d4f52e3470104f6a7e291b0df2bec8a63b70013eef74b49214a32e887be4e6f6

Analysis

max time kernel
50s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 08:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_0a106aaf4a0999a5364bc53d697e2f10_cryptbot_dosia_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
Size 58.9MB
Sample260907-j7mfjsfg47
SHA256 d4f52e3470104f6a7e291b0df2bec8a63b70013eef74b49214a32e887be4e6f6
MD5 0a106aaf4a0999a5364bc53d697e2f10
SHA1 e9969b2204e8910beabdf5213285687192ae1d26
SHA512 97cf9c8c305038391168da256d6cc0114bbc837c7058dc3630f188bcd530b6dc58193e55c5318f9a81f479f737dec76893acf51efec0e90fe6cbfd51506e9508
SSDEEP 1572864:bgmEpk+nncQ1ku27fIXbln+OLD4eHxWJNASlwJfA9taLa:EVRnre7fIr8qD4BHASlqfs0La
TLSH
T13BD73337E3A444A5EA03917DCC6B8648D5337ED84BB8E6BF23EC69165B137D19A30321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4580	dcagentregister.exe
3688	7za.exe
5852	dcagentservice.exe
3292	7za.exe
4812	7za.exe
5968	dcstatusutil.exe
1788	dcagentservice.exe
4100	dcinventory.exe
1912	CRU_Reporter.exe
5128	dcusbsummary.exe
5352	dcconfig.exe
1588	dcusb64.exe
5680	dcstatusutil.exe
672	dcagentregister.exe
4740	dcondemand.exe
5404	dcswmeter.exe
1612	dcinventory.exe
4112	dcconfig.exe
1668	dcconfig.exe
1716	dcpatchscan.exe
6128	dcmetroapps.exe

Loads dropped DLL 64 IoCs

pid	Process
1240	MsiExec.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
5852	dcagentservice.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
5968	dcstatusutil.exe
5968	dcstatusutil.exe
5968	dcstatusutil.exe
5968	dcstatusutil.exe
5968	dcstatusutil.exe
5968	dcstatusutil.exe
5968	dcstatusutil.exe
5968	dcstatusutil.exe
5968	dcstatusutil.exe
1788	dcagentservice.exe
4100	dcinventory.exe
5128	dcusbsummary.exe
5352	dcconfig.exe
4100	dcinventory.exe
4100	dcinventory.exe
4100	dcinventory.exe
5352	dcconfig.exe
5352	dcconfig.exe
5352	dcconfig.exe
5680	dcstatusutil.exe
672	dcagentregister.exe
672	dcagentregister.exe
5352	dcconfig.exe
5680	dcstatusutil.exe
4740	dcondemand.exe
672	dcagentregister.exe
672	dcagentregister.exe
672	dcagentregister.exe
5680	dcstatusutil.exe
4740	dcondemand.exe
5680	dcstatusutil.exe
4740	dcondemand.exe
5680	dcstatusutil.exe
5404	dcswmeter.exe
5680	dcstatusutil.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5684	icacls.exe
1804	icacls.exe
3928	icacls.exe
4260	icacls.exe
4984	icacls.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2760	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dclibxml2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dcagentlibxml2.dll	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2712	WScript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcerror.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\windows-antivirus-list.json	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagenteventaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ohotfix.ini	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\file_system_watcher.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstallerPostAction.log	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\downloadSuccessAccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json	dcondemand.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Idea.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\dc_rds.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\core_util_x64.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwolsettings.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdriver.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcusbaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcipscope.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\NativeUIHandler.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\hostondemandaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\DCAgentQppmUpgraderAccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\PortableDetectionSettings.json	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log	dcswmeter.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-inv.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7z.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\DCAgentQppmUpgraderAccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\RemComm.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_fr_FR.properties	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicescanaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\TroubleshootingToolPoco.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcconfigaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwol.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\NativeUIHandler.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\sas.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\close_top.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\Bit-locker.bat	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\DisableEnableEthernet.vbs	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_hu_HU.properties	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_ro_RO.properties	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_agentaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\AgentHook.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_install_all.svg	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log	dcusbsummary.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log	dcstatusutil.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Internet_Connection.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh_inactive.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ToolsIQ.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\SomAgentAccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_agentservice.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_rejected.svg	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_hr_HR.properties	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentupgrade.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_user.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSRemoteInstallerService.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSLogCollector.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UIControls.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_nb_NO.properties	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSMdmEnroll.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_agentservice.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log	dcconfig.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e595991.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9FE1.tmp	msiexec.exe
File created	C:\Windows\Installer\e595999.msi	msiexec.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDE0.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF79AFCBDE72731785.TMP	msiexec.exe
File created	C:\Windows\Installer\e595990.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e595990.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9948.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}	msiexec.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json	dcagentregister.exe
File created	C:\Windows\SystemTemp\~DF0319EC4556A13263.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF728F9433B85E7054.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDBFA3A07797A4CA9.TMP	msiexec.exe
File created	C:\Windows\Installer\e595991.mst	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4964	cmd.exe
3480	cmd.exe
5628	cmd.exe
3112	cmd.exe
3804	cmd.exe
3296	cmd.exe
3324	cmd.exe
3728	cmd.exe
5548	cmd.exe
6056	cmd.exe
2992	cmd.exe
4300	cmd.exe
4040	cmd.exe
5068	cmd.exe
2232	cmd.exe
5324	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 8 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CD08F540EC478FB79E73FBEBCAABB65C8617F5E9\Blob = 190000000100000010000000ceff5b7a9a7ca8ea9ab5e4698451ea2e0f000000010000002000000031c6c4b5d73497b78b56aa697dda04d7343945814318e35e3e261a4c360977a7030000000100000014000000cd08f540ec478fb79e73fbebcaabb65c8617f5e9140000000100000014000000de0dbcd0562e421e17812bd4f9d8bdf9db7472cb2000000001000000f0030000308203ec308202d4a003020102020805ec8ce2336f537d300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303831383039353231335a180f32303531303831383039353231335a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c7a2aa5acd3124ffb50d4f884832c72f1de518996b53d6543d632319bb81a8908ef3da3424436b105ce86145cb8562c65720ef19ac15a01b370c6ed2923ccd97b7650cb1ee4fbe31cb54e7d8642d65c85c7cbb6a2949683c430214e2855dda452c5077dfbbd2e701a71214b2ec8cd417dd2af691ba0adb425656e8f59df71ca5260e8ae484ed604fb5bf55c86756d0570257537a6876c6d7419f51874db0d3ae9373e795305b54178d056b3ee87193d1f4e5bfeaa0705d2a0578bcf847b1c492fdfa05c471ec59c71fdd23164a2b7655eae11ac90ceba857fa7f57582c85430706dd4b8f6ba0821b0e23965ef589cf7833da642bdfd41408c7c1c68a3836a5630203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414de0dbcd0562e421e17812bd4f9d8bdf9db7472cb301f0603551d23041830168014de0dbcd0562e421e17812bd4f9d8bdf9db7472cb300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101000d7a46d24347d6d83ae3e805f1980ab336c8960f491852325a15337c2f42edd32d5646352843200c273508dcaaa8939930baf75649433f2fb5db97e693f8d8c9c8d78b596606ad9730e7d0e58f4d2e105306c091a6a0d3924af84fb18a6b4d8acceac647d7538f0bd19d6b229e08cea0bffd60b85b0542cc22151c10717105141929366a24552f8fadb52e3cf03b74e02f3907ca25de0065bde5eb782539f0630cb7f018682f0e8c617ae0d3bb9c0040e6fb754d966861976aa4fc3268a4541734889d2d3d8596a12ef7c2e3b57297255037e5fb606dfb9b8b57e69f65db913d1bf922cdcb3249f27b20909cdf747013b8ca4fdabb768fe114bd929da572624e	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F9E424DBB0C27DAC51CD83ABFBEA2084222C9499\Blob = 030000000100000014000000f9e424dbb0c27dac51cd83abfbea2084222c94992000000001000000d8030000308203d4308202bca00302010202083f8a8d6ef4a1b56b300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303831383039353231325a180f32303531303831383039353231325a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c68810103dd071b94f7c89085bf0ed7e6900e9d28300dc4b715e2870e1f5a01a51a5e6d3b90f64f51d2144082de37b758e462d27f335387f92aefb85a8b14a02452f8924ed12d21c62dca80de353a1005fff954caccbdbcbe56cfe8ba0b1732fd54f4e2caaba4d92ee68bc9da0ef4edb534bb7c00c4c5d7c2ba94b155cc0a673d5674c8bba595f705f87ee8a801be83b62af0a7ea20e40f225d6f3c6fea0b6051987d83f9cfb276eba34666f13d49a42e1c1d49a162b37fa85cc2c392d5f9bc6400729d39e551bde4810a5908b35d91989211d05a7543564b85df46b788f213a99548ff35f57ef8e0a0f56d52f15f2a7eaf51675d54858a6e6b1d73e3d82e65f0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c25a756ef178050922709d3b51eb9e39db23ce50301f0603551d23041830168014c25a756ef178050922709d3b51eb9e39db23ce50300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101001ebb457ca3f58b9724cb6783cfd0b9df9ed6c664aa2e28da710cac0f8f6b034b162a6cbd1d9c38b4dc6ff7f3b9596fc86ae71e1a1a41b968c4fd5e01f96621af476cbc8a35cd34bb44b39fade0b223f3fdeaaf6831140b57e5af4b6cafecb86bdc4292f0660fe2af8cdfb25c8bc8b8579d9908392be5b9870601e83fb5ff1f708a244ddfeda0f19f06cbfa5c968576c6373fb32e7bebdbe77cf5ed6b564b21e3e2e3e77be34a0f60f444a3d60ce7199e2a885cd10bfc12552ed081bf23a53536ee8edfa9acdd045958af14611774af0e2e58da75b0461413fe8832b1d256d3531dae0ffef262bfc2d3fa62c2208d6567f40f24e423564828e5fc8b24e68790d3	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CD08F540EC478FB79E73FBEBCAABB65C8617F5E9\Blob = 030000000100000014000000cd08f540ec478fb79e73fbebcaabb65c8617f5e92000000001000000f0030000308203ec308202d4a003020102020805ec8ce2336f537d300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303831383039353231335a180f32303531303831383039353231335a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c7a2aa5acd3124ffb50d4f884832c72f1de518996b53d6543d632319bb81a8908ef3da3424436b105ce86145cb8562c65720ef19ac15a01b370c6ed2923ccd97b7650cb1ee4fbe31cb54e7d8642d65c85c7cbb6a2949683c430214e2855dda452c5077dfbbd2e701a71214b2ec8cd417dd2af691ba0adb425656e8f59df71ca5260e8ae484ed604fb5bf55c86756d0570257537a6876c6d7419f51874db0d3ae9373e795305b54178d056b3ee87193d1f4e5bfeaa0705d2a0578bcf847b1c492fdfa05c471ec59c71fdd23164a2b7655eae11ac90ceba857fa7f57582c85430706dd4b8f6ba0821b0e23965ef589cf7833da642bdfd41408c7c1c68a3836a5630203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414de0dbcd0562e421e17812bd4f9d8bdf9db7472cb301f0603551d23041830168014de0dbcd0562e421e17812bd4f9d8bdf9db7472cb300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101000d7a46d24347d6d83ae3e805f1980ab336c8960f491852325a15337c2f42edd32d5646352843200c273508dcaaa8939930baf75649433f2fb5db97e693f8d8c9c8d78b596606ad9730e7d0e58f4d2e105306c091a6a0d3924af84fb18a6b4d8acceac647d7538f0bd19d6b229e08cea0bffd60b85b0542cc22151c10717105141929366a24552f8fadb52e3cf03b74e02f3907ca25de0065bde5eb782539f0630cb7f018682f0e8c617ae0d3bb9c0040e6fb754d966861976aa4fc3268a4541734889d2d3d8596a12ef7c2e3b57297255037e5fb606dfb9b8b57e69f65db913d1bf922cdcb3249f27b20909cdf747013b8ca4fdabb768fe114bd929da572624e	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F9E424DBB0C27DAC51CD83ABFBEA2084222C9499\Blob = 0f00000001000000200000007d14af46664d6ea6ba2a2bb15f3e6e7c36fc5bdcbd29d800699affa1be875c28030000000100000014000000f9e424dbb0c27dac51cd83abfbea2084222c94992000000001000000d8030000308203d4308202bca00302010202083f8a8d6ef4a1b56b300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303831383039353231325a180f32303531303831383039353231325a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c68810103dd071b94f7c89085bf0ed7e6900e9d28300dc4b715e2870e1f5a01a51a5e6d3b90f64f51d2144082de37b758e462d27f335387f92aefb85a8b14a02452f8924ed12d21c62dca80de353a1005fff954caccbdbcbe56cfe8ba0b1732fd54f4e2caaba4d92ee68bc9da0ef4edb534bb7c00c4c5d7c2ba94b155cc0a673d5674c8bba595f705f87ee8a801be83b62af0a7ea20e40f225d6f3c6fea0b6051987d83f9cfb276eba34666f13d49a42e1c1d49a162b37fa85cc2c392d5f9bc6400729d39e551bde4810a5908b35d91989211d05a7543564b85df46b788f213a99548ff35f57ef8e0a0f56d52f15f2a7eaf51675d54858a6e6b1d73e3d82e65f0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c25a756ef178050922709d3b51eb9e39db23ce50301f0603551d23041830168014c25a756ef178050922709d3b51eb9e39db23ce50300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101001ebb457ca3f58b9724cb6783cfd0b9df9ed6c664aa2e28da710cac0f8f6b034b162a6cbd1d9c38b4dc6ff7f3b9596fc86ae71e1a1a41b968c4fd5e01f96621af476cbc8a35cd34bb44b39fade0b223f3fdeaaf6831140b57e5af4b6cafecb86bdc4292f0660fe2af8cdfb25c8bc8b8579d9908392be5b9870601e83fb5ff1f708a244ddfeda0f19f06cbfa5c968576c6373fb32e7bebdbe77cf5ed6b564b21e3e2e3e77be34a0f60f444a3d60ce7199e2a885cd10bfc12552ed081bf23a53536ee8edfa9acdd045958af14611774af0e2e58da75b0461413fe8832b1d256d3531dae0ffef262bfc2d3fa62c2208d6567f40f24e423564828e5fc8b24e68790d3	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CD08F540EC478FB79E73FBEBCAABB65C8617F5E9\Blob = 0f000000010000002000000031c6c4b5d73497b78b56aa697dda04d7343945814318e35e3e261a4c360977a7030000000100000014000000cd08f540ec478fb79e73fbebcaabb65c8617f5e92000000001000000f0030000308203ec308202d4a003020102020805ec8ce2336f537d300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303831383039353231335a180f32303531303831383039353231335a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c7a2aa5acd3124ffb50d4f884832c72f1de518996b53d6543d632319bb81a8908ef3da3424436b105ce86145cb8562c65720ef19ac15a01b370c6ed2923ccd97b7650cb1ee4fbe31cb54e7d8642d65c85c7cbb6a2949683c430214e2855dda452c5077dfbbd2e701a71214b2ec8cd417dd2af691ba0adb425656e8f59df71ca5260e8ae484ed604fb5bf55c86756d0570257537a6876c6d7419f51874db0d3ae9373e795305b54178d056b3ee87193d1f4e5bfeaa0705d2a0578bcf847b1c492fdfa05c471ec59c71fdd23164a2b7655eae11ac90ceba857fa7f57582c85430706dd4b8f6ba0821b0e23965ef589cf7833da642bdfd41408c7c1c68a3836a5630203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414de0dbcd0562e421e17812bd4f9d8bdf9db7472cb301f0603551d23041830168014de0dbcd0562e421e17812bd4f9d8bdf9db7472cb300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101000d7a46d24347d6d83ae3e805f1980ab336c8960f491852325a15337c2f42edd32d5646352843200c273508dcaaa8939930baf75649433f2fb5db97e693f8d8c9c8d78b596606ad9730e7d0e58f4d2e105306c091a6a0d3924af84fb18a6b4d8acceac647d7538f0bd19d6b229e08cea0bffd60b85b0542cc22151c10717105141929366a24552f8fadb52e3cf03b74e02f3907ca25de0065bde5eb782539f0630cb7f018682f0e8c617ae0d3bb9c0040e6fb754d966861976aa4fc3268a4541734889d2d3d8596a12ef7c2e3b57297255037e5fb606dfb9b8b57e69f65db913d1bf922cdcb3249f27b20909cdf747013b8ca4fdabb768fe114bd929da572624e	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F9E424DBB0C27DAC51CD83ABFBEA2084222C9499\Blob = 140000000100000014000000c25a756ef178050922709d3b51eb9e39db23ce50030000000100000014000000f9e424dbb0c27dac51cd83abfbea2084222c94990f00000001000000200000007d14af46664d6ea6ba2a2bb15f3e6e7c36fc5bdcbd29d800699affa1be875c282000000001000000d8030000308203d4308202bca00302010202083f8a8d6ef4a1b56b300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303831383039353231325a180f32303531303831383039353231325a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c68810103dd071b94f7c89085bf0ed7e6900e9d28300dc4b715e2870e1f5a01a51a5e6d3b90f64f51d2144082de37b758e462d27f335387f92aefb85a8b14a02452f8924ed12d21c62dca80de353a1005fff954caccbdbcbe56cfe8ba0b1732fd54f4e2caaba4d92ee68bc9da0ef4edb534bb7c00c4c5d7c2ba94b155cc0a673d5674c8bba595f705f87ee8a801be83b62af0a7ea20e40f225d6f3c6fea0b6051987d83f9cfb276eba34666f13d49a42e1c1d49a162b37fa85cc2c392d5f9bc6400729d39e551bde4810a5908b35d91989211d05a7543564b85df46b788f213a99548ff35f57ef8e0a0f56d52f15f2a7eaf51675d54858a6e6b1d73e3d82e65f0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c25a756ef178050922709d3b51eb9e39db23ce50301f0603551d23041830168014c25a756ef178050922709d3b51eb9e39db23ce50300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101001ebb457ca3f58b9724cb6783cfd0b9df9ed6c664aa2e28da710cac0f8f6b034b162a6cbd1d9c38b4dc6ff7f3b9596fc86ae71e1a1a41b968c4fd5e01f96621af476cbc8a35cd34bb44b39fade0b223f3fdeaaf6831140b57e5af4b6cafecb86bdc4292f0660fe2af8cdfb25c8bc8b8579d9908392be5b9870601e83fb5ff1f708a244ddfeda0f19f06cbfa5c968576c6373fb32e7bebdbe77cf5ed6b564b21e3e2e3e77be34a0f60f444a3d60ce7199e2a885cd10bfc12552ed081bf23a53536ee8edfa9acdd045958af14611774af0e2e58da75b0461413fe8832b1d256d3531dae0ffef262bfc2d3fa62c2208d6567f40f24e423564828e5fc8b24e68790d3	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CD08F540EC478FB79E73FBEBCAABB65C8617F5E9\Blob = 140000000100000014000000de0dbcd0562e421e17812bd4f9d8bdf9db7472cb030000000100000014000000cd08f540ec478fb79e73fbebcaabb65c8617f5e90f000000010000002000000031c6c4b5d73497b78b56aa697dda04d7343945814318e35e3e261a4c360977a72000000001000000f0030000308203ec308202d4a003020102020805ec8ce2336f537d300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303831383039353231335a180f32303531303831383039353231335a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c7a2aa5acd3124ffb50d4f884832c72f1de518996b53d6543d632319bb81a8908ef3da3424436b105ce86145cb8562c65720ef19ac15a01b370c6ed2923ccd97b7650cb1ee4fbe31cb54e7d8642d65c85c7cbb6a2949683c430214e2855dda452c5077dfbbd2e701a71214b2ec8cd417dd2af691ba0adb425656e8f59df71ca5260e8ae484ed604fb5bf55c86756d0570257537a6876c6d7419f51874db0d3ae9373e795305b54178d056b3ee87193d1f4e5bfeaa0705d2a0578bcf847b1c492fdfa05c471ec59c71fdd23164a2b7655eae11ac90ceba857fa7f57582c85430706dd4b8f6ba0821b0e23965ef589cf7833da642bdfd41408c7c1c68a3836a5630203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414de0dbcd0562e421e17812bd4f9d8bdf9db7472cb301f0603551d23041830168014de0dbcd0562e421e17812bd4f9d8bdf9db7472cb300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101000d7a46d24347d6d83ae3e805f1980ab336c8960f491852325a15337c2f42edd32d5646352843200c273508dcaaa8939930baf75649433f2fb5db97e693f8d8c9c8d78b596606ad9730e7d0e58f4d2e105306c091a6a0d3924af84fb18a6b4d8acceac647d7538f0bd19d6b229e08cea0bffd60b85b0542cc22151c10717105141929366a24552f8fadb52e3cf03b74e02f3907ca25de0065bde5eb782539f0630cb7f018682f0e8c617ae0d3bb9c0040e6fb754d966861976aa4fc3268a4541734889d2d3d8596a12ef7c2e3b57297255037e5fb606dfb9b8b57e69f65db913d1bf922cdcb3249f27b20909cdf747013b8ca4fdabb768fe114bd929da572624e	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F9E424DBB0C27DAC51CD83ABFBEA2084222C9499\Blob = 190000000100000010000000148ad7bdab6971f453ba4ad983db8c430f00000001000000200000007d14af46664d6ea6ba2a2bb15f3e6e7c36fc5bdcbd29d800699affa1be875c28030000000100000014000000f9e424dbb0c27dac51cd83abfbea2084222c9499140000000100000014000000c25a756ef178050922709d3b51eb9e39db23ce502000000001000000d8030000308203d4308202bca00302010202083f8a8d6ef4a1b56b300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303831383039353231325a180f32303531303831383039353231325a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c68810103dd071b94f7c89085bf0ed7e6900e9d28300dc4b715e2870e1f5a01a51a5e6d3b90f64f51d2144082de37b758e462d27f335387f92aefb85a8b14a02452f8924ed12d21c62dca80de353a1005fff954caccbdbcbe56cfe8ba0b1732fd54f4e2caaba4d92ee68bc9da0ef4edb534bb7c00c4c5d7c2ba94b155cc0a673d5674c8bba595f705f87ee8a801be83b62af0a7ea20e40f225d6f3c6fea0b6051987d83f9cfb276eba34666f13d49a42e1c1d49a162b37fa85cc2c392d5f9bc6400729d39e551bde4810a5908b35d91989211d05a7543564b85df46b788f213a99548ff35f57ef8e0a0f56d52f15f2a7eaf51675d54858a6e6b1d73e3d82e65f0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c25a756ef178050922709d3b51eb9e39db23ce50301f0603551d23041830168014c25a756ef178050922709d3b51eb9e39db23ce50300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101001ebb457ca3f58b9724cb6783cfd0b9df9ed6c664aa2e28da710cac0f8f6b034b162a6cbd1d9c38b4dc6ff7f3b9596fc86ae71e1a1a41b968c4fd5e01f96621af476cbc8a35cd34bb44b39fade0b223f3fdeaaf6831140b57e5af4b6cafecb86bdc4292f0660fe2af8cdfb25c8bc8b8579d9908392be5b9870601e83fb5ff1f708a244ddfeda0f19f06cbfa5c968576c6373fb32e7bebdbe77cf5ed6b564b21e3e2e3e77be34a0f60f444a3d60ce7199e2a885cd10bfc12552ed081bf23a53536ee8edfa9acdd045958af14611774af0e2e58da75b0461413fe8832b1d256d3531dae0ffef262bfc2d3fa62c2208d6567f40f24e423564828e5fc8b24e68790d3	dcagentregister.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcmetroapps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CRU_Reporter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcswmeter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcagentregister.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcpatchscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcondemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	dcusb64.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5920	systeminfo.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcagentregister.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcconfig.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	dcagentservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B	dcagentservice.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "184879683"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	2026-09-06_0a106aaf4a0999a5364bc53d697e2f10_cryptbot_dosia_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products	dcagentservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	dcagentservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\"	dcagentservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "7C3FEC54F6DB2754AA34EB273B9C5915"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer	dcagentservice.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F9E424DBB0C27DAC51CD83ABFBEA2084222C9499	dcagentregister.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CD08F540EC478FB79E73FBEBCAABB65C8617F5E9	dcagentregister.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe
4580	dcagentregister.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6044	msiexec.exe
Token: SeSecurityPrivilege	2760	msiexec.exe
Token: SeCreateTokenPrivilege	6044	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6044	msiexec.exe
Token: SeLockMemoryPrivilege	6044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6044	msiexec.exe
Token: SeMachineAccountPrivilege	6044	msiexec.exe
Token: SeTcbPrivilege	6044	msiexec.exe
Token: SeSecurityPrivilege	6044	msiexec.exe
Token: SeTakeOwnershipPrivilege	6044	msiexec.exe
Token: SeLoadDriverPrivilege	6044	msiexec.exe
Token: SeSystemProfilePrivilege	6044	msiexec.exe
Token: SeSystemtimePrivilege	6044	msiexec.exe
Token: SeProfSingleProcessPrivilege	6044	msiexec.exe
Token: SeIncBasePriorityPrivilege	6044	msiexec.exe
Token: SeCreatePagefilePrivilege	6044	msiexec.exe
Token: SeCreatePermanentPrivilege	6044	msiexec.exe
Token: SeBackupPrivilege	6044	msiexec.exe
Token: SeRestorePrivilege	6044	msiexec.exe
Token: SeShutdownPrivilege	6044	msiexec.exe
Token: SeDebugPrivilege	6044	msiexec.exe
Token: SeAuditPrivilege	6044	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6044	msiexec.exe
Token: SeChangeNotifyPrivilege	6044	msiexec.exe
Token: SeRemoteShutdownPrivilege	6044	msiexec.exe
Token: SeUndockPrivilege	6044	msiexec.exe
Token: SeSyncAgentPrivilege	6044	msiexec.exe
Token: SeEnableDelegationPrivilege	6044	msiexec.exe
Token: SeManageVolumePrivilege	6044	msiexec.exe
Token: SeImpersonatePrivilege	6044	msiexec.exe
Token: SeCreateGlobalPrivilege	6044	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	3688	7za.exe
Token: 35	3688	7za.exe
Token: SeSecurityPrivilege	3688	7za.exe
Token: SeSecurityPrivilege	3688	7za.exe
Token: SeRestorePrivilege	3292	7za.exe
Token: 35	3292	7za.exe
Token: SeSecurityPrivilege	3292	7za.exe
Token: SeSecurityPrivilege	3292	7za.exe
Token: SeRestorePrivilege	4812	7za.exe
Token: 35	4812	7za.exe
Token: SeSecurityPrivilege	4812	7za.exe
Token: SeSecurityPrivilege	4812	7za.exe
Token: SeDebugPrivilege	5128	dcusbsummary.exe
Token: SeRestorePrivilege	2760	msiexec.exe
Token: SeTakeOwnershipPrivilege	2760	msiexec.exe
Token: SeRestorePrivilege	2760	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
6044	msiexec.exe
2760	msiexec.exe
1240	MsiExec.exe
5128	dcusbsummary.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2712	5076	2026-09-06_0a106aaf4a0999a5364bc53d697e2f10_cryptbot_dosia_icedid_luca-stealer_njrat_quasar-rat_stealc.exe	89
PID 2712 wrote to memory of 6044	2712	WScript.exe	90
PID 2760 wrote to memory of 1240	2760	msiexec.exe	92
PID 2760 wrote to memory of 4580	2760	msiexec.exe	93
PID 4580 wrote to memory of 4964	4580	dcagentregister.exe	94
PID 4964 wrote to memory of 4452	4964	cmd.exe	96
PID 4452 wrote to memory of 3600	4452	net.exe	97
PID 4964 wrote to memory of 5684	4964	cmd.exe	98
PID 4964 wrote to memory of 1804	4964	cmd.exe	99
PID 4964 wrote to memory of 3928	4964	cmd.exe	100
PID 4964 wrote to memory of 4260	4964	cmd.exe	101
PID 4964 wrote to memory of 4984	4964	cmd.exe	102
PID 4580 wrote to memory of 6056	4580	dcagentregister.exe	105
PID 6056 wrote to memory of 3688	6056	cmd.exe	107
PID 4580 wrote to memory of 3292	4580	dcagentregister.exe	111
PID 4580 wrote to memory of 4812	4580	dcagentregister.exe	113
PID 4580 wrote to memory of 5968	4580	dcagentregister.exe	115
PID 4580 wrote to memory of 4100	4580	dcagentregister.exe	118
PID 1788 wrote to memory of 1912	1788	dcagentservice.exe	119
PID 1788 wrote to memory of 5128	1788	dcagentservice.exe	122
PID 1788 wrote to memory of 5352	1788	dcagentservice.exe	123
PID 5128 wrote to memory of 1588	5128	dcusbsummary.exe	125
PID 1788 wrote to memory of 5680	1788	dcagentservice.exe	127
PID 4580 wrote to memory of 672	4580	dcagentregister.exe	129
PID 1788 wrote to memory of 4740	1788	dcagentservice.exe	130
PID 1788 wrote to memory of 5404	1788	dcagentservice.exe	132
PID 1788 wrote to memory of 1612	1788	dcagentservice.exe	134
PID 1788 wrote to memory of 4112	1788	dcagentservice.exe	136
PID 4112 wrote to memory of 1668	4112	dcconfig.exe	138
PID 672 wrote to memory of 1716	672	dcagentregister.exe	140
PID 672 wrote to memory of 3480	672	dcagentregister.exe	141
PID 3480 wrote to memory of 5920	3480	cmd.exe	144
PID 4100 wrote to memory of 6128	4100	dcinventory.exe	146

C:\Users\Admin\AppData\Local\Temp\2026-09-06_0a106aaf4a0999a5364bc53d697e2f10_cryptbot_dosia_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_0a106aaf4a0999a5364bc53d697e2f10_cryptbot_dosia_icedid_luca-stealer_njrat_quasar-rat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:6044

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FD1CE88091AB13AD69F0AD80B39E298D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1240
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4452
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5684
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "DLAWBTBF\Admin":(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1804
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3928
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4260
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4984
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6056
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3688
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3292
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:5968
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
    bin\dcinventory.exe -i postinstallation 0 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exe
      dcmetroapps.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6128
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:672
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
      bin\dcpatchscan.exe -y 1
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      PID:1716
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *
        5⤵
        
        PID:3704
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
        5⤵
        
        PID:4172
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *
        5⤵
        
        PID:1396
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
        5⤵
        
        PID:5608
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *
        5⤵
        
        PID:4044
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
        5⤵
        
        PID:2784
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *
        5⤵
        
        PID:1516
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *
        5⤵
        
        PID:2368
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
        5⤵
        
        PID:704
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *
        5⤵
        
        PID:2056
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *
        5⤵
        
        PID:5776
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *
        5⤵
        
        PID:1408
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *
        5⤵
        
        PID:3916
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\EPMErrorCodes.xml.gz" *
        5⤵
        
        PID:3320
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-dependency-details.xml.gz" *
        5⤵
        
        PID:5880
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\ud-supported-patch-details.json.gz" *
        5⤵
        
        PID:1076
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.json.gz" *
        5⤵
        
        PID:3292
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.json.gz" *
        5⤵
        
        PID:4852
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\eol-service-packs.json.gz" *
        5⤵
        
        PID:4064
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\os-servicing-data.json.gz" *
        5⤵
        
        PID:4044
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\misconfig-scan-data.xml.gz" *
        5⤵
        
        PID:3552
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz" *
        5⤵
        
        PID:5672
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\patchresource-vul.xml.gz" *
        5⤵
        
        PID:2552
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\applications-vul.xml.gz" *
        5⤵
        
        PID:1968
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz" *
        5⤵
        
        PID:3500
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-details.json.gz" *
        5⤵
        
        PID:4492
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" *
        5⤵
        
        PID:2924
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
        5⤵
        
        PID:6040
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" *
        5⤵
        
        PID:5548
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
        5⤵
        
        PID:5616
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" *
        5⤵
        
        PID:5596
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe
        5⤵
        
        PID:4908
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip" *
        5⤵
        
        PID:5900
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json""
        5⤵
        Executes a command shell one-liner
        
        PID:3804
      - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so
        6⤵
        
        PID:4540
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json""
        5⤵
        Executes a command shell one-liner
        
        PID:3296
      - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so
        6⤵
        
        PID:4744
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json""
        5⤵
        Executes a command shell one-liner
        
        PID:3324
      - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so
        6⤵
        
        PID:5032
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json""
        5⤵
        Executes a command shell one-liner
        
        PID:2232
      - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so
        6⤵
        
        PID:5452
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json""
        5⤵
        Executes a command shell one-liner
        
        PID:2992
      - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so
        6⤵
        
        PID:2592
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json""
        5⤵
        Executes a command shell one-liner
        
        PID:3728
      - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so
        6⤵
        
        PID:3236
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad2
        5⤵
        
        PID:1832
    - - C:\Windows\system32\CompatTelRunner.exe
        
        "C:\Windows\system32\CompatTelRunner.exe" -m:appraiser.dll -f:DoScheduledTelemetryRun
        5⤵
        
        PID:3636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo.exe
        5⤵
        System Location Discovery: System Language Discovery
        Gathers system information
        
        PID:5920

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5852

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe
  CRU_Reporter.exe -RegisterCRU
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1912
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:1588
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  7 0 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:5352
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
  bin\dcstatusutil.exe RequestAgentSlotFromServer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:5680
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:4740
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5404
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:1612
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  3 0 0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
    16
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:1668
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
    bin\dcinventory.exe -p processor compatibility
    3⤵
    PID:1960
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exe
    refresh
    3⤵
    PID:2872
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json
    3⤵
    PID:2372
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\\OSDetection.json.gz" OSDetection.json
    3⤵
    PID:692
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml3744.tmp" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml3744.tmpnew""
    3⤵
    - Executes a command shell one-liner
    PID:5628
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml3744.tmp" -so
      4⤵
      PID:5596
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
    3⤵
    PID:796
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
    3⤵
    PID:4716
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
    3⤵
    PID:5396
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" *
    3⤵
    PID:4608
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll
    3⤵
    PID:4640
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" *
    3⤵
    PID:3144
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll
    3⤵
    PID:3384
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" *
    3⤵
    PID:5484
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe
    3⤵
    PID:3004
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip" *
    3⤵
    PID:4864
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json""
    3⤵
    - Executes a command shell one-liner
    PID:4300
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so
      4⤵
      PID:840
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json""
    3⤵
    - Executes a command shell one-liner
    PID:4040
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so
      4⤵
      PID:3344
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json""
    3⤵
    - Executes a command shell one-liner
    PID:5068
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\java-component-details.json.gz" -so
      4⤵
      PID:252
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json""
    3⤵
    - Executes a command shell one-liner
    PID:3112
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so
      4⤵
      PID:2944
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json""
    3⤵
    - Executes a command shell one-liner
    PID:5324
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so
      4⤵
      PID:4592
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json""
    3⤵
    - Executes a command shell one-liner
    PID:5548
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so
      4⤵
      PID:2104
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcnacprocess.exe
    3
    3⤵
    PID:4996
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh
    3⤵
    PID:5484
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 2
      4⤵
      PID:5100
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"
        5⤵
        
        PID:6040
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 2
      4⤵
      PID:5788
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        
        dcagenttrayicon.exe -r
        5⤵
        
        PID:1944
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        
        dcagenttrayicon.exe
        5⤵
        
        PID:1756
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"
        5⤵
        
        PID:2432
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        
        dcagenttrayicon.exe -r
        5⤵
        
        PID:2780
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exe
        
        dcagenttrayicon.exe
        5⤵
        
        PID:2140
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe
      "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 50a5c86a-eafc-11ed-a05b-0242ac120003 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\ECEASetup.zip" -c ei_win_64 -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointIntelligence-metadata.json" -a 1
      4⤵
      PID:4228
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\ECEASetup.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\EndpointIntelligence\installer\"
        5⤵
        
        PID:3004
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\installer\ECEASetup.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\installer\ECEASetup.exe" -install
        5⤵
        
        PID:5000
      - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEABundle.7z"
        6⤵
        
        PID:3180
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe
  DCProcessMonitor.exe
  2⤵
  PID:4200

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"
1⤵
PID:5960
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 1
  2⤵
  PID:3884
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 2
  2⤵
  PID:3900
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 4
  2⤵
  PID:3736

C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"
1⤵
PID:4188
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\4\BitlockerMgmt.exe
  BitlockerMgmt.exe -svd
  2⤵
  PID:4360
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe
  -s ET_ENUM 9 2 "Unknown"
  2⤵
  PID:1500
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\4\BitlockerMgmt.exe
  BitlockerMgmt.exe -genblrk
  2⤵
  PID:5840

C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAService.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAService.exe"
1⤵
PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e595994.rbs

Path C:\Config.Msi\e595994.rbs
Size 63KB
SHA256 6c52f9cfe8d60a6d4b872c87d4b22707f910361ce83a8f985ba4f59c3a2f9410
MD5 da0a73cb2559a900701adc74dd798697
SHA1 ec4e4ebf18f2a5bb5d19d11ca7bf6db6f5bfd019
SHA512 0e291b986336f4f80ef9fa0d4af1640bb624dd163d03755c6ad618b9a5b806a867635e128c7362547e9dde7e61d05f13ceb5b07bd20906923eb88dd2b134683b
SSDEEP 768:lhvw1oOjyhMzY7yjDO+GLLtjIKGoqOOeYwOwr4ImBVbG:r8oGyh7UDO+B7BflzbG
TLSH
T1F0537166DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37C4DBB457EBF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59599a.rbs

Path C:\Config.Msi\e59599a.rbs
Size 546B
SHA256 04626eacafc4b1cb013b7ab7799c661070807b44631e8ae5cafcf399c3fe6249
MD5 fb06e34786cd6151721becf67f1ddebd
SHA1 6262d258be1a51b772b01558e3672c25684dee3c
SHA512 7feb21918f3252180d75fd5bdab3be1e1411ab1010e513a5ef3db03e61d8af53ce6e87292b5c46686f22f6ea6231c0c5e6e6e037d4b70d37323e54f8efd56ed9
TLSH
T118F09E93A70C46E2D1A06E7622031F451A6BE17A959487762F8856346E1620E5EBB0DC
MD5 SHA1 SHA512 TLSH

Submit Download

client.p12

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
Size 1KB
SHA256 6da6f03bee73c09117f9b3307cab67f81f19145fdaf6467a82495736306da5e9
MD5 f5601fae08a7088847b686493fac302b
SHA1 c9d7986731eefb58a95f6ba2721e669ccecbcbbf
SHA512 b417bf85daaeef6d6e2e6ebf6b64b0c0f27620f2458f3967c89f71f1d30ecffee45d11995716cadad7a9673b2a0752dd7ff6c1ef5409bbf2e21081012cb49d30
TLSH
T1F321E7579E5A81437C7ECEF0606D0C06E1C8C787A980160FFBB2998B0E4267CBF99583
MD5 SHA1 SHA512 TLSH

Submit Download

dc4040.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc4040.tmp
Size 5KB
SHA256 2f74633e0a5aad93efa206056e46b18eb3e4491e7a6285c9cccca403cc17c110
MD5 674f6bb1fe637ed5ef4111da20bfe701
SHA1 49fa0705582f9e991372c0be9a6d99c8d91c1a5a
SHA512 3821286d786d15f75e960cd3559d2e7410a47ad0e3b4fffae0e8d91a41e038731d5cda40b4983b01e1000d1234e5424c39c67a032ee1eb2c20785001aff5c498
SSDEEP 96:CWdv4W+Ep6S4cVF6cNZcGRD8wjFbm6JiahOV87FV/EAA:gUGHElZhm6YgOV4FVzA
TLSH
T1EAB13210A0A28F6D13B17B5C999AEA55CD1606A1360A1E05F06D39A70F3EFC23DB74F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
Size 839KB
SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
MD5 a5efe54df4f28f6d12adf840dc931b36
SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
TLSH
T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAuthHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
Size 3.1MB
SHA256 83213e2eaf59ae51dae43ef745211cfec11fc2f2cdddcf12e60e876cb31432a2
MD5 44cd42312f8ef1ff272cc404cee42076
SHA1 8c293f4faa0e4ff97565e1464ee29a1fdb2a2c21
SHA512 78039f0b5451408330d13228956a772ce8577c830b6f6908f1afa3dd3c067c7c5b5e6d5b5c27c4ff4c8ee9bf38e6d809dddbf972cf89a84da150752cd82768d4
SSDEEP 49152:Xg2pzZ21QzJJC9d/ImYL5lYbyMffECDYBPkPzUVGoXvPU5BLBjAKnbwk1e:XgE1PJo9d/ImYNlYbyMffE8nwl
TLSH
T16EE59E07FB83D5B1DD8E027801B79B7F5D3A8D184B2089E39B9029ADA8761D0563F36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Bold.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
Size 250KB
SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
MD5 a2fb219c999a8fa6b95ad7c24890072e
SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
TLSH
T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Medium.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
Size 245KB
SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
MD5 cecc32d267ee07ce3413637314b66ca0
SHA1 627b584f88033791f427091fff74c9310bdc2ef1
SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
TLSH
T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentCryptoHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
Size 480KB
SHA256 1350d993df746987d9f73a5f16bbbcfc007b973b47aae002b896e9d8de1d1db1
MD5 45cb15ecac73aaee280a266da5ae9f16
SHA1 69ff47fcbc3bb10b39577928a407fb7c49e0b816
SHA512 6d42216d65331c810a6f92961fc3f7d8c5d559051a4fca5183c05322d023fb47a4b7ab3c643f7b628af0e638eb09ca7d2acc37ee702880475788a9d609b648ac
SSDEEP 6144:P0hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQb:PkKB2NPd4sEL90IdI1PbylPP7
TLSH
T197A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_binaries.7z

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
Size 29.1MB
SHA256 14ae05d3e056207fa991ede24704f76bfb6a7c329993769e78374113c4ac0193
MD5 7cb254ffe00821b17585487c2fdd8bb9
SHA1 e224df4a24a8d7886b3799a5934e7999a090368e
SHA512 b5daa042af9843f08ad0922b7506595f35f5e419099bd1c0368a27606d2c4a9e576c5e43819e790c62e6380e6277b37dd04ba932b7385d991a5246700d83eea7
SSDEEP 786432:83NdazNRz1l+az5PdEKYu+FoWf4WHiNMJ741oj:83NdyNRz1YIdmqWAWHN941oj
TLSH
T105673372A01DE23ED713607FACAFCD75D8254F485DBCD97B13EEA80186462A39B22435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cold_normal_msghldr.gif

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
Size 536B
SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
MD5 60f77c64f9c8a86fd24c8e64c20e009e
SHA1 e9299102aa662027b9e46246a5847074444ec1fd
SHA512 972afa85faba00ad96efad4951ec92ed90e60175dd80a388328c708975df2871655d8ae31ea750d60298ab1514c1a4b53b3b0304d5ace6118b4fea320c075f33
TLSH
T12BF075C0B546067A64170F3544351D4502476D06A57CA33ACC50FCDCD67E220B0229A7
MD5 SHA1 SHA512 TLSH

Submit Download

dcagentregister.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
Size 244KB
SHA256 46532137b794eee1e1b1459bd74d8b4dd79e05533076a4b30e78105c9ce0acd9
MD5 9357d00934d3b4c2f2a3e1876ccb67bc
SHA1 e9225f0c769057a01ee70906b0a3ef63277d5a90
SHA512 12f87b3255ed9b682ba6a37de30d65ac8fb351fae7f51c3dc8984d5ed8b6fd0260a940de876b05e7863ee8b158948a2da0bb029936320894b248a516ec3ee9b9
SSDEEP 3072:QR7kVnRpyFf8ZFpwez3EcmHw2Rpa42/pKwfigDucpXfHtF37nOqsYrmXkZcphTAq:QR7kVn5weorw3RrDpfNtnVCXkZosuW1o
TLSH
T175348E6175D0C072D9A304369CB8DBB6597EF8200F71A5DB63980A7FDE206C29B71B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
Size 1.5MB
SHA256 9df7a780cd51de4467f55c8553ba361b1207de9f6073aa5eab5368154041bf2c
MD5 f959f54f1eadb9edbb8c3817712cbb04
SHA1 b29d1779b1f366c1fd4ce58f3215af02eb8f5cec
SHA512 ca25a0bb1a74ccc120ddacdcd64f8eee80563403bc4e9e598f299a9ad69daba9a439eb811d1fc3fcac256cfab0f3ca41d5092deb11b3d5d692452ad151ddf87d
SSDEEP 24576:QMooJgy1mleByM1eWqjNIGeRCWbBodAMJBUY5ZGMUlqLaWVsqxmPttYf1x:zNmMPUzEpbBJ0dtRVsqD9x
TLSH
T19B75AF2376428031D2A100B19D29AB75AF7DA9680B71C4F3E3C49D7DC5E09D29A3E77E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcstatusutil.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
Size 1.3MB
SHA256 ad2ef8e8cd6d18a93aaa5daea434c1c3b48bf3da5cc7f7af728a53da2b3d8881
MD5 c6ca1931d4f49bde0c80279582840b63
SHA1 9eaf965db61191b1cf6951d219dcaf5d527d5e7b
SHA512 4965c4bdeeac4db8250155d4e648e1514e3cb302e23eea8809d9549997b22c4bc28ada7f05fa5241af102c81a30552085d212062cd9e44ea969bf20acb5a0978
SSDEEP 24576:32CG2B3vBdWRXVnSxUltFN2TRv47moJhFGVqP2IPtNgEk576:mUd8FnDP2TRvkCqP2S
TLSH
T1EE55AE1372528031D2B0C1F19929FB76AB6C99681B6294F3A2C48FBD01E45D26B3F71E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hot_mover_msghldr.gif

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
Size 172B
SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
MD5 c8a811d36876948a70fe7509b7f49925
SHA1 48541ac236da4f143154a8f71fb7fb3f3110bb38
SHA512 6bba69fa213b495a9faf4ea917788c43d888b3d96606db1644d7f8c456fb089f01d3e2582016a5043a49182ebd9767a2169aab94de05868ab0efeff5825c7578
TLSH
T115C0801594D652DB7498C735951537213919947F996DD12D404431F134785A0511FD64
MD5 SHA1 SHA512 TLSH

Submit Download

resources.zip

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.zip
Size 119KB
SHA256 790e4cc4c928b2055f625056e5e98a1ac6059ac54dd30f4126ed01f506b0f23f
MD5 4902b1cadcb92eaa717a922d2815bbcb
SHA1 564be25bf2541881f9ebfb8609654db0385f1798
SHA512 02cf0aac0433c17a7e0aa9561452d32ecd83c19700fc282adec9dd5aa55c6bf10ff37c9176fb004c1ba7aeb25dfa77124b668daa815464aeae54768b115aaa89
SSDEEP 3072:B0nkqDUaOF2LX9P8Oq7EnHPZJUWv9jWHXcxI3GDYK01+x57:BokqoaOFkX9P8T+HxJUlXcxAGDYK01g7
TLSH
T172C312AD87CF104AAC8DD5F22B7AD5D4A896306A334C032C4B05EFD6D5D2F862B8109B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

topmiddle.bmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
Size 1016B
SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
MD5 368947d319ac4823f5d542c8f723fb0c
SHA1 7d419d7c8b15f9abefc936f526e68ae2c535292f
SHA512 ed51660075cfeb5a3826231a0f0e2b1b165d0dc808cc5c1f309885dfa7903c914b76bebbb183ef38d67a789adf43b0e6e5223cfccfc362d50ab05b1becb15a60
TLSH
T188119AF0A1F0DCBAE7571660799EB42055D66AC03249424D340BF6286EB7715748CFA9
MD5 SHA1 SHA512 TLSH

Submit Download

ui-icons_444444_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
Size 6KB
SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
MD5 d10bc07005bb2d604f4905183690ac04
SHA1 69011104e870704cf45910d74bed5938f9062891
SHA512 c8df6ec5eb5684348613af6e8bc2e8d5759ff9912e9d36df42c09960739b0922c2830b56059ec0a95fc2ed7aa83fb3fe5a8673402544c4bd00daab457b9b97ab
SSDEEP 192:JfC8S1p4JW0bYmezNui5WP1UMIUN93GUO4:JK8AvOYmW1+BIg93P
TLSH
T102E19E87A4C2459E8EAA5CFF1D8E522DC17B8E1A9A1B50C52552D2C1071DFF8D483FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_555555_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
Size 6KB
SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
MD5 00dd0ec0a16a1085e714c7906ff8fb06
SHA1 244bd9b7c3b1c4f7ef72de31f67804faff213715
SHA512 163afece9ae9693c41324ffd89191132a8d2e42d73f962ace0b70b44a17d954c8f506cc25af152397e2536da6245e4336ae465708edf6ede955b4ad502af7a71
SSDEEP 96:gMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6KaP:zXTvYXQzy51nfmcuXibSralG/aP
TLSH
T166E18DE534F0C16898A14C3253536644D16EB3C3A8F7AD02C1B0AABAA465F3872FF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_777620_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
Size 4KB
SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
MD5 4e7e3e142f3939883cd0a7e00cabdaef
SHA1 d20567fd436991539eafd65c3bde77d82a656012
SHA512 d145a64f637f34d9f9fefaf7cef14ea277d0933e16c625234a9c1e0a54a7f3d0d820ab49b4b68d5d3e9853399d74efba9ff7771bfd3481f8c1c70e6dc6f50275
SSDEEP 96:7sHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:oHm231Nvu+wIqltWOe3nIH
TLSH
T1A7A13DE27BE7DCF495E62277BF9D5491E1542A41207047B4C4C4D11C695C99B1361E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quick-updates.json3744.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json3744.tmp
Size 102KB
SHA256 26e094b8cad80c7d89d7448d92ca8865063520e4ae174982f35f28210331cf60
MD5 bee4b0304da7ea1dcc8694789e924f62
SHA1 f82d64191ddb03e55552ac6932a980da16d0bc57
SHA512 6047729919032306323b735652743ccac706f6b338f98b1153bb65379345b0b15e4379b03ac293799fff9bf88ad3c359a2a2188015a2f1260e941842bf50c4cf
SSDEEP 384:q5IaOc5sHF1FNddtVFjDf/DTnHzzBNRNx1hFR9zPfjMY33zz/1aIJUJlJoJFJtJy:gIk5payriPz1JgHUk99d6mbN8rq
TLSH
T190A39959DB60DE43961A92B150088C01732E236BBC8EBFE0775DA53C5F4C25F197E2AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MisconfigEngine.dll.gz3744.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz3744.tmp
Size 538KB
SHA256 58e79d2ffdac24ac0190fc80b60cf865f74338b8f8e6196cb94adbdf934a35a2
MD5 bccdd29a08c96c35af38529d963b98d0
SHA1 6cb138eb4cb60f4554669ed5a03c6b2cfbcc78e8
SHA512 f3746f47b0443da50d2f675097da37b3eb9dd90df829f0d0956039dfa1715e9e5d3cc69b0c962715de7c5ad27d2dc9c3737d92fb73fd7ef4a5a61fc0e0bd0891
SSDEEP 12288:qiDg1XoVFdHlXuO9P858aa/AQfVvPsqpZHaVoIURDecnpZV:qagBSxl58Oj4Q90eZHb/npZV
TLSH
T184C42301537BC17DB583269D7CC0DAC0DC5D65A3FF8EC52424F26A806B4B9BB185EE92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServerDetectionChecks.dll.gz3744.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz3744.tmp
Size 379KB
SHA256 df5783204295ed860d8a35b3e1d17db720386d26dd13dad3ddf7a510213d28fb
MD5 a305331a9477b901880297a0fdf78109
SHA1 d4769101ab6225cfa700f759f059c8ce6b39eb2a
SHA512 763f9b31b043ee04e24f74729b723934cd30483e8a030d205b455de927d2ceced805b5a72cb3f5c0ebbc16b9c743b2ac9c8d92e2b6e15807404d4a2069ddfa84
SSDEEP 6144:79KVYT86N48LNf0ZK/hPaprwyeeVwkFoYnAaKKRi+H/rzoZfFr1/IjE4yWyIX:JKctO+88/hGwFe6EoYAaKQ1HY1/ITVl
TLSH
T10F84230330C06D00822E2A559F2997AD7A9F74CFD5CCC4DBA6A850D1342AB6EB375DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component-details.json.gz

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\component-details.json.gz
Size 70KB
SHA256 516cf480edce7295fe83301735a3960c649032f665799de577f3e674d8483153
MD5 54bd61198dab8dcedb94262c193312ac
SHA1 39be6ad3ac41632ad46aa85dcb972ffb8ef80b06
SHA512 4d311df4553a03ca469812fefb20e858e59820f65ab1c41f7a01adc151b9617b87d317ea82e3b00aee45413689f8032e1c920a2853f5e483309a87cf8b24093e
SSDEEP 1536:z8fgQtiX6oJ449Ms2QWkWeWJuNDiTuhednuK:zmJKLosYv
TLSH
T1776302D4F5381D2EF40505EB1449A2CEB4B27E9362831BBFB7523A8949826E716B4733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows-component-details.zip3744.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip3744.tmp
Size 599KB
SHA256 fa63b2d74454d2574d2082b6bc80586796e023e9b957b3254f3fc06b2df13613
MD5 061563b34212eded39f6551f91b9ba53
SHA1 4cc1a7e5487f2b8838ac306cca7de38c1d752602
SHA512 f4a10cb4508e8abad129f2e0c9af8c6e07859515bfc5152be2e046107dfe84671c7e478cb2d7bd9240e5e6a07ceee121e404b708f1c61b5c908ab128c14337de
SSDEEP 12288:vOlVCGgXShrSCch6cax/y4BU3jDvSyvR2cQTE807ODP2hq:vOlVCzXSQpTmyjviG8vD+8
TLSH
T104D423858A7A4F8D81754033A9C2D0E0397D2B76FB764A9F37323494860B3760E659F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coveragex.exe.gz3744.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\coveragex.exe.gz3744.tmp
Size 1.4MB
SHA256 ba614677c8fccb3bb6edc183432d1b8cc4e3951d7491b68536edeba5a6505d62
MD5 f2a0d0e65a720b30ff824ca1435954c1
SHA1 a98871bb8640f28745178b1773661acbb2a12361
SHA512 85a81363e180a8cbd19362bdf683e647e129599c800cfe8049ce634125c833a42c6bf61f2e84bc5b785628dbb3b980a85300950c997e856a654c3bd6a3832c8c
SSDEEP 24576:VkU80Lv7U5anIzdtXR+LpXiYbK+pRZ282fCB6uIvcxIqa38ZlkM:yYLUanGtQLpLFR2P6EuIvMZlF
TLSH
T188653339A1D5DEF4453C6DBA62E3A5933E5DC22870A11CDBEBAB712D1ED0BE78132500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
Size 28KB
SHA256 208ed152aa8e05d49fe2edae354a7f7b4425d883a8e25cba2fd1e0700ead87ce
MD5 77f1d20c09c1fee67a03af9c361d2bb0
SHA1 b3bb0fc83a46905e760e84f0c629b7aac6bbcf82
SHA512 254dcc422192469896195a03b89ce6527e905411403b121028c7327cee50525e8a2d3fd6f6f0c518e147a2eeb6ac322d80ec6cab98c08c66aa5aa1565a9b1b4e
SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEv:0PY/9
TLSH
T1CDD24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json.gz3744.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz3744.tmp
Size 2KB
SHA256 74081722259e69e667e2a185d19395d4a0864a48bb43644cda6ae21997da1886
MD5 7c79eba639dc2d6bc437c7f8128a4c80
SHA1 69685c12a029888d2794478b2f41c1656b36800d
SHA512 44739559ed20e7473092fce01a4d10fb476416bf0e4262ba28969b81ca3fec70979df32b4157f9647cf63aea3309a9a98e5fcf29e0bd3c711617dd2e01d2b37d
TLSH
T1E9515C122CF87E5B3441860B75C2BCF59CD7876820DD698DA45C6F08539357B3B61C8A
MD5 SHA1 SHA512 TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
Size 15KB
SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
MD5 cf5799838289c42502297f17ca89b49b
SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
TLSH
T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addons-resources.json1380.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\addons-resources.json1380.tmp
Size 25B
SHA256 436d5da6d28c88f68a146d9dba8531beb076c91007b188ac6b7006cc8f66c65e
MD5 b7598659320335621cd347aba6a77221
SHA1 9b25512643f6d6a0d870f52ce0cfb8429f5bd2be
SHA512 fac5e80dca886f2f669eb8c245027421bbdedbcb7288c7f48859d9df447610d74a8d51e5870e7575f99eedade16e0899b837050608426cf087a517f01cbf529c
MD5 SHA1 SHA512

Submit Download

configuration-settings-dc-win10.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
Size 247KB
SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
MD5 ff5c89c88fe59a341aa4fe80b6f58215
SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
TLSH
T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer-meta-data.json996.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json996.tmp
Size 5KB
SHA256 9655aef7d59b158b778b42b9f2c2c87c08ebdca0335eb725b55189ef7b70740c
MD5 e83ebfd85c0a752c259d96580b04c11e
SHA1 69b1aeef45ce83734a1616f0f07850e1e2acf2e0
SHA512 039db24cfaa17b8de4028807885e9dae54d5a97d7b0dd1a96a01b90b6ddf3442091ccb271df4336b88cc19f2d1c56c5109c4cd07b41555213680e30b9493e0b9
SSDEEP 96:6ogiQsvAZv56hRDGuNLEeIKemiJNJmEiN:6ogiQsvAZv56hRDGuNLEeItmiJjmEE
TLSH
T121C1B6D4B1AF4CFD46C6F54A4D5EC06ABBA6F122F4E94C0C7649FC48CECA099B392424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-framework.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
Size 413KB
SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
MD5 a450789f0d23503c895bafaed3d4be27
SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
TLSH
T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-onpremise.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
Size 109KB
SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
MD5 b39316c180a11c7cbefd08019ad9c97d
SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
TLSH
T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
Size 1.6MB
SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
MD5 ac79e017281cd633fb90c06a19a180fc
SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
TLSH
T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meta-data.xml5288.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml5288.tmp
Size 6KB
SHA256 665135bc345b6f7b8f8453edd4089d023bc39597afd247028881e1a5bf1d8391
MD5 375304be6c53e02c3b828267d13b5b67
SHA1 dd85dc420b53c2becc2c53b61a85da89163d9292
SHA512 8cf0f887f94ae8b46fc45f625b1ded24a3a1e86a5d5a8b36602f235b0dccca71d495527fcee949d01ed4314c10cfc33e5d80372aa1975314592628be9fa66dd9
SSDEEP 192:KU/UEUMJU2UZU+UdU4U7U7U2UMQULUrUYUAUlUHUEU5/UM0UKUwuUMaUKUkuUyUh:Kk9XB696n+onquS5zkiVK/KN6AFMvmG4
TLSH
T12AD19C606BCB9CF81194FA0C8F4DD920F9A2F62761AD501435D9BC548EFB8D73EB2069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources.properties4040.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties4040.tmp
Size 143KB
SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
MD5 68f9f27cafb41305b34055d5a01aecc0
SHA1 1d52fb05faf202d76ec9fb0cd3fa881b1345ffd6
SHA512 573d35d54a88edc2f4f713f444bd9e3f3ad19093ad92d9c8b7730a3bbe5a482fc0800f58fbb84559c62813e117aed113b1a9856543336867835c2d1c46f53e82
SSDEEP 3072:TpfCA7eTk7RKCwyKlWF/VPKWlAZaE09XhQPl1mWB9L6KTSkt8kRK9WHN:tfCA7M2RKCwyKlAVPKcAvTSC8kRKW
TLSH
T1C6E3A41AD1656B7E37C6132BF03A2FD036B20C588701A9E87899E4F4E67D98121B75F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagent.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
Size 4.6MB
SHA256 bec4bd6a1744b0a8c8856f9f779db2eb3bdba081a489adb19000de7a52ccefa4
MD5 1e6a5bdef1a764c8676b2c1563bc0e41
SHA1 feb8ce2e0dcd27bf98f1b636d3fd634497aadadd
SHA512 c66a6850bc36fd8bd882e9b5feb51a6af030ed606ea4f200079259e5712ac89b6af02cc7e821291e8fa62f52360bf806c79f04321e510e86e19980c89ae1f9d5
SSDEEP 49152:n5oZdDXQ4AlZWNVXSr8iVlssssqkffbq32u6dr0zrEGYlLlyYs0wO4TDa1yIoaWD:n5gd3wdbqt6dr0cGYlx1ymyO4YIbj
TLSH
T13D36BF27BF43C070D99E02B815BA9B7B5D3D89248B3188E397D028BD88B54D1663F76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato.woff

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
Size 36KB
SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
MD5 171937a8fad6a1c8a37344d09d4fc20c
SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
TLSH
T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcmsghandler.ico

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
Size 14KB
SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
MD5 3f93e0ea97079b1f5b356166db334740
SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
TLSH
T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop_down_icon.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
Size 449B
SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
MD5 60bd20b51eb0483e93aa6f4cb0a84288
SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
TLSH
T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
MD5 SHA1 SHA512 TLSH

Submit Download

info.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
Size 2KB
SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
MD5 d4893659007e98de701a47cd39991be3
SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
TLSH
T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_icon.svg

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
Size 161B
SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
MD5 10006715631c28cd1cca4302987b6371
SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
TLSH
T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
MD5 SHA1 SHA512 TLSH

Submit Download

Network_Connection.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
Size 436B
SHA256 656d7d2cc3bd730ac08a1c50946237387d7cbabe4d3265346f18c8bc11b0708f
MD5 f355380cfb25f6026c04b9a1af7303dc
SHA1 37305a6e37f7a764899ed3abb3050ca216338d7e
SHA512 ebda0653c1c58861481ab68b4ea06a19f7f5c1e69797fffc0dc1d4a6225f3bfc8d783ff39bcf6d8b4f0bef443d1ee5162d912bfce26ccf68958ca2ca7a65e91b
TLSH
T153E0E53473F6C80A60664344036C79183CE8B48191C8C3E4320461EC9B9AC8FEAE4AF0
MD5 SHA1 SHA512 TLSH

Submit Download

Network_Connection.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
Size 1KB
SHA256 f5d840a3a4eae0ddde9045b56dce5306ecec74212ab86f6e5a6b9014f8a188db
MD5 79ea60eb9383f7cd9f3fc91c19df5d9c
SHA1 99037662b6d9ff38528e32ad455291f6a7c14de5
SHA512 a28e0d134cce35aca2cf037fef8446e2a76939a4e0ec4b5e4eed333dbf573c9b0e7a9d375f607feaccf53aacfedeebb587dfd3c1438948506dd118c8f4949cf3
TLSH
T1A721313073F6E84755260700166838283DDCE56A5288C2D83208B2EC6BAED9FDBE55F1
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 3KB
SHA256 5432116da5c65694f242a45db4d78db1b8efd49011808ab6cb0c2b318e8a7ed5
MD5 8921f88eb2b5df47035f20d23901113a
SHA1 1fc8719c42e99a0c3322bd2f23204acb6ea4c40e
SHA512 8e7706d6767e13142ae32d9935e96b5b99fb023ff236917904c640231db6c6ed1b1aeea6f6074cd88c555af5748999ad9cd157c0722a28c444f95bd5c2e6af38
TLSH
T12D81D4116AB8CDB91B47A52B3764EC005489100F319F68A332AD21FC9BBE447F7AA75C
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 4KB
SHA256 10292ad5835b3ac09aa23d049187bb509ba962917cd682a6d68bf992980ed010
MD5 1d87fabdc1ff058b9f1811ac588885f5
SHA1 15efa56e3be0f616ac282466b3f23d2780dce46e
SHA512 cfea42cac7aa7250da3d4b3179fb3c682db5b4a72a789dbb8317887c8ca34a0b0ca481b42e1d65f18f469e77bed72b12c988b35dff1a6ef936e7f0e59188485e
SSDEEP 96:eY0It8XMXSBXSYI+YVXkXpXAaLyXKXfMXKXfMXKXfMX/rX/i3bCXY:90It8XMXeXhXpXeXKXUXKXUXKXUXjXxo
TLSH
T11891E6116AB8CDB91B47A52B3760DC405489100F308F68A332AD25FC9BBE447F7ABB5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 11KB
SHA256 71c2e4fb788afa230a36de5b8e3f143308208df6e6791b393da70c25d2d230c8
MD5 e76ccb927e39ef274fa57103ba7e3404
SHA1 02e4cb0bc4cca34167bf526a93bf7ca485887fdf
SHA512 4a18642420c38901844004208e55be268b1f2aa5de7acf15433187eacbc6d2e20950e2a3599569b515a15b684d30c3abd72c4e126e07198e96124e5584023512
SSDEEP 192:QLCrqzp2HdO5b6VeXO5uvjdGMwGAGFwWXk98:aCrqzp2Hdab6Wa6wYp
TLSH
T14A328C163BD8A4C063B90889AC35078F1A8B3E1C1553EA9C77583AC1776BC5B7F5F294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dccomponentregister.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dccomponentregister.log
Size 31KB
SHA256 b7e55e8aba56131fc12695795dd1c86c0a1f6a2666f15b84d16b2975cf06e627
MD5 177350826f35cb59d78d5583d9a6352a
SHA1 2bd6bea86b74b80c0ba47f22bd7cc198e572e02e
SHA512 d8b8d5297d46d55e7b9ae0fce845a98f3693e5cafecc8d8d109cec39f332ad323780b048603011eb6302df2829767eb110d7e8d751ca4515dd2a94212ba45e7c
SSDEEP 768:WoLo7DoJuBuXJ23H2QRnFyB9mB0UNSHm97G2U:puBuXJ2p7G2U
TLSH
T1F3E2AD0139AD74F242AE198DAD051F8704DA3E1D0663ED54736CB985BBAE41B2FEF4B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcpatchcpu.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
Size 256B
SHA256 37c86448a8488c959d5f6e7fd3a9f47eba4bb45900e3767921e75f2044b6f425
MD5 a21fa50244c7b55a21e7e44962959e52
SHA1 11ff7b19dea2b48e30aff0791d4f177de087753c
SHA512 0aba3d38cbf3c2081e531a4e9f31c36107b7fe882514d49eb583a49ef7cf7387e3c7508a361e90b8f02a290ad73be3bd3a3d63b1e477319d1c07ff29885f389c
TLSH
T1CCD05E22F07931610A8317B0281A67D716E97D879060A96E72B52564D3AA51F3736019
MD5 SHA1 SHA512 TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 29KB
SHA256 9df8ff38cfce93e1017fb3170e4b390a7f18193560a3b1b1dc4ccc03121b5051
MD5 d2d995d3e69a01cb34929f8ff47eb41e
SHA1 4a82c88663e3174d0615c1864574bc3352549c9a
SHA512 2f607ff4691f0be71e92cbdb82a7beac6f3f21663c921dce9188d12a5d0fe6572615d603f7def549b34e8351162488a53b06d11951c7c646088fbfd97120d4da
SSDEEP 192:sDfCDfISjs1bOlgXfzHaW/YAOz60jD0tldGhnSPeRB7p4apKwE1QasMIndKhhddP:kKDA9uDM0hz8yBml9
TLSH
T1F4D29E407E1CB5BE032B2A58AF0D3343401ABE4D0153EB51BBE65DA592BDA179E8F4F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 1KB
SHA256 04260c19d1bb8d76003f6da7b07aaa96f8440ed269f80657faa5dac65876c6f1
MD5 8d481f92a9669f9c1785d380cfe800b4
SHA1 de7dfb4b77f671f755b4161b453796189d434742
SHA512 676945b94d5b1f6fa66e57901d9270cb939cd955f553fbaf9ad7749959f7862c9ed0f0c1e6462c0cf1d2c32e4f546f1e54fc4b806716de9f88c1d3115afc52b5
TLSH
T1E4313D103A2C25D13266068D7F3E1B5F258EBF180127EA19335B26C5517DC1F3F5E1A0
MD5 SHA1 SHA512 TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 29KB
SHA256 f7b2dc079f853e09676d53991fc776c53c2d740bd0f44f1c472b21e08930ad30
MD5 d7c23d119eb95be09bc8c0a7a66ac9e9
SHA1 f276d9293a4fb9830146cfc3e4cd03dbcee8c890
SHA512 057d8f59afde09d9c9916f07a9815181da13f5f44aa4e8969118b945ebe1af0cab83cb47c5c8d1b759cdd3d422b743204364beb95c1a1e00c06d94bcaf8e0842
SSDEEP 192:UPxdChdICb81rS1YDvXzSebosS1P0jzLtVVyrvm9KlRR3+65eKPG3oLm3syDRHuO:QkhqWuzRi9vI7BNqv2
TLSH
T105D2AE047F1C58B5322B0599BF2D2343401D7D890263FFA87FA799A4F2AC9435ACE9D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devicepatchaccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log
Size 784B
SHA256 d70f8a165e330f61e430f2f824ead19da852cb5b929437b7c962aba5fefdf253
MD5 ee193748667d17dd6b5744375d53f4d8
SHA1 188cf6ac61bba775f27c32d1dcf48891aa2a1ba8
SHA512 f53b755ff07528eb3db4567831db81a566f65405c7833cce618591fe8951eb3527edd95c7d0a9fc70da888d267cd1814819208576754301c75a464d2cc0ff144
TLSH
T10C01EDA34E05024829CEE37378CFDB23E53691660F42791E30ED2184D3283082B8E828
MD5 SHA1 SHA512 TLSH

Submit Download

ecdatatransfer_access.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
Size 5KB
SHA256 68aa559f0ea5bfb3f19b5ab8a75a3853cff3d2178f6f988b3786336069d93360
MD5 338691cf63764ed5adcdc912196699b9
SHA1 3bfb7e8669798e27c63411ec84afeea2b9e3c81e
SHA512 48085cc5b828ef90864331165ee06887abdc0f27a7401329ce87a5bada67a43a06f8b9d8e48670db5a3777e2ef89aae8e0b30a8a73fe130f8f55b28954b2f8d3
SSDEEP 96:lB/2Zmym22+7tsid5CUmijwspgIKj1IKYS9RBN42le2lLNBs7:lBzymesa1mawspJKjiKNzBNTNxBs7
TLSH
T1CAC1230D0FCD68F99729CA12B1D9C904452ABCA9E1F57964B9725801CAB27CFFEB4F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ues_BitLockerToGoRecKeyScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoRecKeyScan.log
Size 797B
SHA256 a1bc8060b632f0ac4c5b4374f9584ca3da8809e7ad829a430b27183990f80e56
MD5 d21cb9abb3e4cc02f27d9a49b1cdda0e
SHA1 4734b0b5fffcecb5d59e6cba7c6f84dc3d0f341e
SHA512 1cce50d564676081767e0cd9475441cc03895d6b265d1c11e2344cb0a04f165973474c442806395c9e8efa627a624b4a0b52e87a99fd44c9d33edeced947fb8f
TLSH
T1220192A257E0309A580FB493C3049F2837C176114C11AE14B4CEB9E5B7B292F6FAF195
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoRecKeyScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoRecKeyScan.log
Size 1KB
SHA256 d98aa5006c66bd182a2c3d4f8af803971b0e1007affa6bf249904bbab452414a
MD5 2bce4f4053616063c4bf3dd9f6da8330
SHA1 8b85552151bbd45d5084d6062e55b72ee172750d
SHA512 5ae155dad36b9f9e2ed5e1699525b2c5a7130bd22ef268d9a51abea5f5a288b5d1d9d5d41455927b2416447bb38d796b84b0aedddefb0b1479a642b039343bce
TLSH
T151313A9696F4348A780FB443C3045F183B813E128C019E29B5CEB5E4B7B292F6EEF195
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoRecKeyScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoRecKeyScan.log
Size 2KB
SHA256 0ed0bf10feb7b27f3991597f058da573959bb09b227e8b0f37788ab71a4b5acb
MD5 06099ca29525af1a4e27c9319593fece
SHA1 5077ad56c7782e517fa32eae3571b059a440e6ba
SHA512 c45778bc9c5522feffd2062843e6f94ce103b56df1e17d8739ca96cd827d2686c2e2abd52742f2e6e3307bb6ea66d022800a4c3af57e1d7bb2f94bb0acc05638
TLSH
T1F04129929AF43899790F7442C3056F083B813D128C819E29B5CEB5D4B7B281FAEEF595
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoRecKeyScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoRecKeyScan.log
Size 5KB
SHA256 1d8494b5bc05d48c99aa740b039dcdd63a576ce976c55d540972165a5145ddb6
MD5 36e7b2b65d24d067ce8d99059e975134
SHA1 a873808ef9484c48a51b7a2a385321a815fdc100
SHA512 658f95fb0d4efc0ac5f88c7b2bd5638ead691d5e1f952e3adb47744308b970445e9f6a1734984b51e58542303093318264029a6e67024258a5b785959a9030f1
SSDEEP 48:IGi2VtFQLjLyJfro+GnyOQnERsMj+GnyOQaAfmWpuBnaAzAMoGUFaHvf2WE5sf6V:li2qLjLwrolyOQnERsMZyOQr/0AZdn
TLSH
T195B18ED25AB07459280F7087C204AF083B953E5788515E2878EFB5D8B76382F9EFF694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ues_BitLockerToGoVolScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoVolScan.log
Size 783B
SHA256 fc5b73923834ce7078d3adc19a9b26c72d121912c82727838aefd47769fa46f2
MD5 db49e7165bd92fe6813186e72ec94058
SHA1 84e9b5759eb195cecec1357c7394693f449f6c45
SHA512 746e847c37945ba0b345456b1dd1b304909ec025abe5632fe8bf364b1b7a5ea56a51cdb3c9f70d0429f09570db6661d7695a857c51b6c0d998b3afce4a90ff43
TLSH
T1540156D2A6E1304A358FB6D3C314DF18378B771128508949B8CDBA55BFB152DEAAE0C6
MD5 SHA1 SHA512 TLSH

Submit Download

ues_BitLockerToGoVolScan.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_BitLockerToGoVolScan.log
Size 1KB
SHA256 39148442600d832d5bfd4f8d308d2ff793ff9181e0f90237d8bd8a6c177c9d8e
MD5 f279bca9d93300c463a5e4a91065fad6
SHA1 ad955dd16b056bf621c4a2a08ea28583a10780ab
SHA512 9fd51dea378f83c4b8435ac92a44484aa865c3eb8e0b5e9aea9ffc54b60c56f068db16604be5cf0973aa9ec4e1faeb872ea9cf1264b3d99a1808170064ce2e27
TLSH
T18D31B9D2A9E0304A364F71D2C2149F0C378A7A125840894DB4CDB5547FB242EEEEA4C2
MD5 SHA1 SHA512 TLSH

Submit Download

setAppPermission_Internal.bat

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
Size 957B
SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
MD5 e300d6f5c088aee55f0b91f4efc72035
SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
TLSH
T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA-Server.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
Size 1KB
SHA256 244e2fe8de7377e30935fe4728b594fc8dd076ad68965cd5d88d54fff32eccff
MD5 ca7c590d0b81623d076cf9dc4c61d711
SHA1 e9f813446b1065646d25ab05fc83b2a531e4168e
SHA512 4284907c02d01da71dc1c36ba72cace10b3b6b64f02269f8af8c5822f4e91b4efb8f19b3fab14a5553e5e55b157b4295c03f936b11adc046567502fe14d52cde
TLSH
T1E02119006FD021F8D46BD298C98D9009082A4FA73EF332204CBC7F1567CF00812FA8C9
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
Size 1KB
SHA256 8f2f4727270bda13bfcdffa7a6267a34d3afbc64d0a649fbe618f5f1c573286f
MD5 a39928dea9f01c56c4bba59ed213a601
SHA1 af5238c101088202cba0b5f40a51283593c08a52
SHA512 4bd3f560185bfb8e4e85a8586142bb9d1424aaec1ed288832ed8722b38213dc96055d6548bb5d5ac77e5d634ee7f6b627e58fe0464dfb4cc6232eb79efc12d8e
TLSH
T10A2196C82D813459E89BE6ECD8187915DD251323DEEC37F791A33D22939B1981B5C5C0
MD5 SHA1 SHA512 TLSH

Submit Download

Agentinstalllog.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
Size 1KB
SHA256 f1ee234fc00794f666790a5f4c545065928d215d9c5bacc56369903950813a66
MD5 4194e693660a87632361d622d616850d
SHA1 411e03e2a4589bfa205e493c8d48e284b0850421
SHA512 c79c34a2bce8a948f786910a70ec3a5c835d5c8ecc93c3f03dec42cfb4f0804ce3a484d0f18c423ba2e214a2c44641332f9989857a1faed22464447f847c68b1
TLSH
T14731E2605FE51829B1F3674BAFF3C4514A73FCE46879E74D23488319476BE0889A836E
MD5 SHA1 SHA512 TLSH

Submit Download

DCAgentServerInfo.json

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
Size 4KB
SHA256 89239487154bd62b659323b9fae940b5c893674ffa1352dd8238a69878d5fb80
MD5 6f7b601e41cc89fc414d301553fab918
SHA1 1e9f9a03b083880e859793f0e1d68a869204a36b
SHA512 62ed83b856e4a4d5904305ddf221cbd67b2b63dc83ff3b3bef1b32240fdf4f24277f68f2721ae5dab84d2d5b9c76ba38d8a3ba512cc41c24ddf971abcb69ce2d
SSDEEP 96:vH0mbue5AeOKYWSgC9TgLerRozc2ikdfZIjHH3elYPe82kD:vUwRAe7Yd2/zc2dDcHXe62ZO
TLSH
T1DCA119459B823DB98ACFC24CDD58B417083D03256B9A23628ABE7E55F4CF00403AF8B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetUP.VBS

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
Size 824B
SHA256 6053c83865de1fe0f527608a3cff4d1689bfebc4047d81187fb78e8dbbbbb74c
MD5 97b3de6696541abe6384970ae8c9901c
SHA1 01db6b9685d45b2dc410f01001ff928c12e34895
SHA512 6a26d774d5a141cf09bc5b0cb589a1452cc655c6fe5839e3c297089228f8c6fa50c99ed8ff4d5e296ef0fbb72857401d00fc515deecc0d928f10fe595f4d8527
TLSH
T1E5018901B43DC7328AB0239150022DDDDEA3431A240852E6B99D8CFECF9C4389A35211
MD5 SHA1 SHA512 TLSH

Submit Download

UEMSAgent.mst

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
Size 20KB
SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
MD5 0273976d2ecf588a5514b0f5069968e5
SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
TLSH
T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 bf1e5206b37ad1e99f6dceca010b7afa14ba792889c8136304bad35a6fb9f87d
MD5 2b97b700db7f7fe358f67b569a09be83
SHA1 9e309e6c42a5090284f1f6d8b65d5fb9106469ef
SHA512 32b90fa285de8669dacfa16b7f43327d3e57efed08f3dcce3f3751747b162f3e678415ffb35967290be8cb9bf95181b7862b6d6360ffc6298e686e932362028b
SSDEEP 48:FQ9AgrNDtlyV+m5mKMR83XAiYdR3rbIDbsRbscVMRTplqEEt45a/U:FQ93rhtlyEq3XAiYdR/usNsl3OKP
TLSH
T190A15545B7E88E24F27A9935BCF060E64266BC924C05EA5F3388730D1C73694E7B071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9948.tmp

Path C:\Windows\Installer\MSI9948.tmp
Size 429KB
SHA256 f78db8103f85debda13f93feafdb903823f8751640885492c6aeef938d7b09a6
MD5 6a6ead9b264363f887b5bfc0a61b2d64
SHA1 6cf6b43b3b2f1ad888612aa9c8bf6de9770c2c81
SHA512 53d351045fa87fa913bec53606a142a53caa37edfecfc010780fb97f9120a9c26f6f5c890a666fb6a0fd5efdf7657c8c608d4c793cb1161c940ea23e70be84f3
SSDEEP 12288:kpqSpvhUEaxBOJBesypR2wd/8Vyup7NTN:kJhUZxBOWsc1yFNh
TLSH
T15C94BF1135C9C031E1AE5170ADB5AF76AE7DBD200F2858CBD3C84D3B1A645C2AB76F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentlibxml2.dll

Path C:\Windows\SysWOW64\dcagentlibxml2.dll
Size 2.0MB
SHA256 fffcb7b3ea73b35ee4cbbe137f40b84fd6799f762cdb2a29f40b07c60cecdde2
MD5 53e10ebd6aefdd16e412074a5af40c50
SHA1 4bcf491358776ef08970a1c7bb61d3d1a4240a8e
SHA512 556a30d43897f17f99f84d250440f16e3e7c513ef08472fe2f5fc5da80a2cf62c13c600e12320ae648a28ff94cdae42069a30922d897298d8a2ff611a3c5ad6c
SSDEEP 49152:m1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQ9:AfOk4rwLBAUZLv9
TLSH
T12EA5BF04B980C532F4EB01F0CAFE5BFB982DCD26672554E767D578D889301E162BEB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Appraiser_Data.ini

Path C:\Windows\appcompat\appraiser\AltData\Appraiser_Data.ini
Size 150KB
SHA256 559885d43368ae6a6f4b7bc372f6155107fb6c6389dc256603a36e9cddbe0b95
MD5 1fb56a5bc86fd861823f04d9d9a89219
SHA1 9706f30146add89dc5b0fd096348f1a6a5e91e9c
SHA512 7e316332e3f5740cf1ad91d9a9495dafff5623d1954949b36f3af350c314e5c7d31afeb8e68a2d16eeb841b671195da6d8e7678ed7941c8b31d044f176edd44b
SSDEEP 768:aYhE+QUn6QoTIE8w8tYGvTsPXQF9R2TBToTbT999YbBjHgj9X4zaSWDmTQem6YEe:A09qHTOV0FoHQVryU6wSBn
TLSH
T1B4E35526390317B6750EA2B747B3E48036D002F54BD355FE3598A9CA7A1B24C25AFF4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Appraiser_AlternateData.cab

Path C:\Windows\appcompat\appraiser\Appraiser_AlternateData.cab
Size 1.9MB
SHA256 4e315add66a19480596cd559b1a83112becc4613a553bece5b65f5a8299f4ea6
MD5 912130224b58b27fec26b4d248ed7a27
SHA1 a8e0641ff6eb4aab67f93aac2139fc0439f20ea6
SHA512 4bcd4687ad2bc1b5b98dafd87cbca6f55b23c2a34903b3494c5284f74be30acfc59f7659f4f7a27c3a9ce93730b7a30282931852faaa25a11b18b934b5746bf4
SSDEEP 49152:EqVCa2KdItJbfJsyemIROmt5Qg5fJMUAWik08cXt3/IQpjzNGPq:EqMudIrbfJsyemIIxa1AWVYt3//t
TLSH
T122953330DE09C789D4FA5EE2C4A6538DF9477ED78634388D0BFAB1B942C9B8C564C261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1262955495.pri

Path C:\Windows\rescache\_merged\2118023660\1262955495.pri
Size 2KB
SHA256 f6f4c6ac3750138ba90518a8a910306bedf35abd47486100241027fde3a7ba8e
MD5 42036132242dabf3495a183ba0581ad0
SHA1 8f074152ef1253265aab9a0352b32867e6f9bda1
SHA512 c70c88e6529e52be19c27571db2bf68edd944ae55b9a10ffd3e20397e45833719d0fa1fbddedae5689364ec645b1dfd9b04b535e4ef4382349d7e5dc6cc86c36
TLSH
T19E517B46F3E82A12F6791B3954F79758B73DB9028B335B4E014462A51CB3BC0DE30EA2
MD5 SHA1 SHA512 TLSH

Submit Download

3288486290.pri

Path C:\Windows\rescache\_merged\3906713228\3288486290.pri
Size 167KB
SHA256 d2f3b8a7d9442d711bcfa1cf25c4b038ab8be2d01ba4c6e0fa34ff09147bc7b7
MD5 a985e910fec8b832a740249597c60ab6
SHA1 63f7c8c6acc8edff1ba20bf491f64a78bfacc875
SHA512 252d80bdac33f1d9022286a8076f1f702648f6489739a3d8a1450687dbe094302f2cf63e9dd72a84d0b398f5b005386742f9f714017c2ca5851a7ab0e65f1531
SSDEEP 3072:wWRvJeHZ9RU83RxBx47pV3NppKPcHuJijj:VlJeH3RU83B6dw6j
TLSH
T115F3DA1BE02D7A317D67BE1739E32BCBB39E4410CF7BB494A00491A258E71665FB6132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4232904637.pri

Path C:\Windows\rescache\_merged\4136552255\4232904637.pri
Size 6KB
SHA256 eb5e6e1d8a29cf99d4bd6808776e0b84e7104a521812a38cb927b174b0bb6ad5
MD5 58e92d51631f0c0fcaa99356878a7737
SHA1 107bd47d634e062c90ef4ecf7f6c93cba9919da3
SHA512 1c58f843faa3532b8cb24d5db928a01c180e4e1e63b02f7509e185d0e53238dbaaac63cbdd6f769375afce3ac0b9d646b4709b036fce3320ca04701604eda71f
SSDEEP 96:WJDtczwKEh4ouNMCYNu9wCdeIdgm+XmWnnSwa5Pscojd09LA:WJD+z0duNdYNu9wC4IiPHlajy
TLSH
T1D3D1DE03E1A8AE21FEAB9B3A54F75B9AB73E6141C73337189050B7A05CB21D09E715F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

670207856.pri

Path C:\Windows\rescache\_merged\4264460956\670207856.pri
Size 4KB
SHA256 b6c16b22cef5df81b77a9b16ee5cf51930362e3546c431574e313fa2497bb14d
MD5 9b854cb473c2f329cfbd0791bc9e0940
SHA1 0385fd5412c57ea1adfd5b6063e411d1a0802994
SHA512 f3247597e5c7a29a4f60068cd062d54fcd69ca3b2061f0d86d575ccb0b273bfa1e50aad083b869da8eb22bc8cda9a80e9929408b7d0a395615fcfe05e2e851a9
SSDEEP 48:WMKrRoTdqsmGJ7ChMPhvkRHyIfMf2u6+zzPudKzh5Ge0raMR6HT+eAQM1OpJIVui:Wprfe7C+hIHe66Cnv0HielCO6UgL9
TLSH
T1CB916577E6A49D02F26A0B3584F34705773C78825B2327CE418C62644CA37E0AFA1AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3636-4685-0x000001D8F3290000-0x000001D8F3291000-memory.dmp

Download

memory/4360-5024-0x0000000004590000-0x0000000004B4A000-memory.dmp

Download

memory/4360-5091-0x00000000056F0000-0x0000000005712000-memory.dmp

Download

memory/4360-5092-0x00000000057E0000-0x0000000005B3B000-memory.dmp

Download

memory/4360-5021-0x0000000000810000-0x000000000089C000-memory.dmp

Download

memory/4360-5089-0x0000000005740000-0x00000000057D4000-memory.dmp

Download

memory/4360-5041-0x0000000004B50000-0x0000000004BE2000-memory.dmp

Download

memory/4360-5032-0x0000000004080000-0x00000000040EE000-memory.dmp

Download

memory/4360-5047-0x0000000004CF0000-0x0000000004D56000-memory.dmp

Download

memory/5840-5201-0x0000000005A50000-0x0000000005DAB000-memory.dmp

Download