3d1a86ad729817d85377f59c3d5dcc67ba59af9824ae64aea8e626f6a4956d52

Analysis

max time kernel
149s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
facai.vbs
Size 1KB
Sample260827-pmjrtavanc
SHA256 3d1a86ad729817d85377f59c3d5dcc67ba59af9824ae64aea8e626f6a4956d52
MD5 4ee143d2618554b4d1e2852c433e46b1
SHA1 59002f85299ef75a7e781b0cf3161573a70dd8be
SHA512 b6ef5c25df25d0e35e8736e0c2f5a127e20563015cb992b6393fe9e967c9640efa3d17c4ca317758d3dcc777c9cb22760b1f04179668788a6afca782f10e6644
TLSH
T1F4313348E92FCD01C9758A7341076C4EC6B717552434006EBB6C8C7AAB2923ADF70562
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
1216	dcagentregister.exe
4436	7za.exe
2668	dcagentservice.exe
4328	dcstatusutil.exe
1060	dcinventory.exe
1328	dcagentservice.exe
4972	dcusbsummary.exe
4656	dcconfig.exe
2576	dcusb64.exe
3168	dcstatusutil.exe
5800	metroapps.exe
3180	dcondemand.exe
3192	dcswmeter.exe
5716	dcinventory.exe
1840	dcconfig.exe
2028	dcinventory.exe
712	DCProcessMonitor.exe
3148	dcondemand.exe
5816	7za.exe
3184	7za.exe
6100	7za.exe
3856	7za.exe
3616	7za.exe
3736	7za.exe
1868	7za.exe
2772	meaap.exe

Loads dropped DLL 50 IoCs

pid	Process
4488	MsiExec.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
2668	dcagentservice.exe
2668	dcagentservice.exe
4328	dcstatusutil.exe
4328	dcstatusutil.exe
4328	dcstatusutil.exe
1060	dcinventory.exe
1060	dcinventory.exe
1328	dcagentservice.exe
1328	dcagentservice.exe
1060	dcinventory.exe
4972	dcusbsummary.exe
4972	dcusbsummary.exe
4656	dcconfig.exe
4656	dcconfig.exe
4656	dcconfig.exe
3168	dcstatusutil.exe
3168	dcstatusutil.exe
5800	metroapps.exe
3168	dcstatusutil.exe
5800	metroapps.exe
5800	metroapps.exe
5800	metroapps.exe
5800	metroapps.exe
3180	dcondemand.exe
3180	dcondemand.exe
3192	dcswmeter.exe
3192	dcswmeter.exe
3180	dcondemand.exe
5716	dcinventory.exe
5716	dcinventory.exe
3180	dcondemand.exe
3180	dcondemand.exe
1840	dcconfig.exe
1840	dcconfig.exe
2028	dcinventory.exe
2028	dcinventory.exe
1840	dcconfig.exe
3148	dcondemand.exe
3148	dcondemand.exe
3148	dcondemand.exe
3148	dcondemand.exe
3148	dcondemand.exe
2772	meaap.exe
2772	meaap.exe
2772	meaap.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_097bbd709f0c4972\msmouse.PNF	dcinventory.exe
File created	C:\Windows\SysWOW64\dcagenthttp.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	dcagentregister.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	dcagentregister.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	dcagentregister.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_a1fe82a86eaecabd\keyboard.PNF	dcinventory.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_7a788f788529d024\usbport.PNF	dcinventory.exe
File created	C:\Windows\SysWOW64\dclibxml2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	dcagentregister.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	dcagentregister.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	dcagentregister.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_6f9a6940085bc1e9\input.PNF	dcinventory.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4644	wscript.exe
4308	WScript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\detected.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Updates_Active.svg	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcondemandrequest.log	dcondemand.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcswmeteraccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dccomponentregister.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentserviceaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log	dcondemand.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\messagebox_info.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcondemandaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\RemComm.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\hostondemandrequest.log	dcondemand.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\alert.swf	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\driverfiles.7z	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_agentservice.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml.gz	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\history.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\invite.swf	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dc_cad.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentslotrequest.log	dcstatusutil.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dc_icon.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dctoolshardware.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml3520.tmp	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\otp-lock-fail.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\me-sign.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe32.exe.config	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\InitCmd.bat	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\prevAtemptData.json	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\csr.pem	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz2952.tmp	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_agentservice.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log	dcstatusutil.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\remind_hover.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcchat.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\vccorlib110.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchresmodifiedaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_download_all.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\patch.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\ZChangeNotifier.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rapchat.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\sas.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\hostondemandaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml3520.tmp	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_rejected.svg	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_agentservice.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\SWScan.json	dcinventory.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DCAgentUpdater.job	dcagentregister.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI75F1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File created	C:\Windows\Installer\e59719d.mst	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAAEDB71BF0D1F046.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}	msiexec.exe
File opened for modification	C:\Windows\Tasks\DCAgentUpdater.job	dcagentregister.exe
File created	C:\Windows\Installer\e5971a4.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB7605F18E50381B4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59719c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59719d.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE1A9E8E1208A5D0F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A38.tmp	msiexec.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json	dcagentregister.exe
File opened for modification	C:\Windows\Installer\MSIF4D8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCE8D374EB6EC1321.TMP	msiexec.exe
File created	C:\Windows\Installer\e59719c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1568	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 7 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\424EC0DECFD35D06CAC424B7B4926B2040AE3013\Blob = 030000000100000014000000424ec0decfd35d06cac424b7b4926b2040ae3013200000000100000029040000308204253082030da00302010202085258b385439c03cb300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303730363231343735345a180f32313236303730363231343735345a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a028201010090dfba856bc15382fe45190726a0624c96f99c244b6364df4563eefaca9fb92d2df9eab996ab7e7b786e699558f56d78c2a1caf106f59d4215b51703abe53280a2c8d0c3f6dab163fe4abf15a7bb55ef58aa30502c91219853239869c9706d4545e2b6c12436b1d19d31ace1b674ccf5b00b27f687122ae004933e44d0f190c4673195962d4fecf7fbf90d6e91fb7b11ae1f28560aeca62af1e5c25ece04b5d6fde9fc86ca20fa57aa4b5e1e08be0701147d841c8f56cd6bb4c41091969a18991777be0381d381065849e5b4d53481276e8430b4d512dbd7cf88be128417de966a7b325c10a839f1a0261c0cb5411b605dc4f8b4e089a3e945be25668e7f00550203010001a35d305b300c0603551d13040530030101ff301d0603551d0e041604144ef9be3368392368fcb673f7ce565a97b5bc3098301f0603551d230418301680144ef9be3368392368fcb673f7ce565a97b5bc3098300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010035a259f6f196cd83267f9d57f02dd838b944a9b751dae680bcddeccaec4b4cddfb443c15220795b88a251d66b55cd2e83f1691f0977d77fc4947957ca40009ad2e1a8127c41fc72edbbc0b749c027c79ebb36e984df2d1879b1ef8b7b4b43b33aaf02b1d709e35d0dd76b689b4fb0771a4b78a1b4404e59c0d78f7ae2eaaeb7854eca97f19d5a31724e4323226d6c66117c77945f70742bd1ad496a1e46e457965768df4808e1075ad48b19a01bae7cb495d501821cdbca8a8d1c2770ea762ba554a841994c6b15d3a5a0d17c08a8fea4d3acdd33aac97e2e8fb89e22472fa94fea9f190d6f329d8cfd9d28f2a2a736b638b9e5d4a1e51496d31c3c0aa0c935f	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C9B454C835C061805660C4B50C29CB771199B510\Blob = 140000000100000014000000e4f99aae32846a87741b8f7bca827f2cbc6a4770030000000100000014000000c9b454c835c061805660c4b50c29cb771199b5100f0000000100000020000000b91d3f67fa8a49697d30830c90e1223eb8b1d7072c95c88bd5e00016b0d0142a2000000001000000af030000308203ab30820293a003020102020815f24d2524b9af10300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303730363231343534315a180f32313236303730363231343534315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a674501b436fa66be4f8eb49fda650f9706c400dbf1a9453fd28573c0f4431cf95993923fe827049efc64a6aa8aefaa3c3ed44f710b50334cd297c92176af9c276bc1dddab62d147ca865b08b4ef72fd03b9c99aaac19c61a6fb8d611ca4aadf2733331f4d28c022a4df3d20c988b5e851ccda23949ea8afdc064ae69938b5c5753eef50f69bf2d9267316e094929934f7efdb51fc49704f0006153a06f10982390cb2045b23037b69cad46c6105e88bbe41617dcd575499494ef76dea0771b89006c5b667aba9db0dba6215c7fb3600fe7ed0414191a8e5ed3ae9781217bb84355599aa66065207ffb32a92834944aebe21b7bbd540d0ce84e64438f7a5fcdd0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e4f99aae32846a87741b8f7bca827f2cbc6a4770301f0603551d23041830168014e4f99aae32846a87741b8f7bca827f2cbc6a4770300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010068365d6937f207b044aec454f22bc5d638747d3afd7cadce2bb371efa97554a96b7e4ba8810aa253232063aa88884ec0ee64b07a8e8fe0131248fcaf102c897c34ce0281b8977092484acf69056830824dfe67e4dcf68a9ff83daf26711f3ac60972ca1ccd19f2f8751f8ec573a033b445ec870ed28e1748c00564bdf2836deab2bcb392a288d7c9bc9189c7056a19790964175da5ec8c4fd228df8c2aac472db465c8e318554f75a1309b0eb376436cbadf629d38950229376c0d54d56b3fd4d1fa64e76cca44ff7d9840fda756b4df2778bbb8a35747424b6edc5ee7c0e7aa3f7270d2f413fc940434ca8c287f74c0d4a34e77e4c0a5aa1a8e6c1a8ef61441	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C9B454C835C061805660C4B50C29CB771199B510\Blob = 6b0000000100000020000000fdcddaf362841f78743901f213365a5aadbcfd694208879cad61056939ccc42b0f0000000100000020000000b91d3f67fa8a49697d30830c90e1223eb8b1d7072c95c88bd5e00016b0d0142a030000000100000014000000c9b454c835c061805660c4b50c29cb771199b510140000000100000014000000e4f99aae32846a87741b8f7bca827f2cbc6a47702000000001000000af030000308203ab30820293a003020102020815f24d2524b9af10300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303730363231343534315a180f32313236303730363231343534315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a674501b436fa66be4f8eb49fda650f9706c400dbf1a9453fd28573c0f4431cf95993923fe827049efc64a6aa8aefaa3c3ed44f710b50334cd297c92176af9c276bc1dddab62d147ca865b08b4ef72fd03b9c99aaac19c61a6fb8d611ca4aadf2733331f4d28c022a4df3d20c988b5e851ccda23949ea8afdc064ae69938b5c5753eef50f69bf2d9267316e094929934f7efdb51fc49704f0006153a06f10982390cb2045b23037b69cad46c6105e88bbe41617dcd575499494ef76dea0771b89006c5b667aba9db0dba6215c7fb3600fe7ed0414191a8e5ed3ae9781217bb84355599aa66065207ffb32a92834944aebe21b7bbd540d0ce84e64438f7a5fcdd0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e4f99aae32846a87741b8f7bca827f2cbc6a4770301f0603551d23041830168014e4f99aae32846a87741b8f7bca827f2cbc6a4770300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010068365d6937f207b044aec454f22bc5d638747d3afd7cadce2bb371efa97554a96b7e4ba8810aa253232063aa88884ec0ee64b07a8e8fe0131248fcaf102c897c34ce0281b8977092484acf69056830824dfe67e4dcf68a9ff83daf26711f3ac60972ca1ccd19f2f8751f8ec573a033b445ec870ed28e1748c00564bdf2836deab2bcb392a288d7c9bc9189c7056a19790964175da5ec8c4fd228df8c2aac472db465c8e318554f75a1309b0eb376436cbadf629d38950229376c0d54d56b3fd4d1fa64e76cca44ff7d9840fda756b4df2778bbb8a35747424b6edc5ee7c0e7aa3f7270d2f413fc940434ca8c287f74c0d4a34e77e4c0a5aa1a8e6c1a8ef61441	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C9B454C835C061805660C4B50C29CB771199B510\Blob = 190000000100000010000000c8ef8ae5936ffa6aa8b1bd9696da5c78140000000100000014000000e4f99aae32846a87741b8f7bca827f2cbc6a4770030000000100000014000000c9b454c835c061805660c4b50c29cb771199b5100f0000000100000020000000b91d3f67fa8a49697d30830c90e1223eb8b1d7072c95c88bd5e00016b0d0142a6b0000000100000020000000fdcddaf362841f78743901f213365a5aadbcfd694208879cad61056939ccc42b2000000001000000af030000308203ab30820293a003020102020815f24d2524b9af10300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303730363231343534315a180f32313236303730363231343534315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a674501b436fa66be4f8eb49fda650f9706c400dbf1a9453fd28573c0f4431cf95993923fe827049efc64a6aa8aefaa3c3ed44f710b50334cd297c92176af9c276bc1dddab62d147ca865b08b4ef72fd03b9c99aaac19c61a6fb8d611ca4aadf2733331f4d28c022a4df3d20c988b5e851ccda23949ea8afdc064ae69938b5c5753eef50f69bf2d9267316e094929934f7efdb51fc49704f0006153a06f10982390cb2045b23037b69cad46c6105e88bbe41617dcd575499494ef76dea0771b89006c5b667aba9db0dba6215c7fb3600fe7ed0414191a8e5ed3ae9781217bb84355599aa66065207ffb32a92834944aebe21b7bbd540d0ce84e64438f7a5fcdd0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e4f99aae32846a87741b8f7bca827f2cbc6a4770301f0603551d23041830168014e4f99aae32846a87741b8f7bca827f2cbc6a4770300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010068365d6937f207b044aec454f22bc5d638747d3afd7cadce2bb371efa97554a96b7e4ba8810aa253232063aa88884ec0ee64b07a8e8fe0131248fcaf102c897c34ce0281b8977092484acf69056830824dfe67e4dcf68a9ff83daf26711f3ac60972ca1ccd19f2f8751f8ec573a033b445ec870ed28e1748c00564bdf2836deab2bcb392a288d7c9bc9189c7056a19790964175da5ec8c4fd228df8c2aac472db465c8e318554f75a1309b0eb376436cbadf629d38950229376c0d54d56b3fd4d1fa64e76cca44ff7d9840fda756b4df2778bbb8a35747424b6edc5ee7c0e7aa3f7270d2f413fc940434ca8c287f74c0d4a34e77e4c0a5aa1a8e6c1a8ef61441	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C9B454C835C061805660C4B50C29CB771199B510\Blob = 5c0000000100000004000000000800006b0000000100000020000000fdcddaf362841f78743901f213365a5aadbcfd694208879cad61056939ccc42b0f0000000100000020000000b91d3f67fa8a49697d30830c90e1223eb8b1d7072c95c88bd5e00016b0d0142a030000000100000014000000c9b454c835c061805660c4b50c29cb771199b510140000000100000014000000e4f99aae32846a87741b8f7bca827f2cbc6a4770190000000100000010000000c8ef8ae5936ffa6aa8b1bd9696da5c782000000001000000af030000308203ab30820293a003020102020815f24d2524b9af10300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303730363231343534315a180f32313236303730363231343534315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a674501b436fa66be4f8eb49fda650f9706c400dbf1a9453fd28573c0f4431cf95993923fe827049efc64a6aa8aefaa3c3ed44f710b50334cd297c92176af9c276bc1dddab62d147ca865b08b4ef72fd03b9c99aaac19c61a6fb8d611ca4aadf2733331f4d28c022a4df3d20c988b5e851ccda23949ea8afdc064ae69938b5c5753eef50f69bf2d9267316e094929934f7efdb51fc49704f0006153a06f10982390cb2045b23037b69cad46c6105e88bbe41617dcd575499494ef76dea0771b89006c5b667aba9db0dba6215c7fb3600fe7ed0414191a8e5ed3ae9781217bb84355599aa66065207ffb32a92834944aebe21b7bbd540d0ce84e64438f7a5fcdd0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e4f99aae32846a87741b8f7bca827f2cbc6a4770301f0603551d23041830168014e4f99aae32846a87741b8f7bca827f2cbc6a4770300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010068365d6937f207b044aec454f22bc5d638747d3afd7cadce2bb371efa97554a96b7e4ba8810aa253232063aa88884ec0ee64b07a8e8fe0131248fcaf102c897c34ce0281b8977092484acf69056830824dfe67e4dcf68a9ff83daf26711f3ac60972ca1ccd19f2f8751f8ec573a033b445ec870ed28e1748c00564bdf2836deab2bcb392a288d7c9bc9189c7056a19790964175da5ec8c4fd228df8c2aac472db465c8e318554f75a1309b0eb376436cbadf629d38950229376c0d54d56b3fd4d1fa64e76cca44ff7d9840fda756b4df2778bbb8a35747424b6edc5ee7c0e7aa3f7270d2f413fc940434ca8c287f74c0d4a34e77e4c0a5aa1a8e6c1a8ef61441	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\424EC0DECFD35D06CAC424B7B4926B2040AE3013\Blob = 19000000010000001000000014966a90fc3f64e04a60b41ab74d0a60030000000100000014000000424ec0decfd35d06cac424b7b4926b2040ae30130f00000001000000200000007dd6a126b8e0e4185eec3f74b7582da08d1dff42433f268954619cf8618a422c200000000100000029040000308204253082030da00302010202085258b385439c03cb300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303730363231343735345a180f32313236303730363231343735345a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a028201010090dfba856bc15382fe45190726a0624c96f99c244b6364df4563eefaca9fb92d2df9eab996ab7e7b786e699558f56d78c2a1caf106f59d4215b51703abe53280a2c8d0c3f6dab163fe4abf15a7bb55ef58aa30502c91219853239869c9706d4545e2b6c12436b1d19d31ace1b674ccf5b00b27f687122ae004933e44d0f190c4673195962d4fecf7fbf90d6e91fb7b11ae1f28560aeca62af1e5c25ece04b5d6fde9fc86ca20fa57aa4b5e1e08be0701147d841c8f56cd6bb4c41091969a18991777be0381d381065849e5b4d53481276e8430b4d512dbd7cf88be128417de966a7b325c10a839f1a0261c0cb5411b605dc4f8b4e089a3e945be25668e7f00550203010001a35d305b300c0603551d13040530030101ff301d0603551d0e041604144ef9be3368392368fcb673f7ce565a97b5bc3098301f0603551d230418301680144ef9be3368392368fcb673f7ce565a97b5bc3098300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010035a259f6f196cd83267f9d57f02dd838b944a9b751dae680bcddeccaec4b4cddfb443c15220795b88a251d66b55cd2e83f1691f0977d77fc4947957ca40009ad2e1a8127c41fc72edbbc0b749c027c79ebb36e984df2d1879b1ef8b7b4b43b33aaf02b1d709e35d0dd76b689b4fb0771a4b78a1b4404e59c0d78f7ae2eaaeb7854eca97f19d5a31724e4323226d6c66117c77945f70742bd1ad496a1e46e457965768df4808e1075ad48b19a01bae7cb495d501821cdbca8a8d1c2770ea762ba554a841994c6b15d3a5a0d17c08a8fea4d3acdd33aac97e2e8fb89e22472fa94fea9f190d6f329d8cfd9d28f2a2a736b638b9e5d4a1e51496d31c3c0aa0c935f	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C9B454C835C061805660C4B50C29CB771199B510\Blob = 030000000100000014000000c9b454c835c061805660c4b50c29cb771199b5102000000001000000af030000308203ab30820293a003020102020815f24d2524b9af10300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303730363231343534315a180f32313236303730363231343534315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a674501b436fa66be4f8eb49fda650f9706c400dbf1a9453fd28573c0f4431cf95993923fe827049efc64a6aa8aefaa3c3ed44f710b50334cd297c92176af9c276bc1dddab62d147ca865b08b4ef72fd03b9c99aaac19c61a6fb8d611ca4aadf2733331f4d28c022a4df3d20c988b5e851ccda23949ea8afdc064ae69938b5c5753eef50f69bf2d9267316e094929934f7efdb51fc49704f0006153a06f10982390cb2045b23037b69cad46c6105e88bbe41617dcd575499494ef76dea0771b89006c5b667aba9db0dba6215c7fb3600fe7ed0414191a8e5ed3ae9781217bb84355599aa66065207ffb32a92834944aebe21b7bbd540d0ce84e64438f7a5fcdd0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e4f99aae32846a87741b8f7bca827f2cbc6a4770301f0603551d23041830168014e4f99aae32846a87741b8f7bca827f2cbc6a4770300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010068365d6937f207b044aec454f22bc5d638747d3afd7cadce2bb371efa97554a96b7e4ba8810aa253232063aa88884ec0ee64b07a8e8fe0131248fcaf102c897c34ce0281b8977092484acf69056830824dfe67e4dcf68a9ff83daf26711f3ac60972ca1ccd19f2f8751f8ec573a033b445ec870ed28e1748c00564bdf2836deab2bcb392a288d7c9bc9189c7056a19790964175da5ec8c4fd228df8c2aac472db465c8e318554f75a1309b0eb376436cbadf629d38950229376c0d54d56b3fd4d1fa64e76cca44ff7d9840fda756b4df2778bbb8a35747424b6edc5ee7c0e7aa3f7270d2f413fc940434ca8c287f74c0d4a34e77e4c0a5aa1a8e6c1a8ef61441	dcagentregister.exe

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcswmeter.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCProcessMonitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	metroapps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcondemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	meaap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcondemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	dcusb64.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5988	systeminfo.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	metroapps.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcinventory.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings	metroapps.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcondemand.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe%5Cresources.pri	metroapps.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "44C40189C3AA44442AA780ED114A0026"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "167772210"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000	msiexec.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\424EC0DECFD35D06CAC424B7B4926B2040AE3013	dcagentregister.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C9B454C835C061805660C4B50C29CB771199B510	dcagentregister.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe
1216	dcagentregister.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4176	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4176	msiexec.exe
Token: SeSecurityPrivilege	4152	msiexec.exe
Token: SeCreateTokenPrivilege	4176	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4176	msiexec.exe
Token: SeLockMemoryPrivilege	4176	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4176	msiexec.exe
Token: SeMachineAccountPrivilege	4176	msiexec.exe
Token: SeTcbPrivilege	4176	msiexec.exe
Token: SeSecurityPrivilege	4176	msiexec.exe
Token: SeTakeOwnershipPrivilege	4176	msiexec.exe
Token: SeLoadDriverPrivilege	4176	msiexec.exe
Token: SeSystemProfilePrivilege	4176	msiexec.exe
Token: SeSystemtimePrivilege	4176	msiexec.exe
Token: SeProfSingleProcessPrivilege	4176	msiexec.exe
Token: SeIncBasePriorityPrivilege	4176	msiexec.exe
Token: SeCreatePagefilePrivilege	4176	msiexec.exe
Token: SeCreatePermanentPrivilege	4176	msiexec.exe
Token: SeBackupPrivilege	4176	msiexec.exe
Token: SeRestorePrivilege	4176	msiexec.exe
Token: SeShutdownPrivilege	4176	msiexec.exe
Token: SeDebugPrivilege	4176	msiexec.exe
Token: SeAuditPrivilege	4176	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4176	msiexec.exe
Token: SeChangeNotifyPrivilege	4176	msiexec.exe
Token: SeRemoteShutdownPrivilege	4176	msiexec.exe
Token: SeUndockPrivilege	4176	msiexec.exe
Token: SeSyncAgentPrivilege	4176	msiexec.exe
Token: SeEnableDelegationPrivilege	4176	msiexec.exe
Token: SeManageVolumePrivilege	4176	msiexec.exe
Token: SeImpersonatePrivilege	4176	msiexec.exe
Token: SeCreateGlobalPrivilege	4176	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4436	7za.exe
Token: 35	4436	7za.exe
Token: SeSecurityPrivilege	4436	7za.exe
Token: SeSecurityPrivilege	4436	7za.exe
Token: SeDebugPrivilege	4972	dcusbsummary.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe
Token: SeTakeOwnershipPrivilege	4152	msiexec.exe
Token: SeRestorePrivilege	4152	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4176	msiexec.exe
4152	msiexec.exe
4488	MsiExec.exe
4972	dcusbsummary.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 4644	4308	WScript.exe	89
PID 4644 wrote to memory of 4176	4644	wscript.exe	90
PID 4152 wrote to memory of 4488	4152	msiexec.exe	92
PID 4152 wrote to memory of 1216	4152	msiexec.exe	93
PID 1216 wrote to memory of 4436	1216	dcagentregister.exe	95
PID 1216 wrote to memory of 1568	1216	dcagentregister.exe	100
PID 1568 wrote to memory of 5988	1568	cmd.exe	102
PID 1216 wrote to memory of 4328	1216	dcagentregister.exe	104
PID 1216 wrote to memory of 1060	1216	dcagentregister.exe	107
PID 1328 wrote to memory of 4972	1328	dcagentservice.exe	110
PID 1328 wrote to memory of 4656	1328	dcagentservice.exe	111
PID 4972 wrote to memory of 2576	4972	dcusbsummary.exe	113
PID 1328 wrote to memory of 3168	1328	dcagentservice.exe	115
PID 1060 wrote to memory of 5800	1060	dcinventory.exe	117
PID 1328 wrote to memory of 3180	1328	dcagentservice.exe	118
PID 1328 wrote to memory of 3192	1328	dcagentservice.exe	120
PID 1328 wrote to memory of 5716	1328	dcagentservice.exe	122
PID 1328 wrote to memory of 1840	1328	dcagentservice.exe	124
PID 1840 wrote to memory of 2028	1840	dcconfig.exe	126
PID 1328 wrote to memory of 712	1328	dcagentservice.exe	129
PID 1328 wrote to memory of 3148	1328	dcagentservice.exe	135
PID 1840 wrote to memory of 5816	1840	dcconfig.exe	137
PID 1840 wrote to memory of 3184	1840	dcconfig.exe	139
PID 1840 wrote to memory of 6100	1840	dcconfig.exe	141
PID 1840 wrote to memory of 3856	1840	dcconfig.exe	143
PID 1840 wrote to memory of 3616	1840	dcconfig.exe	145
PID 1840 wrote to memory of 3736	1840	dcconfig.exe	147
PID 1840 wrote to memory of 1868	1840	dcconfig.exe	149
PID 1840 wrote to memory of 2772	1840	dcconfig.exe	151

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\facai.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\facai.vbs" /elevated
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4176

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A2ED5D57DB7663AA89D045BC2168C7C6
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4488
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo.exe
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:5988
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:4328
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
    bin\dcinventory.exe -i postinstallation 0 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exe
      metroapps.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      PID:5800

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2668

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:2576
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  7 0 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:4656
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
  bin\dcstatusutil.exe RequestAgentSlotFromServer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3168
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3180
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3192
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5716
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  3 0 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
    bin\dcinventory.exe -p processor compatibility
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2028
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5816
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3184
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6100
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3856
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3616
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3736
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1868
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2772
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe
  DCProcessMonitor.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:712
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3148

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5971a0.rbs

Path C:\Config.Msi\e5971a0.rbs
Size 58KB
SHA256 2763b5f7c02849529daac869619a4b9dd15e90bed9b90c4c588d334325aab0d4
MD5 6e07b6a09ca24b596786d13f7976637d
SHA1 c72902e354da8e877792e01c0051fd4d78372614
SHA512 6cc296125a7cdbb07470762f208a658e05d0c652af85cbb01feade204ac8c79b85e8ba23e53fcb2067739a47a809caaa07147f93790db4901766d2bf581996ef
SSDEEP 768:hPOamH6jx6gZiypDO+uTcKaJ5hQbGJNcaiaKhiOVbm:pBsCx6xeDO+MaEWcNpi2bm
TLSH
T1FE436266DB26E2CBD1151AF733826D1806094C7B66F0C43E1318AD3BD4DBA457EBF868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5971a5.rbs

Path C:\Config.Msi\e5971a5.rbs
Size 546B
SHA256 30665b6ded893d3947e6c0fce9e3198b6a30218013a0ba4f8aed82e6ec9c8a71
MD5 a436d2805ff31a15af7fb32abf5ee359
SHA1 56db1e5ad1d71acde5c4e653aa84708d761bcdc1
SHA512 452b78a8d2a8c793b5d1650b2849729076f84c50a32ec8b777c9da10ae8004712f923a9b1e8694f2b6ef6b23e306adb139659bb0b4ba4d1dd44c4ae65fda2a18
TLSH
T19DF09E93A70846E3D6A06E3723435F06193BE539E15483752D882734AD1620A1EFB0CC
MD5 SHA1 SHA512 TLSH

Submit Download

client.p12

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
Size 1002B
SHA256 6817160ba88661fd543e08d90095c0df6b8a622e20e1a217506016a400e5eaee
MD5 42ada24582ca417d69f02ff12644451b
SHA1 00b63aeb934f115cad92e3ceccf5815086f767e7
SHA512 ee93109aef551d186d771d440a23edba7bb36c228150621d64e2169362188bd1dac301549c216d3898941a4b4393f1ff05dfa293c66fe3673ec8e6b734ebbd33
TLSH
T12611A5AAF83C58467DF9DC80F2E9058EAC81E384BE5C300F1B159ED10EE59D8321A9D0
MD5 SHA1 SHA512 TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
Size 802KB
SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
MD5 8f57948e69c82bf98704f129c5460576
SHA1 33e277af0cea397252c23d310961f803be5cdf2b
SHA512 628cf68c9436721b874a87e1bff711d3b6fe5d4bd9b02411890059a7d32078a9592fc48e6e53761d17bdbd72c5eb66593b841470157a3e8b38f0b67525d73bc9
SSDEEP 24576:L48I9t/zu2QSM0TMzOCkY+we/86W5gXKxZ5:Le71MzuiehWIKxZ
TLSH
T1C9059E22BAE5D07BD2421132CA1C7BF591F9976D0B2048C763808F6D7B359D1DA3AE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAuthHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
Size 2.3MB
SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
MD5 2843aac7409fc7e54722c6238342f660
SHA1 3e40879eacf10473127386816c24e0cf245410f6
SHA512 f8a6e689f3b0c6761aa84f29d717d192fc0b34767a06d551a3937827a95f0cf740baada2a151b4ef6138a0fa626a93c94d45e34c235de63e265cebf32c9e70c2
SSDEEP 49152:8P5i/uH8WK6WK0Lh8tRjd4b39T9+LoSaEYLUzSPrBsFwZkmTbk8iE8phYhlJFxI:8P5i/uH8WK6WK0WtRU9TAodE0UzirBsH
TLSH
T17CB5BF23EA808032E4CE053692FD5BB65D3E9A10132CA9D3ABD53DB45E755E2663C34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Bold.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
Size 250KB
SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
MD5 a2fb219c999a8fa6b95ad7c24890072e
SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
TLSH
T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Medium.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
Size 245KB
SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
MD5 cecc32d267ee07ce3413637314b66ca0
SHA1 627b584f88033791f427091fff74c9310bdc2ef1
SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
TLSH
T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_binaries.7z

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
Size 14.6MB
SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
MD5 b26cb94e52dd0688c3a77b46e883f084
SHA1 27692088d8f3d321a6f9afb39395f6109f0469e9
SHA512 9823343c9c341b3a9c07ad9b3c89ec9c2efc8ea31f3937cfccd3c03724494ebddcd83a53a383087d2cc8e4aedff1e64aa7bcd76fc7d6a28fec4c6309bbd19311
SSDEEP 393216:FT+EJ+ygjrEhL2oJ/3u6xC/9HI7T3ebuRgzPNK:FT+U+nQhL2oJ/jI/WXeiKk
TLSH
T15FF633E9B4828A4BC5C889B0C64681C4E1CE41B5DC9A6CB6D5B167BFD3DA8C714DB3F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca-certs.zip

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
Size 160B
SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
MD5 7fe1c49c6da9570331515a2d300642e3
SHA1 13c824b889876a1ae1e94faeed430185329df502
SHA512 9de0c421861be17aa0e32ee5a3b603be946f075bb7178e7ee40d8b8639bedd3761e88114dfddc4aa0ab5ae20d6adfae5535b7205b8fa3674e6e8aaad27a0fb7a
TLSH
T1A0C0122AC1CA24F0EF077FB6B05613A34D0CC1FB020386570C4690401F81EAD8D2C406
MD5 SHA1 SHA512 TLSH

Submit Download

cfgUpdate.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
Size 62KB
SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
MD5 8e3d3fe805da01bc5abb251f2fb58705
SHA1 8adc16a8e417cfe1130c3b3e40495ea977374fdf
SHA512 8e742dc4122c3971f3a0175f648647ba0630fb87d0c1a415c5cd38178643a07a0e2e9ca5e360b3e1de530dba5ba323aa963de9daf204bb0ab19afaa38372311a
SSDEEP 768:KuhPgdGgqsgO0JRCXwvtLqhjgiWmZhSX0P+4EDsXnqmpif52TZaZTAMxkEYg:KuhP+dgv0AvUjymZhSEPF4k4xH
TLSH
T167537B27B390C432D462197458A9C2725E7B79620BF8D6C77788037E4FB13D0AEB935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cold_normal_msghldr.gif

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
Size 536B
SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
MD5 60f77c64f9c8a86fd24c8e64c20e009e
SHA1 e9299102aa662027b9e46246a5847074444ec1fd
SHA512 972afa85faba00ad96efad4951ec92ed90e60175dd80a388328c708975df2871655d8ae31ea750d60298ab1514c1a4b53b3b0304d5ace6118b4fea320c075f33
TLSH
T12BF075C0B546067A64170F3544351D4502476D06A57CA33ACC50FCDCD67E220B0229A7
MD5 SHA1 SHA512 TLSH

Submit Download

dcagentregister.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
Size 92KB
SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
MD5 2978f0ceba230877a2476d3d99739518
SHA1 a16ae5aa1bb6017d2732ee5cced1ede9b091816e
SHA512 5e8ccd699315e23ccc94b4541d568815f88ffc5736c39bdc29d4dc9c3dce3e8ee1b9c70e9f28d980b5433f5bc10d49658b13dc2e8947a415e45d1e4153001cc5
SSDEEP 1536:APLaK7cLtLWedH8rwkrsofXR1BjDrl7E2zzi0FNLGpxLzH:T66trH4wW3RE2zzieLGDT
TLSH
T1ED938E227690C032E456597468ACCA725E7FBD215BB8C4C77788477B1FA03C0AF7A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
Size 1.2MB
SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
MD5 9c1ac952bdfee44fed1ecf7165808e12
SHA1 8fee062be189b641b0ffcbbb7287697b9be16cae
SHA512 bb9720f816a1833769d083079a75913c7aef9a103c3edca122ff151acd94cfb586b3b8303720d305807f72f28c6370bf80d478c5a0e6beb734384a89e344685b
SSDEEP 24576:QSTpNU+Po5KeKA66v9cskz0LIU6iUKLO7N7EqyyF6FmR0OqZC0uNZtSTHytb0Dk:Q2F1ec5zu9LOx7yyF6FmR0OqTi+TStgw
TLSH
T13B559E22D7428031E7E200B7C57A86BAA938AB75131190E3E3D45DE85AEC5D17E3F25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcinventory.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
Size 2.0MB
SHA256 8e35a7064793a56a8d6f1e08050fa588571c8898f5bcea4f78228cf343ce5016
MD5 5956882d71ddb032bc14ce667b700d9e
SHA1 74224f6a2948baeab354e2e2a7e687ab6a65877d
SHA512 f7230ec387f95ab5aff516771b11ca00475adf460a293308a4dd9206a1ef2fc4a462c647ad8a4b0696209b7ed19e303c84667ff85bb2b4a06f4d4e90c15d5f6d
SSDEEP 49152:oc41Ly9rwBXp10lrzBSnwX0cLP65eP8Txvkd/TgVI3cYKNpe:ey96iSnwXpLP65Lvkdnco
TLSH
T137A57D11A742C437E5B304F6C97D86BE5438B930172490C3B3C42DAD9BF99D27A36A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcstatusutil.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
Size 1.1MB
SHA256 b24ad0ae12c05931f11b66f26166c7ec41a7be318893aebe4cc2babe29bdb080
MD5 34bfd8a2cafc17cc6d77731137647ee3
SHA1 f759d53de2db6984ecc7604d0d655cb9324c71ab
SHA512 26772bdc4d88ba6ea664d47c5f1d96fe1b3c08cebf852c77c2a0513459f763edf17300e341f4e764da647649177e4812fc926dda15c640b91ccfd6d0f847ac34
SSDEEP 24576:yq6MTUXbn7CW4nVG2w30/JssVTlFLsWOq63IfHNpFw0wOzfTkqZgfVV:sn3/8FLsWOq63IfHX6NKTHZsV
TLSH
T1E135AF21EB024031E1E200B7C6B9D6BA7938A771271590D3E3C05DE96BA89D1BD3E75F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcusbsummary.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
Size 2.8MB
SHA256 4f8c591982de67c9211011e4a4a9560b93eabd6c08f2856d7638cc4c802a3b64
MD5 0187aacdbf886b531e61c5cd734a4b8d
SHA1 ce576911215f034eb889692b9614d80c04b216db
SHA512 60b48cd7ae6aa5a46b8e509f1181a44136f198fc6235d1531cdf8ef4e0555687fb227295776cb59bf5bc5aa62f022a5c22a06282782f61c47378bc45e7579b9d
SSDEEP 49152:ESkZ33X/kMdw4a0z6GbB7lyONDHSvlCi37AxvP7qm9cVKeKiIAXQSve4RSfoR2/5:EFZ33X/kvBGFlyO9Ski37AxvP7qm9cVm
TLSH
T177D5AE21BB41E036D2A32172855AA3B9A27DA630173591C7E2D05E7C2F745E2B93C73F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hot_mover_msghldr.gif

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
Size 172B
SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
MD5 c8a811d36876948a70fe7509b7f49925
SHA1 48541ac236da4f143154a8f71fb7fb3f3110bb38
SHA512 6bba69fa213b495a9faf4ea917788c43d888b3d96606db1644d7f8c456fb089f01d3e2582016a5043a49182ebd9767a2169aab94de05868ab0efeff5825c7578
TLSH
T115C0801594D652DB7498C735951537213919947F996DD12D404431F134785A0511FD64
MD5 SHA1 SHA512 TLSH

Submit Download

resources.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
Size 318KB
SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
MD5 4373ce1e6f57dc9df7a8ada69479d8ba
SHA1 f19deb28a0af966ad8c03db23cd21f75dfedda08
SHA512 e1c1cd77650e72652528b005da981a8ee3b28c995c41875a872202d0a00c75c612050f74b626dbf42f9e5412624860d182b7b6c98dde4df7c09a7f735834dd41
SSDEEP 6144:QnqKQ2Oq3ScuA05A+O4PlDfZIkbaRF30zG26Wdi9vhEsSCyAekfX6xgrNQi:mqhq3M5A+XfhaD3lV5SCyAe+XmCJ
TLSH
T19264CF2137E5C47BC692253089DC6BF970FAA7490F2448C723C49F2E5E35AE6D239729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

topmiddle.bmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
Size 1016B
SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
MD5 368947d319ac4823f5d542c8f723fb0c
SHA1 7d419d7c8b15f9abefc936f526e68ae2c535292f
SHA512 ed51660075cfeb5a3826231a0f0e2b1b165d0dc808cc5c1f309885dfa7903c914b76bebbb183ef38d67a789adf43b0e6e5223cfccfc362d50ab05b1becb15a60
TLSH
T188119AF0A1F0DCBAE7571660799EB42055D66AC03249424D340BF6286EB7715748CFA9
MD5 SHA1 SHA512 TLSH

Submit Download

ui-icons_444444_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
Size 6KB
SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
MD5 d10bc07005bb2d604f4905183690ac04
SHA1 69011104e870704cf45910d74bed5938f9062891
SHA512 c8df6ec5eb5684348613af6e8bc2e8d5759ff9912e9d36df42c09960739b0922c2830b56059ec0a95fc2ed7aa83fb3fe5a8673402544c4bd00daab457b9b97ab
SSDEEP 192:JfC8S1p4JW0bYmezNui5WP1UMIUN93GUO4:JK8AvOYmW1+BIg93P
TLSH
T102E19E87A4C2459E8EAA5CFF1D8E522DC17B8E1A9A1B50C52552D2C1071DFF8D483FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_555555_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
Size 6KB
SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
MD5 00dd0ec0a16a1085e714c7906ff8fb06
SHA1 244bd9b7c3b1c4f7ef72de31f67804faff213715
SHA512 163afece9ae9693c41324ffd89191132a8d2e42d73f962ace0b70b44a17d954c8f506cc25af152397e2536da6245e4336ae465708edf6ede955b4ad502af7a71
SSDEEP 96:gMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6KaP:zXTvYXQzy51nfmcuXibSralG/aP
TLSH
T166E18DE534F0C16898A14C3253536644D16EB3C3A8F7AD02C1B0AABAA465F3872FF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_777620_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
Size 4KB
SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
MD5 4e7e3e142f3939883cd0a7e00cabdaef
SHA1 d20567fd436991539eafd65c3bde77d82a656012
SHA512 d145a64f637f34d9f9fefaf7cef14ea277d0933e16c625234a9c1e0a54a7f3d0d820ab49b4b68d5d3e9853399d74efba9ff7771bfd3481f8c1c70e6dc6f50275
SSDEEP 96:7sHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:oHm231Nvu+wIqltWOe3nIH
TLSH
T1A7A13DE27BE7DCF495E62277BF9D5491E1542A41207047B4C4C4D11C695C99B1361E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_777777_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
Size 6KB
SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
MD5 40bf25799e4fec8079c7775083de09df
SHA1 4fc6b1449c73f5d10489c104225ebe326a4016ba
SHA512 51c9e46224098e9270bf51bec93e0528b5e726a632a1de57863fba531d914a9db1d3fb07d22cef756f6fc9e999bf08043e73bca6225a9ab7efffe2904105c388
SSDEEP 192:92XiIsTugcTnouLuIXdj7Z7rgmlWRI1ie+BVtNzDby:AmOTnwCnZftW61ie+BV3Xby
TLSH
T15DE19FC1E5F8C4E0DD58E668EE886209C7A658B9064742DBCF0485694B48D3186FAB8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_cc0000_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
Size 4KB
SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
MD5 093a819138276b446611d1d2a45b98a2
SHA1 1c7fc1ab71ed0d9fa051f07c7e8f43467121ebf7
SHA512 c886fae282a185b69a2cdd8593cc4c4e7ee463bc010bf59544058bb294cb0bc2ecc008a9dbdc6c7cd0e45bbb80bb9cdd5b7520c4a88779eb8ff2df56128d7b8d
SSDEEP 96:gHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:gHm231Nvu+wIqltWOe3nIH
TLSH
T187A17DE17B6BC4E4EBE7233FBFD95460A1542A01206073F480C0D1ECA98D9A71361E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_ffffff_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
Size 6KB
SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
MD5 ea4ebe072be75fbbea002631916836de
SHA1 1769aa84191332e981245146067080ee4faa592a
SHA512 85990dc5c32560e10cf380d0e10707a4d995ff58b35cc81bb0ebca5afec15c1ddd6cb0de8e7fb392f2384f2a7ef9482f2b1e47924556e983b9c5ff1a79c1e7de
SSDEEP 96:DcH4W00cRUjbz7dqG+sLo/Hh+U5cVH/lT3jmk/8fY44WtYHM4tNtldMJU/gl:oYW0YhqG+sLoPT+XjNQYbZNtfMJb
TLSH
T1B3D19E81D6CEA64BCB01DCC97EC73BD82588436B5A1A94EA15D2B0C8B52FA8CC50583F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources.properties

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties
Size 98KB
SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
MD5 c340fdd54a3956f567a1b3b5bf0ad58e
SHA1 3c620fd4efda92ddcb42fedd600d4ceb1d940a97
SHA512 d5e3171d3b11bb56fcf35de8ad596fb37008f21d9e8dfa18444c1460490fdffde3149981ab7fa45a144ce1daa28a5c588230b58fc802ccd30568dc2383b38f3a
SSDEEP 3072:UyfCAIeTx7UYwyKlWF/VPKWl+DE09phQl1mWSDj8kS:VfCAIMBUYwyKlAVPKc+LDj8kS
TLSH
T16AA3735AD1766F7E33C6132BF4392BD176B20D648741A9E87988E8F4D63C84121BB4B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
Size 15KB
SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
MD5 783b02208909201added3870096ecb7e
SHA1 f912be0d056a40d9ffc49aeff5287d258048664c
SHA512 a3b95b96082621a06f1b3df0dde7b50b4c84172f8f5a48889f766fab9594e3dc41a86ab47553bc8ef4a01c29103bfc59ace36f1135e4aedc0d7079faad513589
SSDEEP 96:jSOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:jBhBAO8b0Obx9nFLnnmI
TLSH
T1E662C593A51D099F0222039999DF7AD3A1BC94344C7328FEF8C259256FDAC1923737B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
Size 28KB
SHA256 208ed152aa8e05d49fe2edae354a7f7b4425d883a8e25cba2fd1e0700ead87ce
MD5 77f1d20c09c1fee67a03af9c361d2bb0
SHA1 b3bb0fc83a46905e760e84f0c629b7aac6bbcf82
SHA512 254dcc422192469896195a03b89ce6527e905411403b121028c7327cee50525e8a2d3fd6f6f0c518e147a2eeb6ac322d80ec6cab98c08c66aa5aa1565a9b1b4e
SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEv:0PY/9
TLSH
T1CDD24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json.gz3520.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz3520.tmp
Size 2KB
SHA256 74081722259e69e667e2a185d19395d4a0864a48bb43644cda6ae21997da1886
MD5 7c79eba639dc2d6bc437c7f8128a4c80
SHA1 69685c12a029888d2794478b2f41c1656b36800d
SHA512 44739559ed20e7473092fce01a4d10fb476416bf0e4262ba28969b81ca3fec70979df32b4157f9647cf63aea3309a9a98e5fcf29e0bd3c711617dd2e01d2b37d
TLSH
T1E9515C122CF87E5B3441860B75C2BCF59CD7876820DD698DA45C6F08539357B3B61C8A
MD5 SHA1 SHA512 TLSH

Submit Download

agent-settings.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
Size 3KB
SHA256 a7fd3ac6570fda2ee1a9cc3d1f6a36e8a723fdd77508cdcbb506f5068c38ba9f
MD5 e94f7e148c657a19c3ccb68d448616de
SHA1 442d1194e041882bf93e9bdd26711944b56a6fc2
SHA512 c48ca27363122152c1f0f301e4c63ba4d303f70b462e113a2f90727b1720a1ed55a2afb880fa5e4a6e4b77f916a49976ec17e375e9e14c72f6028b12fe165770
TLSH
T10A812011A0B0C72D1375776CDE56F615CE0A06A52A190B0AF05D34FF0F7ABD27AAB4E2
MD5 SHA1 SHA512 TLSH

Submit Download

configuration-settings-dc-win10.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
Size 242KB
SHA256 1a388c11ac7b14c44ecb605da1f6111274beb11d947442311c5ef1a88d6e4b68
MD5 80ff33c99dd10147ea596dc25319a780
SHA1 04bada413072751276f871286071cf691b5073ff
SHA512 ae0ff8a43d19cc0b4a26cf10e7fa28779d803d984639d2e6a5304a6e737635a440a5551633a1026be8b3a9d847ac0f7e125e1f00f0edeb5fb03bc5afefa6e44c
SSDEEP 768:HDVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAaS:HDzZZ1uSNABIpkIU1
TLSH
T13E3418969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration-settings-dc-winxp.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-winxp.xml
Size 246KB
SHA256 1cc07f4bae868d6538d08b563b8d18c241169e0a97eb4e7f569dcc104be75df8
MD5 d687601fef459a2711ac844cfd863373
SHA1 10720c707e8d240c198288556db0c418c0b8cb64
SHA512 1df1473210b097867025d1c4480380c6c67f5465e0f924b6173983e7e759a83e95c334e31c45a7f080b8c67b6f85ca1b9653ea2e121c78d16490920e7b44771a
SSDEEP 768:HDVQuZ14/++C1TFgSNwbEdxoHBZDH5+qXBi+kpWc2t7cIugGIbMQnKXjUEAavAaO:HDzZZ1uSNAEiVkZO1
TLSH
T1BE3418969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration-settings-dc.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
Size 261KB
SHA256 db2751fd3ef07f03c99e5b117f2806f627470d629d4dd79f619dc8ea51f9d805
MD5 0b2e7aceb8fb4d6fd05c58cde380297c
SHA1 e80cd444ef61f95de76582a6bc7381bc223c82c4
SHA512 541bf21ca6cc52a1fc6c0851100a3df10d543cfc205eea2711ed2c46d63f463045bb638a3cba60c83c5cedc87df9736c74dcd6a401b1eca1d1e6418959d49574
SSDEEP 768:HDVQuZ14/++C1TFgSNwb2MxoH9rDT95+E4XBNv2pWc2twcIMgGIbMQnKXjUEAav4:HDzZZ1uSNA7YTo2aO1
TLSH
T1684417969DFEAC53E2D4091C8E921C087D9A4B874DC918A535BC3BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-framework.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
Size 415KB
SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
MD5 d1a1e51389e6663e8e53933731adf46f
SHA1 9ada91a587210f7f67ce5e805d7c35ba1c4201eb
SHA512 14208064c56b6fd9998f10b7a534b3c48ddc1539ca4ae63521e5ccced1824e3a2e7ecc0c2e592138bf17d4ef07d253ba537215d8fc095b0d2a55842887624a99
SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZn2FYYh:6fufQiiNJY7tYiSYh
TLSH
T13E94B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-onpremise.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
Size 109KB
SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
MD5 b39316c180a11c7cbefd08019ad9c97d
SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
TLSH
T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
Size 1.6MB
SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
MD5 415d608384f186f24717c62056111c99
SHA1 85a8d23411db39acaaa00a7efb974535f74bfb26
SHA512 f72b81cddefac677b27d41380fbc647c83a1cd22ac3d319659f569d64907103cbaa5ca3ab877c97fb54f3f0f37b5a6a3a7afa96f6c4c7bee02aaa275473b7ceb
SSDEEP 49152:L8vq3hwELiWbHTKR0NDZK+/0KfEDKJKzK5xFKOQFKNoDKpW83wKFC+KFE2v:4vqxwEeWbHTK+hZK+/0KfEDKJKzK5xF8
TLSH
T13E75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dynamic-variables.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
Size 28KB
SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
MD5 889d10168a96d01a40af825a606ffbe8
SHA1 d1a75fea9d9aedd31dd581b8cdf7b45791d790d8
SHA512 4536452db3e0d32cc7129bab4180a509b71d5affa0fb98599cf7ae4d21671cce0fcb7335cc891a0ce247de2a6674197f6ba74409a14b6bfc15a7a03d1511b90b
SSDEEP 768:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYOXNe/pR71KRa2GG4q+V5No5hVMKD4idqH:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYL
TLSH
T10AD2753E61A0FC4CBAD0E85C14CC8A188855D313518D7AF1FBE84F2E0BA59A5525FDFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meta-data.xml4828.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml4828.tmp
Size 8KB
SHA256 051ac0d901129245785deb1ca9694abb9252d29e7178f18ea5aea88e1b1b303f
MD5 2f5cc5d85358aedda75ec14d9aeb938a
SHA1 be498c5335fcc75aacc80f885933c06ecc9bcb4f
SHA512 7729f09255eb46e06c27659b31da6e4a00a3209c8d9966bc401e4ad4d04d8fa8626c38c27d2b7ed00c8ce8302061d31ad3ee7a31c77eb38df4eaf39313b9bb3e
SSDEEP 192:kYUKUEUAURUwuUM9U7U2UMRU2UTUMUdUZU+UAUlUHUHUfUMeULUZU+UYAUzU+UGC:DN9Jm6PonLBED669zkiM+0uY9TAQ9TBQ
TLSH
T173127AA06BCA9CF81194FA0C8F4DD820F9B5F61721AD101535D5BC488EFB8EB3DB6129
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagent.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
Size 3.1MB
SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
MD5 7e12fdfa73e292f21d91fab687229213
SHA1 092919df467205f4b81337a73e1d8602c77d92ee
SHA512 5e41cf585b2e549330b21d8e9f414fbe7588fe405c1b80d32053c14b98b45a001384c93ac32e7253910f01285f1c6efc0d46e163c1b0c3f017fd04f5bda20ad7
SSDEEP 49152:8594T6Iiya9PlJdUI11loQlxI6Uh8Zvu4d7TmunCQ/XHaT9eGfcph9yv3fxJuQ:8P4uIiya9PeHQlxdQ4dGunCQfUer9yvr
TLSH
T19AE5AF13EB418031E5DA00B6C27A9B7A9D396730132590D7E7D06DE86EB45E27A3E34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcconfig.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
Size 7.0MB
SHA256 27800f916566d2a564e48eb543d1c511c72b344765ff4f9bdafb113d13669f01
MD5 210c7ad0f6111a77a81dda1c6af5fd40
SHA1 8278e855060fafb2d5542b11ea4a1d68553895c4
SHA512 19d4aefc458d07d0826f6e0d0bd6f7c53c5706c88c5363545e18c5765a6f999e1a22be3d6c97b18609ba18459b6f2d8585faa5b4c8c8e7ffae2bc641c541777c
SSDEEP 196608:Mcm9rt6qX04B1RlXiuzOBhuVAOZouCDuQcf9VY0:+m4BX1iuzO32rouCDuf9VY0
TLSH
T16576AE22EE068136F5C100B7927C5BBB6879AB301725A0D3E6945DEC59F48D2623FB1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato.woff

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
Size 36KB
SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
MD5 171937a8fad6a1c8a37344d09d4fc20c
SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
TLSH
T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop_down_icon.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
Size 449B
SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
MD5 60bd20b51eb0483e93aa6f4cb0a84288
SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
TLSH
T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
MD5 SHA1 SHA512 TLSH

Submit Download

info.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
Size 2KB
SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
MD5 d4893659007e98de701a47cd39991be3
SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
TLSH
T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
MD5 SHA1 SHA512 TLSH

Submit Download

Network_Connection.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
Size 1KB
SHA256 069fcbe00cf74fcece85ad33f293d47bc6836c5ef46d4eecacaa3de0b6f5598e
MD5 41512775acb8d9c8d782008f2033021c
SHA1 8b65a049ff0dda799ea03c811383f294f761e9fd
SHA512 3c26f0d03abbaedfc6d3564d4a575f693636b33e2a80594fa12abf5a7584975a56d980bb55dbe29e4b8c5b515f1d820590795ed90c2cc51a522f9fd29e04e720
TLSH
T11A11023173BCA0452763004D52EEBC123C7BEB4523B5BCE25644F26C65F225AE2E27A1
MD5 SHA1 SHA512 TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 96KB
SHA256 54a34ec04ecf16ad851f846c891b4b8bd49c5bb780b96be00f1dec83f9c24ccc
MD5 1796dec0d2ef43ad6f6fcba5b7dbcba2
SHA1 464f7c4e30f99305a55901bc01d8b0eaea1f65df
SHA512 96568f66fd6a3819ee9e0c5c47e08ea9aa77bc208138f2f92d1c721feda845e37ee4881bfbff69fd459caa8487dbf092a5fd9d0b03fca2e723fd8dbd8a7487ca
SSDEEP 768:gCRJxc2yQb3CBmEFhGiJfq4XlAznGffSpSKmnm0jeaZR7DV8AEbWn:p3znGXSpSKmnmPa9
TLSH
T1B2A368417EFD30D047675D9A9B0227C325827958031378A0B7ACBECCA6D9A139FBFA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentservice.log
Size 4KB
SHA256 a8de9a53b4c0393382f901a90bb49b116dbf96b8879219256e640e44466dc46a
MD5 f0293e6d6c33e2a2ef7d3724b57feaa1
SHA1 0b8fa883accc4f97deb22d728d1e633589c7d796
SHA512 2150d495372dac3018926d68a3271937070d252fcbced1fdfac22471aa8f1ab72ca8df5471bf7d53bbf650878ef6ac96a64651e4191e6086c328ee958b6f66e9
SSDEEP 96:1eX48OEGfnMWE5LtoIoIojojojojoRoRoRoHo0RKD27zcG:8XMy5xoIoIojojojojoRoRoRoHo0RX75
TLSH
T1D091294075F63CD14A7748A999230BE3328B74A527136CF0A7AA3FE48DED8159FDE610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcdatatransferdown.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
Size 4KB
SHA256 9b7c63d752205d158d4b34e38f558e6218fe3db35d9ea9f76a4d807e6b161a9c
MD5 d66a13aece5bff7a9fcb519f41a6ce7d
SHA1 7f56ffe7872bb95b9a1079a4d920215513a06fab
SHA512 d0e422b285325751995f8a25d3a1e7756030c84b11f19f34ec6dc4370d952547c6df26ec3d3c5065b5198c9d2b9053cb563d07ac871e7f7746837de5b254ad4a
SSDEEP 48:+7O7/C32yME42+hcMEett2tRW29MEm2fMEgy2MHg2cMEG2Xc2RMEj22zRp2FMESY:+q7iIyem3Jo3iwqbJAC1
TLSH
T1B5A1020D2BF864B84B7A0B5FF2845A24B4997CDA927030F4FA58857AC7E1355FAE4E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcdatatransferup.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferup.log
Size 453B
SHA256 7a2b9e7b8bcb7cb8cc3bb17d4f0c0537379154135fc6690acdd306b48809bdd7
MD5 c17217ace391744a8a25cf5f786bcb2d
SHA1 0f327c0b0a52adff5f04823f6c364484bd9dfe0f
SHA512 2969e56cdc902c908eacb2478072db3bae856b5d5b2318749538822b1c1e9489cc7aa33b0b9ed5c491d5a772424b00c4ff1038073ea95de596c4676f25e3bdcf
TLSH
T101F0DC0997B4343989BA4E1EF5161104B4DBA052403010E0EC99A4558BB07EA9BE1748
MD5 SHA1 SHA512 TLSH

Submit Download

InitCmd.bat

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\InitCmd.bat
Size 2B
SHA256 d7e9f590ccc53e236f6e389f0e160908f898fad9b886395c003e6b1f869bf816
MD5 cfe260590d0669f46ac503d60f9a35c5
SHA1 1608bb75347cd8c40187e5f3c0a969ed73a98d51
SHA512 412888dd9c7c139f325b672e9d42d2e5ab1e5eda102589de112cd45cf914a2d76488650f6815bda856b35b8ad391b8988749d96bf89b54645bbae91b251a51d8
MD5 SHA1 SHA512

Submit Download

MessageBox.vbs

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\MessageBox.vbs
Size 326B
SHA256 39791d8f62c8e387bd506ce76242f1916b0ac61454a6d4dd4c86dd26f883ad48
MD5 5fe1dba38795a952385fb731966f5d7e
SHA1 412dd51a654f3bf376bfaf0cd1f8b268db175108
SHA512 d5a0023305a0aba17d50eff734ac5821656396c7d2a03e5a648138e3389cc8e2ec416d5b81d75af40e2d74524e2fe3da592c08c6d8b474fb8458b5f1c51ed711
TLSH
T163E0865D6C05DAB3D24A51926BF1F13A4A170A80A21774E48107D4B22A29A529E5297D
MD5 SHA1 SHA512 TLSH

Submit Download

generalAlerts.vbs

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\generalAlerts.vbs
Size 6KB
SHA256 f6590dfa19b65645e964f791ecc00e24950b060f6eb7df304af8652198cbd581
MD5 bc7cd345c15a075d4987aa52648053a3
SHA1 36906d307b8bf787979ab88292ea1390f5cab0f7
SHA512 3e036d74a187da7f3e034ec02f249302592ee382594187b04ff42b61313a50a79b66cde8e9c2b06f5ade553d01541874c303c54dcff58a1171c1629cd1614878
SSDEEP 192:3bko8MYWNybKu4wMuPtZhXsSxBSk43IxGxpTkAJazAwL:3bkqFN6T4wBPtZhcSxBSk4YxGxpTkAJA
TLSH
T11AD1DA2BA6109B244A4315E7674C717E7EA0C407A141FD58BCECC9C42F95F39C7A51EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI75F1.tmp

Path C:\Windows\Installer\MSI75F1.tmp
Size 81KB
SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
MD5 e9b3f881f3855718fe6a4ed7855bae30
SHA1 cf19171cc1b2186c5e046c0a3195ce47532b215a
SHA512 50c04cc4ff234bb97192af5b437838f81e3930b1c2024dc13bd292ff85f6ddbaa670c7e2c2a1ca90d2c9e8de1b0ec4c1e7c2aa49ada80a0f4a42f9e461f41c26
SSDEEP 1536:A+xCoJw5hZFi1QmA2uFQW9z/gkcWBxk40OExFyoxM:nJw51i1PburjM+xEOExFy9
TLSH
T102837C117350C872E49A693468A9C7326D397D625EF884C77FD907794FA03C1AE3932B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59719c.msi

Path C:\Windows\Installer\e59719c.msi
Size 31.8MB
SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
MD5 db7ca603d463a06806ff1660979f406d
SHA1 823ade4e43d36416436a115c48ba562d94fa696f
SHA512 8e2527478514cf5ec8b40fa0ffc53d91ae72a1ba75a8c96800e06282b5e76e2f2f61f4b9e979c15f691591ee4f926b17aa07aebf31de68638b13e94db702b8d5
SSDEEP 786432:juvkjbX98hUIlkZpqcvX4kp1h1HnX6Jx5L3gxKF:ivk3X98hUUspqcvokD3yxU6
TLSH
T1FD77337234438836D5C26CB095E6C364D2A60D508EB42453A677B2BBDAF37C296F73E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagenthttp.dll

Path C:\Windows\SysWOW64\dcagenthttp.dll
Size 3.6MB
SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
MD5 c943a1cdbcd28058068b921cc8daa04e
SHA1 2694d3588167cc0f940a30a5f4b13793e0cf181e
SHA512 d5bee6a3a43d4b04e41d177af022ff03ac8a2971f0cc79265e00d027294e56b1de289773e487dba60664a6c9ba3d9f2f26bdd5453cc9220cd8313adf1868fd24
SSDEEP 49152:eGvD7zfSmnd1o2Mm0A1qga6zN/zuNscwOWbKikCDp9ZqljvLQTeDTtJb83ph9h7Q:1D7zqmnd1oT4XN/zuNsSikq6Lzbs9VQ
TLSH
T1D106BF11FF82C176FECE1176827A4F7E4D3A9744076649C767A43AB80E311E26A3E247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dclibxml2.dll

Path C:\Windows\SysWOW64\dclibxml2.dll
Size 2.1MB
SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
MD5 67cc424838fda84bad295b4459107c8b
SHA1 404f865e84e6338735a0c38617d73031195c520f
SHA512 1a3232bed3826065416a50866d02827765c66104ed49c533324f0cb614745028411bda63784f4f8c3819f9a72e65016171179d80d484d10e52300eaffbd44397
SSDEEP 49152:e9DUM26DYbVgzTtuKlKuuGaXKbj/BAUZLYM7:TMfQgRBBAUZLT
TLSH
T1F9A5AE15F981C176E5E6807486FEEBB6982ECD31232460E376A639D45E341E232BD34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download