
- Size 7.0MB
- SHA256 27800f916566d2a564e48eb543d1c511c72b344765ff4f9bdafb113d13669f01
- MD5 210c7ad0f6111a77a81dda1c6af5fd40
- SHA1 8278e855060fafb2d5542b11ea4a1d68553895c4
- SHA512 19d4aefc458d07d0826f6e0d0bd6f7c53c5706c88c5363545e18c5765a6f999e1a22be3d6c97b18609ba18459b6f2d8585faa5b4c8c8e7ffae2bc641c541777c
- SSDEEP 196608:Mcm9rt6qX04B1RlXiuzOBhuVAOZouCDuQcf9VY0:+m4BX1iuzO32rouCDuf9VY0
- TLSH T16576AE22EE068136F5C100B7927C5BBB6879AB301725A0D3E6945DEC59F48D2623FB1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 1KB
- SHA256 ae24c2ffd8976639114b8d2e77254530e7ef4063cd63a133bd4d2381793095aa
- MD5 670d077ccd2cd5dfdbfcf8e85fdc732f
- SHA1 2dce52736e5c9bbc3234a6aee45c49f8db9a7707
- SHA512 9ad2951fcf065816879b44fed7cb316c3a4f6c1c7d7ae2950c7ec77687afc28af591f93aafdbcecaac5dc8ff870bff6b09d2e76a7afb49cd19308f0c633e36f1
- TLSH T19711CDB271F920CFA671264952407CB2DCD44A4D22A380E21606936CE57BE53EAF73B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 102KB
- SHA256 52d4979bb9c86b6f1bc2afe78dd44b84d96ff7beb14e7602b6044903a0bcac94
- MD5 22aced07ea241200ae5ef47d2c26b250
- SHA1 129d31926580b5f93125716be7316f046a54f323
- SHA512 ab631dcf45b8a088c2964701e8de7fad27e697ffc0af34a12bfe78f9f300c59c72113fa019333d813b2d4df0429f13cdf6375e3a2b357945778becf02abfdd33
- SSDEEP 768:zFTB6sE9H43TNvyBu9WFdLSkGIGRqWvapqsVR+iRWwq1qzqXq5qc1DptZN5B/LJw:CxGRq4apqsVR+kLzO
- TLSH T1AAA3BC4029B630DA4269254ABD0227AB86CB752C0187FD793B6F78856B9DC471FFF780
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentservice.log
- Size 952B
- SHA256 f95eb755503ee47f907499fead3ca0643a008b628ee753b29a0d7353177252a6
- MD5 572fde249d88b016e7e80686fa1b34c9
- SHA1 87e74e2a6ac6fe437e35486b7ec02fb679565fd5
- SHA512 3df8da388309d094802c813ee4ca5b65641a4b7f6150f8f0f95b878dcf50501e73ce16a93d4083ffaaaa0d88f8c7c333751158725eb76b672db02453228f19a6
- TLSH T142110B414ABB2493426A09C07E010B46A3C7B4AC018BEDD0376CF5E5CB5A4879FEE3B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dccomponentregister.log
- Size 32KB
- SHA256 997f5dd96ebfef787d9ebaada5902becec833b0db3a30c308b8b2870db3173af
- MD5 56e5e345a67dcbdff288151667a0cc92
- SHA1 f685aba953ab233bec93c767483d48f28cb2f021
- SHA512 5b7757647526005d9583c82e7dd256755ee69a680cdd1185d003ded316c2fa284177a7e329a0120f2a4156c5a09448fef8efc7e7194cb2482bb3dbc478340633
- SSDEEP 768:L5yn+i+lUNu4/oKIjFqNLwtIKdUuLY3pd:L5yn+i+LUuk
- TLSH T191E29C8129BE249262EE448BB9011F8749C7781D41E7FD9073ACFC846B994531FBF7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
- Size 4KB
- SHA256 68219c4eed00e8c5cbc263a84c8d58ea6656f7d8755f74656edbc4181a53de50
- MD5 8f49d58f3a2a2a824ae92d3663ab17fd
- SHA1 3b5d20bd8f60628c6b61a9b65f74dd4baaaab2fe
- SHA512 853c297bb48d0d9b845072d48bf642146355f5128014698fc17a548f522dfac5333365f3ff5b69d5a29ba54e0e31d8ab1f9fdff221f7ac5d469734ee7f3b3cdd
- SSDEEP 48:+7R1Re+02O3EX2PJhJEett2rBZ2r8Em25WCEgy2GyCEgy26uEG24HEP2Mc2KLh2p:+PRN6qerGiv7oeUV+i+Hd
- TLSH T1F3A10FA95798F47D476A0A4FB34C590082D47C8662F16098FB988017DBFA353BAFCB19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferup.log
- Size 453B
- SHA256 48ce56d8b10063dd02533e8d897049710fd9d04947d00ccfa9ab400eb10a01b2
- MD5 5ebcf87cce34b3cad9038a47275f6f5c
- SHA1 675b3b87aad3d48667c539c89efb8f1d9a8db20b
- SHA512 386fe610cc0ebc08ab427c8a4c3504ca06bcee4a2201ed4db2bf824a17580b9f46935f98d74c0a6d9eedd66192b4bb80b56ee2cf62369ef65d52067e125dbfd7
- TLSH T15DF0D4954710B47D45E54D0DA2194184E7F56042102110A8FED8D04347BCBE75FF9708
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaphelper.log
- Size 26KB
- SHA256 260775f3ca084d2d2bbf9988694e5e942ed931d94f87ab9cdb1fe1c291107705
- MD5 c0d66d6b5fc7d63d247f6f296467b3bf
- SHA1 26e6c37423fe19ba37d83b736af0cfcf1680dd9c
- SHA512 8a4be9aaef2f65cb594fda736cf430685b4f3a7e938dc5b42c5058b1e6ff1cb75253adb049ec47a71a108b0cca659da3098e72e194377f9a0acd93097f3ff775
- SSDEEP 192:WaJoxjvLwNihpi69ircfCFgLZALuEyHM6IoBn5KhSpEu0cw/ieuiSieu09ieu4uL:NWTd8lW7RHGXpNyAnLFBCXIwA5
- TLSH T119C2B9C15D7A9D92225BD99727011FC2C1C3781D05E7AC50332CB5E8AB9E8132BBE7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\ntuser_202607231828320095.pol
- Size 396B
- SHA256 c2df8982feed8c723c9a2e8e186739ea97e59f710f895388b4a2a4c5a2a820a9
- MD5 368bca7648282e23eb5f11e144602b3b
- SHA1 7468afcfa01a74084dac37942ec8343b27fbce9d
- SHA512 2b500d97edabaa42172f17e2f4e995db398c64ccd1dfc41e1dab5f41ffc4f68da4ac1304890c429db3eb945669d62f2c7c019c922a27f706a41b544a1817151f
- TLSH T1E6E0BF0157F91958FBFA5A316C339D985E7B79252724C88D201C114F4836E248F62327
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dc5924.tmp
- Size 10KB
- SHA256 44492bdf9c5ad4b0a5c1bff9b461b81d676c491e7be66e5d27b32c16931d4404
- MD5 8a26a1d7c2ab4897d02a35e70cc65ceb
- SHA1 a1a5dd2bfff180bb1c7645b1950a702c6cc82ea6
- SHA512 6e3a393720c74a85ebeae0ea8fcde42244e6301848b3eb1a42d97346ff1417408b26520a64a51e660498c4c311613fe4637eaf1b1a70d27d14c17a6591dfb1b9
- SSDEEP 192:GUKUEUAURUwuUHUrAU2UAUdUZU+UAUlUHUhUrU7UaU5/UYUsUSUoUAU/UJUTUKUo:GN9dm6m+An1669zkiQSSXK/9tfhtM0GL
- TLSH T1902267A06BCB9CF80194FA0C9E499920F9B5F71721AD101535D8BC488EFB8E73DB6169
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6586.tmp
- Size 81KB
- SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
- MD5 e9b3f881f3855718fe6a4ed7855bae30
- SHA1 cf19171cc1b2186c5e046c0a3195ce47532b215a
- SHA512 50c04cc4ff234bb97192af5b437838f81e3930b1c2024dc13bd292ff85f6ddbaa670c7e2c2a1ca90d2c9e8de1b0ec4c1e7c2aa49ada80a0f4a42f9e461f41c26
- SSDEEP 1536:A+xCoJw5hZFi1QmA2uFQW9z/gkcWBxk40OExFyoxM:nJw51i1PburjM+xEOExFy9
- TLSH T102837C117350C872E49A693468A9C7326D397D625EF884C77FD907794FA03C1AE3932B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e595edf.msi
- Size 31.8MB
- SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
- MD5 db7ca603d463a06806ff1660979f406d
- SHA1 823ade4e43d36416436a115c48ba562d94fa696f
- SHA512 8e2527478514cf5ec8b40fa0ffc53d91ae72a1ba75a8c96800e06282b5e76e2f2f61f4b9e979c15f691591ee4f926b17aa07aebf31de68638b13e94db702b8d5
- SSDEEP 786432:juvkjbX98hUIlkZpqcvX4kp1h1HnX6Jx5L3gxKF:ivk3X98hUUspqcvokD3yxU6
- TLSH T1FD77337234438836D5C26CB095E6C364D2A60D508EB42453A677B2BBDAF37C296F73E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\GroupPolicy\gpt.ini
- Size 11B
- SHA256 77c7c10b4c860d5ddf4e057e713383e61e9f21bcf0ec4cfbbc16193f2e28f340
- MD5 ec3584f3db838942ec3669db02dc908e
- SHA1 8dceb96874d5c6425ebb81bfee587244c89416da
- SHA512 35253883bb627a49918e7415a6ba6b765c86b516504d03a1f4fd05f80902f352a7a40e2a67a6d1b99a14b9b79dab82f3ac7a67c512ccf6701256c13d0096855e
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\dcagenthttp.dll
- Size 3.6MB
- SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
- MD5 c943a1cdbcd28058068b921cc8daa04e
- SHA1 2694d3588167cc0f940a30a5f4b13793e0cf181e
- SHA512 d5bee6a3a43d4b04e41d177af022ff03ac8a2971f0cc79265e00d027294e56b1de289773e487dba60664a6c9ba3d9f2f26bdd5453cc9220cd8313adf1868fd24
- SSDEEP 49152:eGvD7zfSmnd1o2Mm0A1qga6zN/zuNscwOWbKikCDp9ZqljvLQTeDTtJb83ph9h7Q:1D7zqmnd1oT4XN/zuNsSikq6Lzbs9VQ
- TLSH T1D106BF11FF82C176FECE1176827A4F7E4D3A9744076649C767A43AB80E311E26A3E247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dclibxml2.dll
- Size 2.1MB
- SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
- MD5 67cc424838fda84bad295b4459107c8b
- SHA1 404f865e84e6338735a0c38617d73031195c520f
- SHA512 1a3232bed3826065416a50866d02827765c66104ed49c533324f0cb614745028411bda63784f4f8c3819f9a72e65016171179d80d484d10e52300eaffbd44397
- SSDEEP 49152:e9DUM26DYbVgzTtuKlKuuGaXKbj/BAUZLYM7:TMfQgRBBAUZLT
- TLSH T1F9A5AE15F981C176E5E6807486FEEBB6982ECD31232460E376A639D45E341E232BD34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\DCAgentUpdater.job
- Size 448B
- SHA256 bc9b32700d8b846a8f70b3be2de83caf954cf1e47fc8f77a5a7069e2800f441f
- MD5 19317ffa6d6d808a343933c13e40b360
- SHA1 3406b5321c3a5c8c0ef205849c3688a1ca839f24
- SHA512 bea1e8ec4327e5a4bd65323cd0b5d17b876c10f546a722017307d3e2dfc92ec8a364aa3d70ae8c3b464677641ec10e2dd7bfc11e7f9c03ca3d67097fe67c6944
- TLSH T15CF08601EBD1010DF373ABB54BF149D06666FD217A73D21C2075050E4E66F45CA66777
- MD5 SHA1 SHA512 TLSH