Analysis
- max time kernel
109s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 00:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Invoicedekho.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
31 signatures
150 seconds
Behavioral task
behavioral2
Sample
Invoicedekho.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target Invoicedekho.exe
- Size 139KB
- Sample260804-ah9ecasvfv
- SHA256 1935fdce4e68fd521fd4daaf468e04c7364a055848cfebb8010f90ab35d76c87
- MD5 8cf1f92017b559ee0b946bfd0c31a9d6
- SHA1 deb51cb300444743c8c278b071c5bb5efba66608
- SHA512 4919148b9f11e0effc577184cb75678fd4951c8f60ca6a504a2fd002a1d95fd505a66d524dc02cf0cb0b0f43e9a994c7d2415fc6e63f337c4d0e0a1012bd7781
- SSDEEP 3072:QHetpDLnHnwlv52wZ3NGkVYVrzIDoPb62yu:Q+LD8lvk2NyVrzIsP
- TLSH T138D35B0B36A630F8E1728578895A0649D7B2B87307105F9F7BAC81994F333E69D39F61
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
pid Process 3588 powershell.exe 5936 powershell.exe - Executes dropped EXE 30 IoCs
pid Process 4992 dcagentregister.exe 3100 7za.exe 1856 dcagentservice.exe 5372 dcpatchscan.exe 3416 dcstatusutil.exe 1492 dcinventory.exe 1048 dcagentservice.exe 1280 metroapps.exe 1176 dcusbsummary.exe 4928 dcconfig.exe 1352 dcusb64.exe 1448 dcstatusutil.exe 4252 dcondemand.exe 4172 dcswmeter.exe 5788 dcinventory.exe 4956 dcconfig.exe 5712 7za.exe 4820 dcinventory.exe 3896 7za.exe 3588 7za.exe 2528 7za.exe 3732 dcondemand.exe 4368 7za.exe 4276 7za.exe 1724 7za.exe 2152 7za.exe 2860 7za.exe 4084 7za.exe 5024 7za.exe 1280 7za.exe - Loads dropped DLL 49 IoCs
pid Process 3448 MsiExec.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 1856 dcagentservice.exe 1856 dcagentservice.exe 5372 dcpatchscan.exe 5372 dcpatchscan.exe 5372 dcpatchscan.exe 3416 dcstatusutil.exe 3416 dcstatusutil.exe 3416 dcstatusutil.exe 1048 dcagentservice.exe 1048 dcagentservice.exe 1492 dcinventory.exe 1492 dcinventory.exe 1280 metroapps.exe 1176 dcusbsummary.exe 1176 dcusbsummary.exe 1280 metroapps.exe 1280 metroapps.exe 1280 metroapps.exe 4928 dcconfig.exe 4928 dcconfig.exe 4928 dcconfig.exe 1448 dcstatusutil.exe 1448 dcstatusutil.exe 1492 dcinventory.exe 1448 dcstatusutil.exe 4252 dcondemand.exe 4252 dcondemand.exe 4252 dcondemand.exe 4172 dcswmeter.exe 4172 dcswmeter.exe 5788 dcinventory.exe 5788 dcinventory.exe 4252 dcondemand.exe 4252 dcondemand.exe 4956 dcconfig.exe 4956 dcconfig.exe 4820 dcinventory.exe 4820 dcinventory.exe 4956 dcconfig.exe 3732 dcondemand.exe 3732 dcondemand.exe 3732 dcondemand.exe 3732 dcondemand.exe 3732 dcondemand.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe - Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2492 powercfg.exe 2836 powercfg.exe 6128 powercfg.exe 1528 powercfg.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 dcagentregister.exe File opened for modification C:\Windows\SysWOW64\logs\devicepatchaccess.log dcagentregister.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_a1fe82a86eaecabd\keyboard.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_7a788f788529d024\usbport.PNF dcinventory.exe File created C:\Windows\SysWOW64\dcagenthttp.dll msiexec.exe File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 dcagentregister.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF dcinventory.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 2232 wscript.exe 1900 wscript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\logo_light.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UIControls.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\SomAgentAccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\history_ico.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientSocket.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAUser.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\arrow_pull_left.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win7.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstallerunzip.log dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_devsummaryAcccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Announcement.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\icon_alert.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\user.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\sspicon.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-br.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcconfigexec.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfservicedll.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml dcpatchscan.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_computer.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\invite.rgn msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe32.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfserviceexe.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\hostondemandaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ns-status-details.xml1772.tmp dcondemand.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdsagentwindow.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Internet_Connection.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dropdownarrow.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentupgrade.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_agentserviceaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcfilteraccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcprepostaccess.csv dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\FullScan.json dcinventory.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcchat.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dctask64.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_request.svg msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dccomponentregister.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\folder_backup.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log dcpatchscan.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\DCAgentUpgraderAccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\MicrosoftEdge.admx msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\ChatFrame.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb32.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchdownloadaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchstatusaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\hover.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dc_cad.exe 7za.exe - Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e597ad4.mst msiexec.exe File created C:\Windows\SystemTemp\~DFCEDF573489DCC7C0.TMP msiexec.exe File created C:\Windows\Installer\e597adb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE1AE.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF51BCEF81B36A46A5.TMP msiexec.exe File created C:\Windows\Installer\e597ad3.msi msiexec.exe File created C:\Windows\SystemTemp\~DFECD3F2BAD97B7B9D.TMP msiexec.exe File created C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File opened for modification C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\SystemTemp\~DF4BECA61DAE315030.TMP msiexec.exe File opened for modification C:\Windows\Installer\e597ad3.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8275.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File opened for modification C:\Windows\Installer\e597ad4.mst msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI863E.tmp msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3200 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 8 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F78852E0A6E11A07BB0019BB4A1FE97EA70DFAB2\Blob = 19000000010000001000000057df974fcfa6f8c488d8fad52bbf35400f0000000100000020000000282d3aa1deba6a1a1c2a3c182338f42952ef75c0219f6be9a8e19f8b499582e9030000000100000014000000f78852e0a6e11a07bb0019bb4a1fe97ea70dfab2140000000100000014000000ccef2e97a8904e76c86f5eda12ba7b884dea027a200000000100000029040000308204253082030da0030201020208021fb4d8f2982a85300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303732333133313834355a180f32313236303732333133313834355a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c5e505ec38e467cd4448ca2f29d980d5a6e9482810cec4b08e2ec6b778351b110ea3d3c795ade21511d55e24a7a085a2c7b08c607e8ee1bfa1264f4ce1cc0d8293adc650ffdd99a858d35fcc938f39d08592f2d736cf7c227ec193cfad0955a7bbd48615e513f5669d1fba9fe577e71bbbd762918d565233a7c6ef34c45f6f6991210668eac710c002d72f12a58c86b2fcf97ed656c31ca04cf0067ab3c0fb13a9a7a654dac239a0acf5c08d98110a04a82cbb70cbd8716ecaa632eb45995b3b43d39dad25e78baa8a5eae775b5cf2ecc7c6ab47db934e4a77a7ffe05c39880d355ef7d60701b15a102a169834e996339b730158687840e079d869ad990eb32d0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414ccef2e97a8904e76c86f5eda12ba7b884dea027a301f0603551d23041830168014ccef2e97a8904e76c86f5eda12ba7b884dea027a300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101008ba84707c83f13e8f5cdbf2ee4aeffafb27cc8786b2137450bb068ceab0c92dd673c44115f6a6fb2e7a180b39dc17553188a91eebd46686c673f4dea62bbd70ed3008ad2d0a9aa56a23d12b97bd017cc4d76be01292d6c4628c87ae0d680415c0f0232f884088c3cc18123cc8aa5efb18b1a1152d14b808f562ef5116c9fae811a302954f1f09834a04ff2f9cc72ef705bd177b8692cc1c06a35fb3b9d5d5855b219981316fac3817f430581af228feedeaf3dc658b4daf10b7bbcd54131004eb0b28b3756b5c941e80a08963750e6b06af98fe23dd57526ffc28ce0598c72c650ff3781a3c79e2c28f6228a3066d1a9e26f9c9f8b00a199b607df4daa7894d8 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6F060E260C768C9A01B5FD766520374561C4F7DA\Blob = 0300000001000000140000006f060e260c768c9a01b5fd766520374561c4f7da2000000001000000af030000308203ab30820293a003020102020826189ff0f7ab9a2a300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303732333133313531395a180f32313236303732333133313531395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100dfec21430f3c4d3899b9d6947b8d1191147b09050da96521fbc289f3de0fb6e8b166f1148b9f683b500c242087c216f378d0e73cf999eb551d7230b6fe89a5ace4265e5e3d93c258954aa85f634e3b80739ba51f50a99566c8384643a3a9a99c9489dd498125f0a791942af93116bc4589bf6439a998e752604e8c4bb16c3922f2b00318fa7026482fa119a9849fcfe56fb9bec6ca3d2cf21f4637076049f1c0d00b8f7e4f3cba2346127efad1bdc54cee13afc3ffa48c86b4c22b84946a962ca39c06b0552673d2c45e4fdb1a0498c87f7967c9a91cec53da418aa8bb1bc494d2995997d803d05632cfcfd33b0ad7f88fe98c3554ebb2bd23f16e86a8d5fb0b0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414c231451a5e76f77b60cfde24d969ecb4fa2f30ed301f0603551d23041830168014c231451a5e76f77b60cfde24d969ecb4fa2f30ed300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b849ff46c06e5d6009a1a31bb52a6702da3bf3f99be913b74e17f6f2f1d6797f9f163e0afcd2c2f6182c62f582250d689cc8c4cdba7c7556b1ca19269086d589403fc6c2c8f7e6c90e4e154f90627406bdf51fa2b4aec644cbe58173599e97abef89022229916e9c0d27e193d75775e17b51f44b53c0ecb13c99a05f9eefebda560199915cbdc549a66546eaa42c1fc1b82e1bc7bda4dd40cb073de42e5f21f8303bb87b738f9d0c7576435a72c948876d93b71b9f0f870aad53b786d2615e638b723af4ad379d9017fb8f2c6a9c15d75090fea707d3f07bb9210420c5d9abab8338ddab1131f48aa371848680292b864964cfdd3ea7d1f437feafc630b40873 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F78852E0A6E11A07BB0019BB4A1FE97EA70DFAB2\Blob = 030000000100000014000000f78852e0a6e11a07bb0019bb4a1fe97ea70dfab2200000000100000029040000308204253082030da0030201020208021fb4d8f2982a85300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303732333133313834355a180f32313236303732333133313834355a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c5e505ec38e467cd4448ca2f29d980d5a6e9482810cec4b08e2ec6b778351b110ea3d3c795ade21511d55e24a7a085a2c7b08c607e8ee1bfa1264f4ce1cc0d8293adc650ffdd99a858d35fcc938f39d08592f2d736cf7c227ec193cfad0955a7bbd48615e513f5669d1fba9fe577e71bbbd762918d565233a7c6ef34c45f6f6991210668eac710c002d72f12a58c86b2fcf97ed656c31ca04cf0067ab3c0fb13a9a7a654dac239a0acf5c08d98110a04a82cbb70cbd8716ecaa632eb45995b3b43d39dad25e78baa8a5eae775b5cf2ecc7c6ab47db934e4a77a7ffe05c39880d355ef7d60701b15a102a169834e996339b730158687840e079d869ad990eb32d0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414ccef2e97a8904e76c86f5eda12ba7b884dea027a301f0603551d23041830168014ccef2e97a8904e76c86f5eda12ba7b884dea027a300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101008ba84707c83f13e8f5cdbf2ee4aeffafb27cc8786b2137450bb068ceab0c92dd673c44115f6a6fb2e7a180b39dc17553188a91eebd46686c673f4dea62bbd70ed3008ad2d0a9aa56a23d12b97bd017cc4d76be01292d6c4628c87ae0d680415c0f0232f884088c3cc18123cc8aa5efb18b1a1152d14b808f562ef5116c9fae811a302954f1f09834a04ff2f9cc72ef705bd177b8692cc1c06a35fb3b9d5d5855b219981316fac3817f430581af228feedeaf3dc658b4daf10b7bbcd54131004eb0b28b3756b5c941e80a08963750e6b06af98fe23dd57526ffc28ce0598c72c650ff3781a3c79e2c28f6228a3066d1a9e26f9c9f8b00a199b607df4daa7894d8 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F78852E0A6E11A07BB0019BB4A1FE97EA70DFAB2\Blob = 140000000100000014000000ccef2e97a8904e76c86f5eda12ba7b884dea027a030000000100000014000000f78852e0a6e11a07bb0019bb4a1fe97ea70dfab20f0000000100000020000000282d3aa1deba6a1a1c2a3c182338f42952ef75c0219f6be9a8e19f8b499582e9200000000100000029040000308204253082030da0030201020208021fb4d8f2982a85300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303732333133313834355a180f32313236303732333133313834355a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c5e505ec38e467cd4448ca2f29d980d5a6e9482810cec4b08e2ec6b778351b110ea3d3c795ade21511d55e24a7a085a2c7b08c607e8ee1bfa1264f4ce1cc0d8293adc650ffdd99a858d35fcc938f39d08592f2d736cf7c227ec193cfad0955a7bbd48615e513f5669d1fba9fe577e71bbbd762918d565233a7c6ef34c45f6f6991210668eac710c002d72f12a58c86b2fcf97ed656c31ca04cf0067ab3c0fb13a9a7a654dac239a0acf5c08d98110a04a82cbb70cbd8716ecaa632eb45995b3b43d39dad25e78baa8a5eae775b5cf2ecc7c6ab47db934e4a77a7ffe05c39880d355ef7d60701b15a102a169834e996339b730158687840e079d869ad990eb32d0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414ccef2e97a8904e76c86f5eda12ba7b884dea027a301f0603551d23041830168014ccef2e97a8904e76c86f5eda12ba7b884dea027a300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101008ba84707c83f13e8f5cdbf2ee4aeffafb27cc8786b2137450bb068ceab0c92dd673c44115f6a6fb2e7a180b39dc17553188a91eebd46686c673f4dea62bbd70ed3008ad2d0a9aa56a23d12b97bd017cc4d76be01292d6c4628c87ae0d680415c0f0232f884088c3cc18123cc8aa5efb18b1a1152d14b808f562ef5116c9fae811a302954f1f09834a04ff2f9cc72ef705bd177b8692cc1c06a35fb3b9d5d5855b219981316fac3817f430581af228feedeaf3dc658b4daf10b7bbcd54131004eb0b28b3756b5c941e80a08963750e6b06af98fe23dd57526ffc28ce0598c72c650ff3781a3c79e2c28f6228a3066d1a9e26f9c9f8b00a199b607df4daa7894d8 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6F060E260C768C9A01B5FD766520374561C4F7DA\Blob = 140000000100000014000000c231451a5e76f77b60cfde24d969ecb4fa2f30ed0300000001000000140000006f060e260c768c9a01b5fd766520374561c4f7da0f00000001000000200000007f6992fcb71e4408243aee78aa8c868ac3d8438458a3393a5cda778ed741a2a82000000001000000af030000308203ab30820293a003020102020826189ff0f7ab9a2a300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303732333133313531395a180f32313236303732333133313531395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100dfec21430f3c4d3899b9d6947b8d1191147b09050da96521fbc289f3de0fb6e8b166f1148b9f683b500c242087c216f378d0e73cf999eb551d7230b6fe89a5ace4265e5e3d93c258954aa85f634e3b80739ba51f50a99566c8384643a3a9a99c9489dd498125f0a791942af93116bc4589bf6439a998e752604e8c4bb16c3922f2b00318fa7026482fa119a9849fcfe56fb9bec6ca3d2cf21f4637076049f1c0d00b8f7e4f3cba2346127efad1bdc54cee13afc3ffa48c86b4c22b84946a962ca39c06b0552673d2c45e4fdb1a0498c87f7967c9a91cec53da418aa8bb1bc494d2995997d803d05632cfcfd33b0ad7f88fe98c3554ebb2bd23f16e86a8d5fb0b0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414c231451a5e76f77b60cfde24d969ecb4fa2f30ed301f0603551d23041830168014c231451a5e76f77b60cfde24d969ecb4fa2f30ed300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b849ff46c06e5d6009a1a31bb52a6702da3bf3f99be913b74e17f6f2f1d6797f9f163e0afcd2c2f6182c62f582250d689cc8c4cdba7c7556b1ca19269086d589403fc6c2c8f7e6c90e4e154f90627406bdf51fa2b4aec644cbe58173599e97abef89022229916e9c0d27e193d75775e17b51f44b53c0ecb13c99a05f9eefebda560199915cbdc549a66546eaa42c1fc1b82e1bc7bda4dd40cb073de42e5f21f8303bb87b738f9d0c7576435a72c948876d93b71b9f0f870aad53b786d2615e638b723af4ad379d9017fb8f2c6a9c15d75090fea707d3f07bb9210420c5d9abab8338ddab1131f48aa371848680292b864964cfdd3ea7d1f437feafc630b40873 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6F060E260C768C9A01B5FD766520374561C4F7DA\Blob = 6b00000001000000200000009727b787ece9649538033f21516a866c671dafe06e3c386095a251f27d68a83d0f00000001000000200000007f6992fcb71e4408243aee78aa8c868ac3d8438458a3393a5cda778ed741a2a80300000001000000140000006f060e260c768c9a01b5fd766520374561c4f7da140000000100000014000000c231451a5e76f77b60cfde24d969ecb4fa2f30ed2000000001000000af030000308203ab30820293a003020102020826189ff0f7ab9a2a300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303732333133313531395a180f32313236303732333133313531395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100dfec21430f3c4d3899b9d6947b8d1191147b09050da96521fbc289f3de0fb6e8b166f1148b9f683b500c242087c216f378d0e73cf999eb551d7230b6fe89a5ace4265e5e3d93c258954aa85f634e3b80739ba51f50a99566c8384643a3a9a99c9489dd498125f0a791942af93116bc4589bf6439a998e752604e8c4bb16c3922f2b00318fa7026482fa119a9849fcfe56fb9bec6ca3d2cf21f4637076049f1c0d00b8f7e4f3cba2346127efad1bdc54cee13afc3ffa48c86b4c22b84946a962ca39c06b0552673d2c45e4fdb1a0498c87f7967c9a91cec53da418aa8bb1bc494d2995997d803d05632cfcfd33b0ad7f88fe98c3554ebb2bd23f16e86a8d5fb0b0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414c231451a5e76f77b60cfde24d969ecb4fa2f30ed301f0603551d23041830168014c231451a5e76f77b60cfde24d969ecb4fa2f30ed300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b849ff46c06e5d6009a1a31bb52a6702da3bf3f99be913b74e17f6f2f1d6797f9f163e0afcd2c2f6182c62f582250d689cc8c4cdba7c7556b1ca19269086d589403fc6c2c8f7e6c90e4e154f90627406bdf51fa2b4aec644cbe58173599e97abef89022229916e9c0d27e193d75775e17b51f44b53c0ecb13c99a05f9eefebda560199915cbdc549a66546eaa42c1fc1b82e1bc7bda4dd40cb073de42e5f21f8303bb87b738f9d0c7576435a72c948876d93b71b9f0f870aad53b786d2615e638b723af4ad379d9017fb8f2c6a9c15d75090fea707d3f07bb9210420c5d9abab8338ddab1131f48aa371848680292b864964cfdd3ea7d1f437feafc630b40873 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6F060E260C768C9A01B5FD766520374561C4F7DA\Blob = 19000000010000001000000079f0456365e5877f0553bcfc62279225140000000100000014000000c231451a5e76f77b60cfde24d969ecb4fa2f30ed0300000001000000140000006f060e260c768c9a01b5fd766520374561c4f7da0f00000001000000200000007f6992fcb71e4408243aee78aa8c868ac3d8438458a3393a5cda778ed741a2a86b00000001000000200000009727b787ece9649538033f21516a866c671dafe06e3c386095a251f27d68a83d2000000001000000af030000308203ab30820293a003020102020826189ff0f7ab9a2a300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303732333133313531395a180f32313236303732333133313531395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100dfec21430f3c4d3899b9d6947b8d1191147b09050da96521fbc289f3de0fb6e8b166f1148b9f683b500c242087c216f378d0e73cf999eb551d7230b6fe89a5ace4265e5e3d93c258954aa85f634e3b80739ba51f50a99566c8384643a3a9a99c9489dd498125f0a791942af93116bc4589bf6439a998e752604e8c4bb16c3922f2b00318fa7026482fa119a9849fcfe56fb9bec6ca3d2cf21f4637076049f1c0d00b8f7e4f3cba2346127efad1bdc54cee13afc3ffa48c86b4c22b84946a962ca39c06b0552673d2c45e4fdb1a0498c87f7967c9a91cec53da418aa8bb1bc494d2995997d803d05632cfcfd33b0ad7f88fe98c3554ebb2bd23f16e86a8d5fb0b0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414c231451a5e76f77b60cfde24d969ecb4fa2f30ed301f0603551d23041830168014c231451a5e76f77b60cfde24d969ecb4fa2f30ed300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b849ff46c06e5d6009a1a31bb52a6702da3bf3f99be913b74e17f6f2f1d6797f9f163e0afcd2c2f6182c62f582250d689cc8c4cdba7c7556b1ca19269086d589403fc6c2c8f7e6c90e4e154f90627406bdf51fa2b4aec644cbe58173599e97abef89022229916e9c0d27e193d75775e17b51f44b53c0ecb13c99a05f9eefebda560199915cbdc549a66546eaa42c1fc1b82e1bc7bda4dd40cb073de42e5f21f8303bb87b738f9d0c7576435a72c948876d93b71b9f0f870aad53b786d2615e638b723af4ad379d9017fb8f2c6a9c15d75090fea707d3f07bb9210420c5d9abab8338ddab1131f48aa371848680292b864964cfdd3ea7d1f437feafc630b40873 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6F060E260C768C9A01B5FD766520374561C4F7DA\Blob = 5c0000000100000004000000000800006b00000001000000200000009727b787ece9649538033f21516a866c671dafe06e3c386095a251f27d68a83d0f00000001000000200000007f6992fcb71e4408243aee78aa8c868ac3d8438458a3393a5cda778ed741a2a80300000001000000140000006f060e260c768c9a01b5fd766520374561c4f7da140000000100000014000000c231451a5e76f77b60cfde24d969ecb4fa2f30ed19000000010000001000000079f0456365e5877f0553bcfc622792252000000001000000af030000308203ab30820293a003020102020826189ff0f7ab9a2a300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303732333133313531395a180f32313236303732333133313531395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100dfec21430f3c4d3899b9d6947b8d1191147b09050da96521fbc289f3de0fb6e8b166f1148b9f683b500c242087c216f378d0e73cf999eb551d7230b6fe89a5ace4265e5e3d93c258954aa85f634e3b80739ba51f50a99566c8384643a3a9a99c9489dd498125f0a791942af93116bc4589bf6439a998e752604e8c4bb16c3922f2b00318fa7026482fa119a9849fcfe56fb9bec6ca3d2cf21f4637076049f1c0d00b8f7e4f3cba2346127efad1bdc54cee13afc3ffa48c86b4c22b84946a962ca39c06b0552673d2c45e4fdb1a0498c87f7967c9a91cec53da418aa8bb1bc494d2995997d803d05632cfcfd33b0ad7f88fe98c3554ebb2bd23f16e86a8d5fb0b0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414c231451a5e76f77b60cfde24d969ecb4fa2f30ed301f0603551d23041830168014c231451a5e76f77b60cfde24d969ecb4fa2f30ed300b0603551d0f0404030201a6300d06092a864886f70d01010b05000382010100b849ff46c06e5d6009a1a31bb52a6702da3bf3f99be913b74e17f6f2f1d6797f9f163e0afcd2c2f6182c62f582250d689cc8c4cdba7c7556b1ca19269086d589403fc6c2c8f7e6c90e4e154f90627406bdf51fa2b4aec644cbe58173599e97abef89022229916e9c0d27e193d75775e17b51f44b53c0ecb13c99a05f9eefebda560199915cbdc549a66546eaa42c1fc1b82e1bc7bda4dd40cb073de42e5f21f8303bb87b738f9d0c7576435a72c948876d93b71b9f0f870aad53b786d2615e638b723af4ad379d9017fb8f2c6a9c15d75090fea707d3f07bb9210420c5d9abab8338ddab1131f48aa371848680292b864964cfdd3ea7d1f437feafc630b40873 dcagentregister.exe - System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language metroapps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcswmeter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcpatchscan.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcconfig.exe - Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2180 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings metroapps.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcondemand.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\mlang.dll,-4386 = "English (United States)" systeminfo.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcstatusutil.exe - Modifies registry class 23 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Public\\Documents\\Cache_C717_B91F\\ext\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Public\\Documents\\Cache_C717_B91F\\ext\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "44C40189C3AA44442AA780ED114A0026" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "167772210" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6F060E260C768C9A01B5FD766520374561C4F7DA dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F78852E0A6E11A07BB0019BB4A1FE97EA70DFAB2 dcagentregister.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3588 powershell.exe 3588 powershell.exe 5936 powershell.exe 5936 powershell.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3588 powershell.exe Token: SeDebugPrivilege 5936 powershell.exe Token: SeShutdownPrivilege 2492 powercfg.exe Token: SeCreatePagefilePrivilege 2492 powercfg.exe Token: SeShutdownPrivilege 2836 powercfg.exe Token: SeCreatePagefilePrivilege 2836 powercfg.exe Token: SeShutdownPrivilege 6128 powercfg.exe Token: SeCreatePagefilePrivilege 6128 powercfg.exe Token: SeShutdownPrivilege 1528 powercfg.exe Token: SeCreatePagefilePrivilege 1528 powercfg.exe Token: SeShutdownPrivilege 1528 powercfg.exe Token: SeCreatePagefilePrivilege 1528 powercfg.exe Token: SeShutdownPrivilege 4296 msiexec.exe Token: SeIncreaseQuotaPrivilege 4296 msiexec.exe Token: SeSecurityPrivilege 1872 msiexec.exe Token: SeCreateTokenPrivilege 4296 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4296 msiexec.exe Token: SeLockMemoryPrivilege 4296 msiexec.exe Token: SeIncreaseQuotaPrivilege 4296 msiexec.exe Token: SeMachineAccountPrivilege 4296 msiexec.exe Token: SeTcbPrivilege 4296 msiexec.exe Token: SeSecurityPrivilege 4296 msiexec.exe Token: SeTakeOwnershipPrivilege 4296 msiexec.exe Token: SeLoadDriverPrivilege 4296 msiexec.exe Token: SeSystemProfilePrivilege 4296 msiexec.exe Token: SeSystemtimePrivilege 4296 msiexec.exe Token: SeProfSingleProcessPrivilege 4296 msiexec.exe Token: SeIncBasePriorityPrivilege 4296 msiexec.exe Token: SeCreatePagefilePrivilege 4296 msiexec.exe Token: SeCreatePermanentPrivilege 4296 msiexec.exe Token: SeBackupPrivilege 4296 msiexec.exe Token: SeRestorePrivilege 4296 msiexec.exe Token: SeShutdownPrivilege 4296 msiexec.exe Token: SeDebugPrivilege 4296 msiexec.exe Token: SeAuditPrivilege 4296 msiexec.exe Token: SeSystemEnvironmentPrivilege 4296 msiexec.exe Token: SeChangeNotifyPrivilege 4296 msiexec.exe Token: SeRemoteShutdownPrivilege 4296 msiexec.exe Token: SeUndockPrivilege 4296 msiexec.exe Token: SeSyncAgentPrivilege 4296 msiexec.exe Token: SeEnableDelegationPrivilege 4296 msiexec.exe Token: SeManageVolumePrivilege 4296 msiexec.exe Token: SeImpersonatePrivilege 4296 msiexec.exe Token: SeCreateGlobalPrivilege 4296 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 1872 msiexec.exe Token: SeTakeOwnershipPrivilege 1872 msiexec.exe Token: SeRestorePrivilege 3100 7za.exe Token: 35 3100 7za.exe Token: SeSecurityPrivilege 3100 7za.exe Token: SeSecurityPrivilege 3100 7za.exe Token: SeDebugPrivilege 1176 dcusbsummary.exe Token: SeDebugPrivilege 4172 dcswmeter.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4296 msiexec.exe 1872 msiexec.exe 3448 MsiExec.exe 1176 dcusbsummary.exe - Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4344 wrote to memory of 4628 4344 Invoicedekho.exe 89 PID 4344 wrote to memory of 3588 4344 Invoicedekho.exe 91 PID 4344 wrote to memory of 5936 4344 Invoicedekho.exe 93 PID 4344 wrote to memory of 2232 4344 Invoicedekho.exe 96 PID 2232 wrote to memory of 1900 2232 wscript.exe 97 PID 1900 wrote to memory of 2492 1900 wscript.exe 98 PID 1900 wrote to memory of 2836 1900 wscript.exe 100 PID 1900 wrote to memory of 6128 1900 wscript.exe 102 PID 1900 wrote to memory of 1528 1900 wscript.exe 104 PID 1900 wrote to memory of 4296 1900 wscript.exe 106 PID 1872 wrote to memory of 3448 1872 msiexec.exe 108 PID 1872 wrote to memory of 4992 1872 msiexec.exe 110 PID 4992 wrote to memory of 3100 4992 dcagentregister.exe 112 PID 4992 wrote to memory of 5372 4992 dcagentregister.exe 117 PID 4992 wrote to memory of 3200 4992 dcagentregister.exe 118 PID 3200 wrote to memory of 2180 3200 cmd.exe 120 PID 4992 wrote to memory of 3416 4992 dcagentregister.exe 123 PID 4992 wrote to memory of 1492 4992 dcagentregister.exe 125 PID 1492 wrote to memory of 1280 1492 dcinventory.exe 172 PID 1048 wrote to memory of 1176 1048 dcagentservice.exe 129 PID 1048 wrote to memory of 4928 1048 dcagentservice.exe 130 PID 1176 wrote to memory of 1352 1176 dcusbsummary.exe 177 PID 1048 wrote to memory of 1448 1048 dcagentservice.exe 134 PID 1048 wrote to memory of 4252 1048 dcagentservice.exe 136 PID 1048 wrote to memory of 4172 1048 dcagentservice.exe 138 PID 1048 wrote to memory of 5788 1048 dcagentservice.exe 140 PID 1048 wrote to memory of 4956 1048 dcagentservice.exe 142 PID 5372 wrote to memory of 5712 5372 dcpatchscan.exe 144 PID 4956 wrote to memory of 4820 4956 dcconfig.exe 147 PID 5372 wrote to memory of 3896 5372 dcpatchscan.exe 150 PID 5372 wrote to memory of 3588 5372 dcpatchscan.exe 152 PID 5372 wrote to memory of 2528 5372 dcpatchscan.exe 154 PID 1048 wrote to memory of 3732 1048 dcagentservice.exe 156 PID 4956 wrote to memory of 4368 4956 dcconfig.exe 158 PID 4956 wrote to memory of 4276 4956 dcconfig.exe 160 PID 4956 wrote to memory of 1724 4956 dcconfig.exe 162 PID 4956 wrote to memory of 2152 4956 dcconfig.exe 164 PID 4956 wrote to memory of 2860 4956 dcconfig.exe 166 PID 5372 wrote to memory of 4084 5372 dcpatchscan.exe 168 PID 4956 wrote to memory of 5024 4956 dcconfig.exe 170 PID 5372 wrote to memory of 1280 5372 dcpatchscan.exe 172 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoicedekho.exe"C:\Users\Admin\AppData\Local\Temp\Invoicedekho.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\System32\certutil.exe"C:\Windows\System32\certutil.exe" -hashfile "C:\Users\Public\Documents\Cache_C717_B91F\pkg_CAA4.zip" SHA2562⤵PID:4628
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -Command "$ErrorActionPreference='Stop'; Add-Type -AssemblyName System.IO.Compression.FileSystem; $z=[IO.Compression.ZipFile]::OpenRead('C:\Users\Public\Documents\Cache_C717_B91F\pkg_CAA4.zip'); try { $r=@('DCAgentServerInfo.json','UEMSAgent.mst','DMRootCA.crt','DMRootCA-Server.crt','dcremagentinstaller.exe','setup.bat','README.html','RemCom.exe','UEMSAgent.msi','setup1.vbs'); $n=@($z.Entries | ForEach-Object {$_.FullName}); foreach($x in $r){if($n -notcontains $x){exit 21}}; $b=New-Object byte[] 65536; foreach($e in $z.Entries){if($e.Length -gt 0){$s=$e.Open(); try {while($s.Read($b,0,$b.Length) -gt 0){}} finally {$s.Dispose()}}}; exit 0 } finally {$z.Dispose()}"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='Stop'; Add-Type -AssemblyName System.IO.Compression.FileSystem; [IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Public\Documents\Cache_C717_B91F\pkg_CAA4.zip','C:\Users\Public\Documents\Cache_C717_B91F\ext\')"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5936
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B //Nologo "C:\Users\Public\Documents\Cache_C717_B91F\ext\setup1.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\Cache_C717_B91F\ext\setup1.vbs" /elevated3⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /change standby-timeout-ac 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2492
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /change standby-timeout-dc 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /change hibernate-timeout-ac 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:6128
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /hibernate off4⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Public\Documents\Cache_C717_B91F\ext\UEMSAgent.msi" TRANSFORMS="C:\Users\Public\Documents\Cache_C717_B91F\ext\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Public\Documents\Cache_C717_B91F\ext\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Public\Documents\Cache_C717_B91F\ext\DMRootCA.crt" /qn4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4296
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7357FDC6DCAE6B57671EFAD71C7C5CD02⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3448
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exebin\dcpatchscan.exe -y 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5712
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3896
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3588
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2528
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4084
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1280
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad24⤵PID:1364
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 7093261d-e605-4137-be02-f2a185eeaad2 -f "--" -c val-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\Vulnerability-metadata.json" -a 15⤵PID:1212
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:1352
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 7093261d-e605-4137-be02-f2a185eeaad2 -c val-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\Vulnerability-metadata.json" -e enabled -a 35⤵PID:2328
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe4⤵
- System Location Discovery: System Language Discovery
- Gathers system information
- Modifies data under HKEY_USERS
PID:2180
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3416
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exemetroapps.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1280
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1856
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1352
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4928
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1448
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4252
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4172
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5788
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -p processor compatibility3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4820
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4368
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4276
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1724
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2152
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5024
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh3⤵PID:4732
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 9ff13e98-156a-40a8-a2f0-1966149487e5 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip" -c acp -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ApplicationControl-metadata.json" -a 14⤵PID:4524
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\acp_component.zip"5⤵PID:3448
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"5⤵PID:1088
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\VerifyTrustedFiles.exe"6⤵PID:3048
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\dcprocmon.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\dcprocmon.exe"7⤵PID:2644
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe33 0 07⤵PID:828
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\ACPipelogServer.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\ACPipelogServer.exe"7⤵PID:4852
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\Privilager.exe"7⤵PID:2408
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 24⤵PID:4108
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" bin\dccomponentregister.dll5⤵PID:4040
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵PID:2328
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵PID:2100
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip"5⤵PID:5520
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵PID:5044
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵PID:2916
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3732
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys"C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\bin\NotifDriver_W10x64.sys"1⤵PID:1456
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"1⤵PID:4288
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -install "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driver\x64\Win10\DCFAFilter.inf"2⤵PID:3384
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -start2⤵PID:4552
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesFaUser.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\uesFaUser.exe"2⤵PID:4988
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe-s ET_ENUM 9 2 "Unknown"2⤵PID:4460
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe-c 93⤵PID:1936
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Windows\TEMP\{9a68f026-d21a-2d45-ae23-b7fdca2f21f7}\DCFAFilter.inf" "9" "4ca28cc43" "0000000000000114" "Service-0x0-3e7$\Default" "0000000000000180" "208" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10"1⤵PID:2652
-
C:\Windows\system32\DRIVERS\DCFAFilter.syssystem32\DRIVERS\DCFAFilter.sys1⤵PID:2132
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e597ad7.rbs
- Size 58KB
- SHA256 24da8b909e6c8dbe041f8851749f3ac8d0483b463e3ecd64e9145086a81a6a42
- MD5 5c0c038fc8bd52bc56e562497fe7e8bf
- SHA1 422174d986cbacb58e177de5e2be73f582e43b7a
- SHA512 56a5454bf5c3256d65ad767d432fce7bf6c00f492b9d3061a3f204cff57d12b9595f004fabe8b7598cd912e92bdd2fcc8cc28ae6e9203962d7b9730ff6a0c089
- SSDEEP 768:mPOamH6jx6gZiypDO+uTcK2JjhQUGG5DagashiOVb+:+BsCx6xeDO+M2JGA7vi2b+
- TLSH T178436166DB26E2CBD1151AF633826D1806094C7BA6F0C43E13186D3BD4DBA457EBF868
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e597adc.rbs
- Size 546B
- SHA256 ac7577b1416f3e04afabe8280a527844c46e8d18f8c3436e0f8dcda56da43745
- MD5 182bee5f732aab611ea72d10741f13d7
- SHA1 c30cc836f9a4399ca875e9e4c81d3ebcf7f7155f
- SHA512 8633ce8627c70c2d74cae9ae12b4d4967191a86ee74b075e49972fa2dff49714cbda277f972d587787cc60d9b3bc20a78e2351878cb096c32895879b28d8a407
- TLSH T1A7F09E93A70842E2D5A06E3713031F46293FE53DA19487752D882734BD1620A2EFB0CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1002B
- SHA256 c287d40910a8d8a71db788ac702d6c1312cae9e3f1a2465f10d39ba0d81ece20
- MD5 26cbbd08edb952db62bc45dc68769261
- SHA1 59bf0565c8ee7b390114d3998c88e07989d51d98
- SHA512 b00689d03d7b263069e67f0dbb80224727826635e492400ef695ae7dece7cecacb5e82b4ac08f57daedaf16cf366c926e71bbacfd405faf232af8243d34659fe
- TLSH T159110586E56C0F053C55FDF9166D47CB5988A60B4ECE3CEBA46149801F59B1A37CCD14
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\appctrl\data\indexed_dnsa\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 802KB
- SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
- MD5 8f57948e69c82bf98704f129c5460576
- SHA1 33e277af0cea397252c23d310961f803be5cdf2b
- SHA512 628cf68c9436721b874a87e1bff711d3b6fe5d4bd9b02411890059a7d32078a9592fc48e6e53761d17bdbd72c5eb66593b841470157a3e8b38f0b67525d73bc9
- SSDEEP 24576:L48I9t/zu2QSM0TMzOCkY+we/86W5gXKxZ5:Le71MzuiehWIKxZ
- TLSH T1C9059E22BAE5D07BD2421132CA1C7BF591F9976D0B2048C763808F6D7B359D1DA3AE1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 2.3MB
- SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
- MD5 2843aac7409fc7e54722c6238342f660
- SHA1 3e40879eacf10473127386816c24e0cf245410f6
- SHA512 f8a6e689f3b0c6761aa84f29d717d192fc0b34767a06d551a3937827a95f0cf740baada2a151b4ef6138a0fa626a93c94d45e34c235de63e265cebf32c9e70c2
- SSDEEP 49152:8P5i/uH8WK6WK0Lh8tRjd4b39T9+LoSaEYLUzSPrBsFwZkmTbk8iE8phYhlJFxI:8P5i/uH8WK6WK0WtRU9TAodE0UzirBsH
- TLSH T17CB5BF23EA808032E4CE053692FD5BB65D3E9A10132CA9D3ABD53DB45E755E2663C34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
- Size 250KB
- SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
- MD5 a2fb219c999a8fa6b95ad7c24890072e
- SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
- SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
- SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
- TLSH T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
- Size 245KB
- SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
- MD5 cecc32d267ee07ce3413637314b66ca0
- SHA1 627b584f88033791f427091fff74c9310bdc2ef1
- SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
- SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
- TLSH T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
- Size 14.6MB
- SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
- MD5 b26cb94e52dd0688c3a77b46e883f084
- SHA1 27692088d8f3d321a6f9afb39395f6109f0469e9
- SHA512 9823343c9c341b3a9c07ad9b3c89ec9c2efc8ea31f3937cfccd3c03724494ebddcd83a53a383087d2cc8e4aedff1e64aa7bcd76fc7d6a28fec4c6309bbd19311
- SSDEEP 393216:FT+EJ+ygjrEhL2oJ/3u6xC/9HI7T3ebuRgzPNK:FT+U+nQhL2oJ/jI/WXeiKk
- TLSH T15FF633E9B4828A4BC5C889B0C64681C4E1CE41B5DC9A6CB6D5B167BFD3DA8C714DB3F0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
- Size 160B
- SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
- MD5 7fe1c49c6da9570331515a2d300642e3
- SHA1 13c824b889876a1ae1e94faeed430185329df502
- SHA512 9de0c421861be17aa0e32ee5a3b603be946f075bb7178e7ee40d8b8639bedd3761e88114dfddc4aa0ab5ae20d6adfae5535b7205b8fa3674e6e8aaad27a0fb7a
- TLSH T1A0C0122AC1CA24F0EF077FB6B05613A34D0CC1FB020386570C4690401F81EAD8D2C406
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
- Size 62KB
- SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
- MD5 8e3d3fe805da01bc5abb251f2fb58705
- SHA1 8adc16a8e417cfe1130c3b3e40495ea977374fdf
- SHA512 8e742dc4122c3971f3a0175f648647ba0630fb87d0c1a415c5cd38178643a07a0e2e9ca5e360b3e1de530dba5ba323aa963de9daf204bb0ab19afaa38372311a
- SSDEEP 768:KuhPgdGgqsgO0JRCXwvtLqhjgiWmZhSX0P+4EDsXnqmpif52TZaZTAMxkEYg:KuhP+dgv0AvUjymZhSEPF4k4xH
- TLSH T167537B27B390C432D462197458A9C2725E7B79620BF8D6C77788037E4FB13D0AEB935A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
- Size 536B
- SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
- MD5 60f77c64f9c8a86fd24c8e64c20e009e
- SHA1 e9299102aa662027b9e46246a5847074444ec1fd
- SHA512 972afa85faba00ad96efad4951ec92ed90e60175dd80a388328c708975df2871655d8ae31ea750d60298ab1514c1a4b53b3b0304d5ace6118b4fea320c075f33
- TLSH T12BF075C0B546067A64170F3544351D4502476D06A57CA33ACC50FCDCD67E220B0229A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 92KB
- SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
- MD5 2978f0ceba230877a2476d3d99739518
- SHA1 a16ae5aa1bb6017d2732ee5cced1ede9b091816e
- SHA512 5e8ccd699315e23ccc94b4541d568815f88ffc5736c39bdc29d4dc9c3dce3e8ee1b9c70e9f28d980b5433f5bc10d49658b13dc2e8947a415e45d1e4153001cc5
- SSDEEP 1536:APLaK7cLtLWedH8rwkrsofXR1BjDrl7E2zzi0FNLGpxLzH:T66trH4wW3RE2zzieLGDT
- TLSH T1ED938E227690C032E456597468ACCA725E7FBD215BB8C4C77788477B1FA03C0AF7A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.2MB
- SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
- MD5 9c1ac952bdfee44fed1ecf7165808e12
- SHA1 8fee062be189b641b0ffcbbb7287697b9be16cae
- SHA512 bb9720f816a1833769d083079a75913c7aef9a103c3edca122ff151acd94cfb586b3b8303720d305807f72f28c6370bf80d478c5a0e6beb734384a89e344685b
- SSDEEP 24576:QSTpNU+Po5KeKA66v9cskz0LIU6iUKLO7N7EqyyF6FmR0OqZC0uNZtSTHytb0Dk:Q2F1ec5zu9LOx7yyF6FmR0OqTi+TStgw
- TLSH T13B559E22D7428031E7E200B7C57A86BAA938AB75131190E3E3D45DE85AEC5D17E3F25F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
- Size 3.3MB
- SHA256 e3200c70077193f3decf5896fded35b3cce2034aec5517178a24e35a665abfd0
- MD5 cb8424f3468ff7b5d98890f119279f4f
- SHA1 d82d02cde0da4f79b8bc430a306e47767f08f60d
- SHA512 ea59556d8f33cb1a05e616d9095d869590dcf47acd553c86ed4439cdea5e86251159e166cff9f84e7ac99ed726343af2371c057d80f1b249d4e72c3a777cd23c
- SSDEEP 49152:cPsJnLOymqHBm6MkoA4kLF6NEOROCWHnu26Dz7ZJSoY9n0aSu9cLGtTNpqLO:cPsJLEqHg6MkoMcNEQ/lJSoYeaSFYsO
- TLSH T1C5F59F21EF018135E6D100B7D67DAE6A582EFA30132190D3E2D81DAD67B46E33A3D65F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
- Size 172B
- SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
- MD5 c8a811d36876948a70fe7509b7f49925
- SHA1 48541ac236da4f143154a8f71fb7fb3f3110bb38
- SHA512 6bba69fa213b495a9faf4ea917788c43d888b3d96606db1644d7f8c456fb089f01d3e2582016a5043a49182ebd9767a2169aab94de05868ab0efeff5825c7578
- TLSH T115C0801594D652DB7498C735951537213919947F996DD12D404431F134785A0511FD64
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
- Size 318KB
- SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
- MD5 4373ce1e6f57dc9df7a8ada69479d8ba
- SHA1 f19deb28a0af966ad8c03db23cd21f75dfedda08
- SHA512 e1c1cd77650e72652528b005da981a8ee3b28c995c41875a872202d0a00c75c612050f74b626dbf42f9e5412624860d182b7b6c98dde4df7c09a7f735834dd41
- SSDEEP 6144:QnqKQ2Oq3ScuA05A+O4PlDfZIkbaRF30zG26Wdi9vhEsSCyAekfX6xgrNQi:mqhq3M5A+XfhaD3lV5SCyAe+XmCJ
- TLSH T19264CF2137E5C47BC692253089DC6BF970FAA7490F2448C723C49F2E5E35AE6D239729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
- Size 1016B
- SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
- MD5 368947d319ac4823f5d542c8f723fb0c
- SHA1 7d419d7c8b15f9abefc936f526e68ae2c535292f
- SHA512 ed51660075cfeb5a3826231a0f0e2b1b165d0dc808cc5c1f309885dfa7903c914b76bebbb183ef38d67a789adf43b0e6e5223cfccfc362d50ab05b1becb15a60
- TLSH T188119AF0A1F0DCBAE7571660799EB42055D66AC03249424D340BF6286EB7715748CFA9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
- Size 6KB
- SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
- MD5 d10bc07005bb2d604f4905183690ac04
- SHA1 69011104e870704cf45910d74bed5938f9062891
- SHA512 c8df6ec5eb5684348613af6e8bc2e8d5759ff9912e9d36df42c09960739b0922c2830b56059ec0a95fc2ed7aa83fb3fe5a8673402544c4bd00daab457b9b97ab
- SSDEEP 192:JfC8S1p4JW0bYmezNui5WP1UMIUN93GUO4:JK8AvOYmW1+BIg93P
- TLSH T102E19E87A4C2459E8EAA5CFF1D8E522DC17B8E1A9A1B50C52552D2C1071DFF8D483FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
- Size 6KB
- SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
- MD5 00dd0ec0a16a1085e714c7906ff8fb06
- SHA1 244bd9b7c3b1c4f7ef72de31f67804faff213715
- SHA512 163afece9ae9693c41324ffd89191132a8d2e42d73f962ace0b70b44a17d954c8f506cc25af152397e2536da6245e4336ae465708edf6ede955b4ad502af7a71
- SSDEEP 96:gMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6KaP:zXTvYXQzy51nfmcuXibSralG/aP
- TLSH T166E18DE534F0C16898A14C3253536644D16EB3C3A8F7AD02C1B0AABAA465F3872FF7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
- Size 4KB
- SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
- MD5 4e7e3e142f3939883cd0a7e00cabdaef
- SHA1 d20567fd436991539eafd65c3bde77d82a656012
- SHA512 d145a64f637f34d9f9fefaf7cef14ea277d0933e16c625234a9c1e0a54a7f3d0d820ab49b4b68d5d3e9853399d74efba9ff7771bfd3481f8c1c70e6dc6f50275
- SSDEEP 96:7sHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:oHm231Nvu+wIqltWOe3nIH
- TLSH T1A7A13DE27BE7DCF495E62277BF9D5491E1542A41207047B4C4C4D11C695C99B1361E11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
- Size 6KB
- SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
- MD5 40bf25799e4fec8079c7775083de09df
- SHA1 4fc6b1449c73f5d10489c104225ebe326a4016ba
- SHA512 51c9e46224098e9270bf51bec93e0528b5e726a632a1de57863fba531d914a9db1d3fb07d22cef756f6fc9e999bf08043e73bca6225a9ab7efffe2904105c388
- SSDEEP 192:92XiIsTugcTnouLuIXdj7Z7rgmlWRI1ie+BVtNzDby:AmOTnwCnZftW61ie+BV3Xby
- TLSH T15DE19FC1E5F8C4E0DD58E668EE886209C7A658B9064742DBCF0485694B48D3186FAB8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
- Size 4KB
- SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
- MD5 093a819138276b446611d1d2a45b98a2
- SHA1 1c7fc1ab71ed0d9fa051f07c7e8f43467121ebf7
- SHA512 c886fae282a185b69a2cdd8593cc4c4e7ee463bc010bf59544058bb294cb0bc2ecc008a9dbdc6c7cd0e45bbb80bb9cdd5b7520c4a88779eb8ff2df56128d7b8d
- SSDEEP 96:gHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:gHm231Nvu+wIqltWOe3nIH
- TLSH T187A17DE17B6BC4E4EBE7233FBFD95460A1542A01206073F480C0D1ECA98D9A71361E21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
- Size 6KB
- SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
- MD5 ea4ebe072be75fbbea002631916836de
- SHA1 1769aa84191332e981245146067080ee4faa592a
- SHA512 85990dc5c32560e10cf380d0e10707a4d995ff58b35cc81bb0ebca5afec15c1ddd6cb0de8e7fb392f2384f2a7ef9482f2b1e47924556e983b9c5ff1a79c1e7de
- SSDEEP 96:DcH4W00cRUjbz7dqG+sLo/Hh+U5cVH/lT3jmk/8fY44WtYHM4tNtldMJU/gl:oYW0YhqG+sLoPT+XjNQYbZNtfMJb
- TLSH T1B3D19E81D6CEA64BCB01DCC97EC73BD82588436B5A1A94EA15D2B0C8B52FA8CC50583F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json1944.tmp
- Size 100KB
- SHA256 a0d4f6bf96122a1006814b91832d884d0e229ee657b00173b3d5db9ea19d910c
- MD5 8c2fcdef020833b4c08dd2a298e60af5
- SHA1 8032dd7bf54b5b855cc0361dd9ce7eaeff528c44
- SHA512 12677470972cd3a77bbec21000d52cf7fd563492a76ae419cb6162a9af41a62310c1cac543aa95a300272bfb5c13ef939a9433cb08c13893482ef1faf26670ed
- SSDEEP 192:5wlP4D3l3RHFnZ0gzfL3LPDnOaDnf7Tv3r4QH/nv/nv/f+7JGZW0e47MgFrx6V1X:FxF/Oc5nFDAHcd6xzf8S
- TLSH T1B7A38919DB60DE43960AA3B150084D01322E137BBD89BFE4375E663C9F4D52F197E2AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz1944.tmp
- Size 464KB
- SHA256 330c26d95b59deb9cc893537bc91e1b8852d1ff4c99219c968ded6e93440c009
- MD5 d9fe4142d10fdca3ffa4c1b13c0793de
- SHA1 da0cd0fe875fe19e60f2701aa35d3d1a23c0fd71
- SHA512 fe4f9a114b34a0fd8d0c8dbbc0964450bb225686ec113fb638f8fb21a76cb357a0bda3e67e7675c1eaebf055ded845e105d2c33710f16589cd99223a25709c5b
- SSDEEP 12288:KAv6dZ+cXAx11I/fMN9fgR/o8GlPfmenWO4pU9GC:WwlxPI/EIRXGmYp4pU9GC
- TLSH T116A4235525FCE71799A2FA4A5EAE80925BD293040ED0C671EC7A7034829276DEF3FC50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz1944.tmp
- Size 201KB
- SHA256 0e38c0611ca05835971a71b2f460ddfe8a936b2b5c02d6611b09854c6cdce2a3
- MD5 42198bc0b5a873ae4542e21ca7a55ccd
- SHA1 db6e99be06fb5162f0fd2c5c4aa4a27964b8b5b2
- SHA512 94750d83c9de6017fd39bec8e05e1ea6daeb40722afb471079267a1477a95a43f89639ef023fc401c8c6a6040246d3fc23970c8f476a17ca3ce6872a50514da0
- SSDEEP 3072:9KnpnnBDOTA7Um0byMAI/OZfzRb2hWxZqZz81JeXSZU//OtHesb+NC6a13MJS09/:AxnsTrm0byMOZfzRrxrJa9araY6wMSCH
- TLSH T1841423634D00599F10ACDBA561FBC60636953EF7815BBB741BD6B9CE3BE0F8442B9012
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz1944.tmp
- Size 106KB
- SHA256 720e3ad75a63b849b8c08bd20cf08b10c2cdc188957da9f62f1ff9509f63ce17
- MD5 c4d67805dd7a13173ba3683833af3626
- SHA1 3c15fd9943334ae8f8573d590f407062ae2d34ce
- SHA512 74892b1d831a0fdb6f68811f0e3db8ec10ad0a4eb70d61efb660d9ad0656b4f8cf25971fdd58803a0ad627a3cffb91388a7a32974358cc82b8e0fc133238812f
- SSDEEP 3072:32I3AjIRq2uM7EoL1cq9f/NS1c3PD+hRpjqiYsToNCg9:32IeIR4uEolE1iPDAMH
- TLSH T137B312304D05848B322DEF06EFDD73E23E4ABD6FF99295563D5481906953B30BBA2D21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties
- Size 98KB
- SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
- MD5 c340fdd54a3956f567a1b3b5bf0ad58e
- SHA1 3c620fd4efda92ddcb42fedd600d4ceb1d940a97
- SHA512 d5e3171d3b11bb56fcf35de8ad596fb37008f21d9e8dfa18444c1460490fdffde3149981ab7fa45a144ce1daa28a5c588230b58fc802ccd30568dc2383b38f3a
- SSDEEP 3072:UyfCAIeTx7UYwyKlWF/VPKWl+DE09phQl1mWSDj8kS:VfCAIMBUYwyKlAVPKc+LDj8kS
- TLSH T16AA3735AD1766F7E33C6132BF4392BD176B20D648741A9E87988E8F4D63C84121BB4B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 15KB
- SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
- MD5 783b02208909201added3870096ecb7e
- SHA1 f912be0d056a40d9ffc49aeff5287d258048664c
- SHA512 a3b95b96082621a06f1b3df0dde7b50b4c84172f8f5a48889f766fab9594e3dc41a86ab47553bc8ef4a01c29103bfc59ace36f1135e4aedc0d7079faad513589
- SSDEEP 96:jSOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:jBhBAO8b0Obx9nFLnnmI
- TLSH T1E662C593A51D099F0222039999DF7AD3A1BC94344C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz5508.tmp
- Size 2KB
- SHA256 5cbc36ed2b88e9ecb6ad8d4d68c98cb191cf82807fc1092a1eb93cf34a0dd67f
- MD5 2753952dbc7aa26752c1f36db853c800
- SHA1 4ea38945bd0c241753f19d857687e7d084123e2f
- SHA512 ae992e2c5d83e9eb7c27addc49701aafa5f0920de7c2c04b65e38c694150ac9e18391052bb047d8c0856152335877d95628c1dc2c03fd5ddd4bf242dd337ee55
- TLSH T154513B003C98BA73331A92966CE3AD1A4F33E2F0005D1968E9BE0D01438F17E3792F5A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
- Size 3KB
- SHA256 11eefc1e2305c4223527c6e95389dc5ce39074d424e37cf290b31eedeee25221
- MD5 96411a9f1cb0edda48db9bc290ff99c2
- SHA1 0e34de2fc9ac6607d43d420763d75d39ac2be944
- SHA512 4e165427b12464adbab0249b9e526500e90a90d6d0085ce095a62e7ef256b329af2abc2e938be03a669733daae71142d87c80caa20f4b236e6fee3b1d0accbba
- TLSH T1B9813211A0B0CB2D1375776CDE56F615CE0607952A190B0AF06D34FB0F7AAD17AAB4F2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
- Size 242KB
- SHA256 1a388c11ac7b14c44ecb605da1f6111274beb11d947442311c5ef1a88d6e4b68
- MD5 80ff33c99dd10147ea596dc25319a780
- SHA1 04bada413072751276f871286071cf691b5073ff
- SHA512 ae0ff8a43d19cc0b4a26cf10e7fa28779d803d984639d2e6a5304a6e737635a440a5551633a1026be8b3a9d847ac0f7e125e1f00f0edeb5fb03bc5afefa6e44c
- SSDEEP 768:HDVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAaS:HDzZZ1uSNABIpkIU1
- TLSH T13E3418969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json2444.tmp
- Size 898B
- SHA256 49bb65c5b909d75aa1e2679ff85385671772431f942fb7fa17d2508886ff9407
- MD5 b2a23ffc7f6d76f464e4843286bc22b3
- SHA1 45576d382f515843a879e88b6955c6edf8927617
- SHA512 7b423efa88cbb63a08d7d6945469fb2c1cba8772a15978d32da3facd172cb9f03e4d93cbea73289d79b7ad1bb162d692a9a16127915e3b6adfbe1cf0d63d02e6
- TLSH T1D311CAE470AF0CFD82C6F55AAD8DD02ABBA9F626D0F88C087659F9088EC6048B3D1514
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-br.xml
- Size 54KB
- SHA256 200c5b769c540ea6cfcf8b311b3cfbe950b2f93406020deca59cd31773a6c9d8
- MD5 52d1db2a3b9241f873076cfabeaf4582
- SHA1 b51ac32f72a5377a9e13c9bfd93e92ebbc3983ec
- SHA512 b1f92bd0700e5f48cc5bc248e4bc5355cec384588ac816aa5ee3399270ca653afdbb162c7c876954d5e0fe2738ad76d212a626614f20ebc8b2a2bfda06319d7f
- SSDEEP 384:GvBUBk4Ou1tkFHYEMVlm5D3GEb5o7sRUURA2Iy679RUuLIp:pOum4jVlkDRdoQZIy67MuUp
- TLSH T1E843861F2EDDFFC90489D8A04CA470842E6F6A7BE59154D0F89FED35AB046DB6C32621
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-edb.xml
- Size 389KB
- SHA256 be1f87e03f3fd0cb7fc75784db831a31cb3c809cb08d4dbf784d6ac832382534
- MD5 666c46cc0aa743b45457fa116ce22001
- SHA1 73ce9949094a69121066eff149e897fa93764b17
- SHA512 69a6b3cc0f44cfa8d7fcd1ac458eb83cdb607ce60af17347dcf2e8fb6d5ea6e537b1b1be5c2150fd22355631ffea4435341eb891b8653546ec7b6f339d46b823
- SSDEEP 1536:cdr2eN4+wTmYLR17wX5jTf0ClYOwiyP0ClTNp+dJ7fU:cdrIJQoL
- TLSH T15684245B7EFABBD91485D8D488E030841E846177B95126D9B8CECF769F01B87BC23B18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 415KB
- SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
- MD5 d1a1e51389e6663e8e53933731adf46f
- SHA1 9ada91a587210f7f67ce5e805d7c35ba1c4201eb
- SHA512 14208064c56b6fd9998f10b7a534b3c48ddc1539ca4ae63521e5ccced1824e3a2e7ecc0c2e592138bf17d4ef07d253ba537215d8fc095b0d2a55842887624a99
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZn2FYYh:6fufQiiNJY7tYiSYh
- TLSH T13E94B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml
- Size 278KB
- SHA256 73c9afdb65406c39f529eb6461b60b91352160a6ab53cf6f1d1c033ad5baf61f
- MD5 e59e02705dc4f04e06050fb7537d2459
- SHA1 4bfc64e6291dc30a50cceb5385118acd2fc4d363
- SHA512 ca4e1dad24d33a0545d04cee84b34f634f9b7e0923a61ae399ff44432352f70e73656e2a67b60e8c3cb1ded972321d0fa233885000505fc7dd47d4bdefe264be
- SSDEEP 6144:linOGst7mrpjMG9KKJoDm9d2JKbT4S4j8xpMqH1GOYKK2nYdcZBYa:wJ2JKbT4qH1GOYX2nYuZBYa
- TLSH T12454CA1F2EDEFED50449D894889071842E6F9A3BE19554D0F8EFED35EB00ADB2C32661
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-vul.xml
- Size 163KB
- SHA256 052ff066f5ca62c9d79312f15341789b4c4851c0e0f67e02eb3bed5454c1bd53
- MD5 46bdc1ed87d1ff5045a43d68b2810696
- SHA1 473d1fc806c370ae188099e09d94835a0112b51d
- SHA512 0f7329f4382486bca23c2dcf4eb33dde6759f0cb94652557a57df571fa67595df193fc356381bca4d61943b6fac8dca13bbcd5186c7d803c6a9c59ce3331cd63
- SSDEEP 768:XEKy8oHAQ1oSX/DET0znoschasDgRVgAY:XEKy80AQ1PX/DET0znoschaegk9
- TLSH T1FEF39A2F2EF9F6E10045D898889071941EA06277E69566D4BCCDDF76AF00B8B7C33B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
- MD5 415d608384f186f24717c62056111c99
- SHA1 85a8d23411db39acaaa00a7efb974535f74bfb26
- SHA512 f72b81cddefac677b27d41380fbc647c83a1cd22ac3d319659f569d64907103cbaa5ca3ab877c97fb54f3f0f37b5a6a3a7afa96f6c4c7bee02aaa275473b7ceb
- SSDEEP 49152:L8vq3hwELiWbHTKR0NDZK+/0KfEDKJKzK5xFKOQFKNoDKpW83wKFC+KFE2v:4vqxwEeWbHTK+hZK+/0KfEDKJKzK5xF8
- TLSH T13E75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml
- Size 6KB
- SHA256 3ad0e5128c6c817107392a3f3a4d97797f7cd12c78fbcb81c38440a92955bbbf
- MD5 cc370df97cc7557c37ee5c5f0ed3b985
- SHA1 7b07f3b85d029621cd6df01d3b0bc75413ed5450
- SHA512 127a0220b1682a14eb1dc05e3287dd62789d624ebc87335a5b2ee08527879f65878d1d7475c7aaf86fe0209e000b10c22f47739d208394bb2eb5732d147b99dd
- SSDEEP 192:CKHUKfadKr+KCe8KrBeCKuUGUKEm+KO+KGk9:tTfxVCorBu5GzDWG8
- TLSH T1EDE1BC69A65C9E050A7328D7B71733E563B1861B06D0001378EFB1A82B73BD345AF6F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
- Size 28KB
- SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
- MD5 889d10168a96d01a40af825a606ffbe8
- SHA1 d1a75fea9d9aedd31dd581b8cdf7b45791d790d8
- SHA512 4536452db3e0d32cc7129bab4180a509b71d5affa0fb98599cf7ae4d21671cce0fcb7335cc891a0ce247de2a6674197f6ba74409a14b6bfc15a7a03d1511b90b
- SSDEEP 768:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYOXNe/pR71KRa2GG4q+V5No5hVMKD4idqH:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYL
- TLSH T10AD2753E61A0FC4CBAD0E85C14CC8A188855D313518D7AF1FBE84F2E0BA59A5525FDFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml5384.tmp
- Size 9KB
- SHA256 6b0e665f6f3764adfb4e352dda123c936cd8c017a50d21e15abcbebf9b35b904
- MD5 0269ece9a2410f28f727f8e6a3300ae7
- SHA1 8ee44ac157716b2f59360cb61d7ba4da2b5d90d6
- SHA512 5c120a2bf5a4254c4a3737f93f639bc64800e59ea26ea93fc2e003d67b7f8a94f5e89f5b025689ebc719c56e63e9ac7668f7048635136c124ffaba92f83e3e58
- SSDEEP 192:4U/UEUUhUKUwuUOURUvUEUrAU2UFU7UTUMU2UZU+UdUlUHUHUzUKULUZU+UEUzUh:4k91N6nmG9+AnUoEDB696kiMA/uY9VQg
- TLSH T1E01259A06BCA9CF81194FA0C8E4DD820F9B5F61721AD105435E5FC488EFB8E73DB6169
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 3.1MB
- SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
- MD5 7e12fdfa73e292f21d91fab687229213
- SHA1 092919df467205f4b81337a73e1d8602c77d92ee
- SHA512 5e41cf585b2e549330b21d8e9f414fbe7588fe405c1b80d32053c14b98b45a001384c93ac32e7253910f01285f1c6efc0d46e163c1b0c3f017fd04f5bda20ad7
- SSDEEP 49152:8594T6Iiya9PlJdUI11loQlxI6Uh8Zvu4d7TmunCQ/XHaT9eGfcph9yv3fxJuQ:8P4uIiya9PeHQlxdQ4dGunCQfUer9yvr
- TLSH T19AE5AF13EB418031E5DA00B6C27A9B7A9D396730132590D7E7D06DE86EB45E27A3E34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
- Size 4KB
- SHA256 6e7fa525b83a46cb8bb0c0fb400ea1b82acbefcd7ccc7cd02073b46f93d1de7c
- MD5 61c05cd456e9ac81d86e31cb20c12842
- SHA1 429677ae1cd75b8a0628404c46e713db2effe079
- SHA512 704e6e06a61341964bd137efbd0153f26c3b9cc5a0b7e4aab29dd37d0a386a4f611ef70d6ddc1a8994a4d258e37e466456254441429a5aa3fe129acb7a1fe7ea
- SSDEEP 96:+d7SnVkEVeeCVOlVlVxVNVcVYUNV5VzFVCVE:+diFMcrPjKFn3YE
- TLSH T14CA1234A27DC8A7557AE0A5FF186A81441983C4BE1713274FB16809BDFA23A1F7F8918
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
- Size 256B
- SHA256 98bdbd730da3d583a6660cc86727385a7f43f32b9cc48c3f68d0f575afcea7d0
- MD5 fa39af57b06023e724fdcc50fa1825fb
- SHA1 6064c70b7f483787303a6d24c009af6b5641082f
- SHA512 fb4ed6adad53d1e19e576a4be83f036efc566887fa45b800f9d81cb18631995672cdafe853a3be5dc110798df1b1074c89906658319b273ff8956bf197eeede3
- TLSH T187D017487C2B61141DC137A53C1DE790145529036B60EE00736524349BE34AE37F8021
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log
- Size 784B
- SHA256 5e61f7d1b02fb475afc55125f954df4c9e9b90eed2090c25d932f79d0e2687a6
- MD5 4f2556a510eacad1812b7fcd52c89a99
- SHA1 7c6f4e7f4b8710f94d999ffc360c6e4d41eeb3cc
- SHA512 527c2436e53ce57ee18a3ef45e5e8ed4885d2a3fb9de1b24982c5ef29775377ea7e85a512f5e41db02003531024b9e6bf67927cd9c209a098cecc82196a2ee75
- TLSH T1AD0122628F09060828CEE37738DFE723E53191A20F42790E30ED2558933534C3B9E428
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c242955204af8017d7d001750715285332b5ce53c3b3d7bc6b97fece5b5df31b
- MD5 f59c241c288708d47d3f434c0216587b
- SHA1 dd12f39b82730c14f2d69746744ce0b70b7e6820
- SHA512 29a3a2801a718725ee2d03660954bbd869b002893633520096c5e7229bf45076b109926fa2ee72ff4cdaafdb6b40a621db40920a22711402d54e52be1a0fb1ce
- TLSH T134214B33B3CC86E4D899413604DAAD1037B697D754DECED7A784D249B53F288DEA1190
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\Cache_C717_B91F\ext\DCAgentServerInfo.json
- Size 1KB
- SHA256 f61a22250f15815ee5bf3657c8cb6f7c7c385aed68c45989c895366187c7e02a
- MD5 ee7673f445183702b3d18c588c98b4df
- SHA1 5689a7dd5d7b4f6d28eeea7321bf3bbf3ca53b68
- SHA512 c5145d92da30d56f253b7ce5c5165d615d66fc9a1825c94e3df7af95adecb41c4af51820bba8c31f1fabb125909efeefc8c4ddb8f9f763be332615f2c02fe64b
- TLSH T18B3110A8D8130E5B5ACD955C181C1846A6B4012B1C24388CB71DA6DDBFAE21F13F326D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\Cache_C717_B91F\ext\DMRootCA-Server.crt
- Size 1KB
- SHA256 d5557ae15f12c4b7d27399def6c1819f8821a13d0de950cdb65e17023e9552b4
- MD5 d816e43e13e009e227c967897da79a46
- SHA1 06afdc65dbc8cb3f456cb34b54ec6b77d78fab45
- SHA512 2d97f8490012f5ecec07e47016f5bb20a11795234ca55c325584c4d32ae8bf69922ae04eae966ddffac42b05dadd31e432f60180492168522dceba520f64c1aa
- TLSH T11E21B6740E14ADB56567B7B8D41983E32D480F0B1DC248B12E0CADC38358906BBEA40A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\Cache_C717_B91F\ext\DMRootCA.crt
- Size 1KB
- SHA256 aa78c357965f4239d7e84cec68347171e0e620a39ea012f86707659b0278fcd8
- MD5 8b0500ab21782acc63041f01a48b0fac
- SHA1 9556a0b90df9de1550629e39f033b43c85b790ec
- SHA512 f71623fff74dc0c34a87588a8bec83c58a345755de36acf522173fe2fb2b13b03d475f90979ec93f7c6aec83bb1d8a84ded26b97320bafdbe608ccd0185ff238
- TLSH T1273107028D1228D0B28BF598E52E212D1C279A4D8CB74BB30CCF3D42DB866D4661E24D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\Cache_C717_B91F\ext\README.html
- Size 2KB
- SHA256 c430a6802aa574bb46874cd15321b27a4ba69c55c04f1f83072acce7b5e8a452
- MD5 ab3a8287f8e9ab6d80ab5870c9f844a6
- SHA1 5e521d5161bfab7b2c041146aa1e12ee85a1ba4c
- SHA512 1143e5a5dc825152d64a7af57c19f495a1a21192f3b16cd7aed9c6acfaf796d093f692655b74d7f516576acc96726b821cf8034978baabb9cbcd1783b8d48bee
- TLSH T11E51DC73D7926F37A163035E714AE3D82F11F1C19054AB18B2BA81D67DCA12B60673DE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\Cache_C717_B91F\ext\RemCom.exe
- Size 3.1MB
- SHA256 7a1dcf22a67c194367d4ef65304cf69c11df0b14c3d08215b7ee81373a3cefba
- MD5 3e298792e73b58dd0b0d81f91683d9e0
- SHA1 ed5066d483b7249dc75fa4b0578108f96b8c91fb
- SHA512 aa3ce01fe0f5602cc79fe8879cfd773e0bbde8a820f81baa95698a5346b4cc1c6bb36cd39839995cb308cf9248e566500fdf8c040e022130693f01e9a04c6f66
- SSDEEP 98304:qI4kvKvHx15RFAN4z4yGTpOnHNQc9xQrpf:qI4kU5RFRzw9OnHt92rl
- TLSH T108E59D13FE418471FAC2013B82FD5FBA8D7E9610136DA9E3669539B44F702D26A3934B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Documents\Cache_C717_B91F\ext\UEMSAgent.msi
- Size 31.8MB
- SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
- MD5 db7ca603d463a06806ff1660979f406d
- SHA1 823ade4e43d36416436a115c48ba562d94fa696f
- SHA512 8e2527478514cf5ec8b40fa0ffc53d91ae72a1ba75a8c96800e06282b5e76e2f2f61f4b9e979c15f691591ee4f926b17aa07aebf31de68638b13e94db702b8d5
- SSDEEP 786432:juvkjbX98hUIlkZpqcvX4kp1h1HnX6Jx5L3gxKF:ivk3X98hUUspqcvokD3yxU6
- TLSH T1FD77337234438836D5C26CB095E6C364D2A60D508EB42453A677B2BBDAF37C296F73E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Documents\Cache_C717_B91F\ext\UEMSAgent.mst
- Size 20KB
- SHA256 180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
- MD5 0509fd12bad30c0cbe679a18bcb2042a
- SHA1 6c933d6b00da0a63621e646912a1079b2af5e0e5
- SHA512 9593e50f7c91fb06701938376255e3a50985a2b7559340f1f17d801026a2f5b8ef1348857b80a0d9b6559768525d68f148b372a50597b0ec8aac15309db800ee
- SSDEEP 48:k7xLm2JQMPTjbJc3GgCP/p/vvrdGRFXfJJa8:kdJQyNGo/JRST
- TLSH T14E924D4AF622E93ACA494A329D53C3CC0731BC01CD82425B76D8B7DFBC7A1841B165EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Documents\Cache_C717_B91F\ext\dcremagentinstaller.exe
- Size 194KB
- SHA256 927837f0b31d20c0ed7948cf6170b57b28bfd4bd118aa21853611062ed2678b2
- MD5 35c1ebfd236a2222141531829f67f0e3
- SHA1 c6be8310ad8152815bc74ce423a02b9360b0f493
- SHA512 732f95a7541b2aef592d159656d2212598401f21be00031a6a66080efa52ce293fc85f458b4f1181a8e5fece98a837e51dc121df773abf0dc210a87cdd54add4
- SSDEEP 3072:xDTP/OYHh9aGwsXOXhnyuGqmEiXyM9SUJlLxTU6mpPF1tE:xDLZBAGwsXo6EiXyM9SIltTU/znE
- TLSH T1E7148C357689C073D557153949F8D77B7A6EB8220B60A0C76BE80B7D9F702E29B3430A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Documents\Cache_C717_B91F\ext\setup.bat
- Size 3KB
- SHA256 fe27ac5a7a72e2f380ecd90367eccec418f87dd7cabb3d3a19ba27f38871b13e
- MD5 efc869e1d2ec0db71eb82e86bc114b7b
- SHA1 066e0391da7faa969a7c506beff3beef74b9bd53
- SHA512 edf588d20a0a66f510a370ec63fb351054b201c091d7c26f0501197741911184b7c7dd73b7d8ef3aa0bdf19e7901935066ffaa031a655b22f668f1ee5c12f1b1
- TLSH T14F610F808F522F751454CF59E07A82C3E733D006A7C67070189DBC9ABB8D7A63D3EAA4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\Cache_C717_B91F\ext\setup1.vbs
- Size 1KB
- SHA256 33633ef8abb63a5ed8bcd1cf78e90f80438bb0236afe59714bfff83d73410428
- MD5 0112c726a741f3351dcd1872ad6aa013
- SHA1 7f9f98f388abdc938fc0c2d162233b93c822b809
- SHA512 a2d1e96fe4f73772743e0f64d392515dccd124526fcd69c8607be71842bd95b8c184c58547c2f10f124ed1f9cdbb10466ecde7a2076b6d2ddd1f22630d9d1ac0
- TLSH T15431251B99644A07D4D2C65321F37C5C9F7A6A57000882B735A9DC9883D83639F5F237
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Documents\Cache_C717_B91F\pkg_CAA4.zip
- Size 33.0MB
- SHA256 d7d432e81d268f77446757bc2c0cc2d5828852c68274b75f6a7a879b2f8e179b
- MD5 1e923c07157ed359886fb9daa3a2380f
- SHA1 6840c12e81e88a99f3b2c7416f505fde41fea302
- SHA512 8a5c198648526acb5e6aff3b81a3c46cb4bdf9d457c84e524e9fc53d6f1159caa916bccb97597c7dcfd0955ad09a97d106360fcf3f89ec355d934b1878410060
- SSDEEP 786432:D37dCxbdhnfCJMGPk1Di4DNOCFzzt7P18AnX07UL3Ea7:jIxbXnfCJMAYDi4D0C5Z9nT3D7
- TLSH T1317733F1A442896BA9C1DCA0E7C5C184E28641E5CE743D77E16A53F3C2E7BC794E72A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8275.tmp
- Size 81KB
- SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
- MD5 e9b3f881f3855718fe6a4ed7855bae30
- SHA1 cf19171cc1b2186c5e046c0a3195ce47532b215a
- SHA512 50c04cc4ff234bb97192af5b437838f81e3930b1c2024dc13bd292ff85f6ddbaa670c7e2c2a1ca90d2c9e8de1b0ec4c1e7c2aa49ada80a0f4a42f9e461f41c26
- SSDEEP 1536:A+xCoJw5hZFi1QmA2uFQW9z/gkcWBxk40OExFyoxM:nJw51i1PburjM+xEOExFy9
- TLSH T102837C117350C872E49A693468A9C7326D397D625EF884C77FD907794FA03C1AE3932B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagenthttp.dll
- Size 3.6MB
- SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
- MD5 c943a1cdbcd28058068b921cc8daa04e
- SHA1 2694d3588167cc0f940a30a5f4b13793e0cf181e
- SHA512 d5bee6a3a43d4b04e41d177af022ff03ac8a2971f0cc79265e00d027294e56b1de289773e487dba60664a6c9ba3d9f2f26bdd5453cc9220cd8313adf1868fd24
- SSDEEP 49152:eGvD7zfSmnd1o2Mm0A1qga6zN/zuNscwOWbKikCDp9ZqljvLQTeDTtJb83ph9h7Q:1D7zqmnd1oT4XN/zuNsSikq6Lzbs9VQ
- TLSH T1D106BF11FF82C176FECE1176827A4F7E4D3A9744076649C767A43AB80E311E26A3E247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dclibxml2.dll
- Size 2.1MB
- SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
- MD5 67cc424838fda84bad295b4459107c8b
- SHA1 404f865e84e6338735a0c38617d73031195c520f
- SHA512 1a3232bed3826065416a50866d02827765c66104ed49c533324f0cb614745028411bda63784f4f8c3819f9a72e65016171179d80d484d10e52300eaffbd44397
- SSDEEP 49152:e9DUM26DYbVgzTtuKlKuuGaXKbj/BAUZLYM7:TMfQgRBBAUZLT
- TLSH T1F9A5AE15F981C176E5E6807486FEEBB6982ECD31232460E376A639D45E341E232BD34F
- MD5 SHA1 SHA512 SSDEEP TLSH