Overview
overview
8Static
static
1Optimizein...on.vbs
windows10-2004-x64
8Optimizein...on.vbs
windows11-ltsc_2024-x64
8README.html
windows10-2004-x64
3README.html
windows11-ltsc_2024-x64
3UEMSAgent.msi
windows10-2004-x64
7UEMSAgent.msi
windows11-ltsc_2024-x64
7setup.bat
windows10-2004-x64
3setup.bat
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
Optimizeinstallation.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
Optimizeinstallation.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
Behavioral task
behavioral3
Sample
README.html
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
README.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral5
Sample
UEMSAgent.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral6
Sample
UEMSAgent.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral7
Sample
setup.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
setup.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target Optimizeinstallation.vbs
- Size 9KB
- Sample260919-s8e8astvgt
- SHA256 c076f8e222e25225c68700e807d998a18da8d6cdec61686cdd13098b2641b681
- MD5 2ad9b66d959054f019a7058eb3bc4b65
- SHA1 9215d7a0a214de88e0fc89db919e5e89fafc4c89
- SHA512 aeb435073f793ced3df699327499c7858bde34f69cb00c184e09a3fe307699f572fc99babc618d41714924d8a87134e582cd5569639f949a884335fd52594647
- SSDEEP 192:uTuT9NjcUR18X3n0VHJkiLjJlLYNgAF21dhCz7ES1xa:vpZ9R18X3n0VHJki3JlLYNgAkhCz7EA4
- TLSH T16212020053ED1548B1F26A04EEB68119CB23BDA5A879DD0D45EC098E5BBB904DCF7F3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\SET52C5.tmp driversetup64.exe File created C:\Windows\system32\DRIVERS\SET52C5.tmp driversetup64.exe File opened for modification C:\Windows\system32\DRIVERS\DCFAFilter.sys driversetup64.exe File opened for modification C:\Windows\System32\drivers\SETA1CF.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETA1CF.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\MEARWFltDriver.sys DrvInst.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation WScript.exe - DCAgent remote management tool 3 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral1/files/0x000700000002451d-209.dat hacktool_dcagent behavioral1/files/0x0007000000024587-323.dat hacktool_dcagent behavioral1/files/0x00070000000245fe-573.dat hacktool_dcagent - Executes dropped EXE 64 IoCs
pid Process 4220 dcagentregister.exe 4576 7za.exe 5100 dcagentservice.exe 4884 dcpatchscan.exe 616 dcstatusutil.exe 1920 dcinventory.exe 1476 dcagentservice.exe 4352 dcusbsummary.exe 804 dcconfig.exe 3528 metroapps.exe 4216 dcusb64.exe 3848 dcstatusutil.exe 4516 dcondemand.exe 60 dcswmeter.exe 1720 dcinventory.exe 2820 7za.exe 2548 dcconfig.exe 2084 7za.exe 1660 dcinventory.exe 2152 7za.exe 3128 dcinventory.exe 4240 metroapps.exe 3172 dcuninstallsw.exe 4980 DCProcessMonitor.exe 4100 7za.exe 3244 dcwolsettings.exe 4340 dcondemand.exe 4988 dcagenttrayicon.exe 4028 dcagenttrayicon.exe 5772 dcondemand.exe 5960 7za.exe 6020 7za.exe 2200 7za.exe 5368 7za.exe 5472 7za.exe 5528 7za.exe 5344 7za.exe 5564 7za.exe 5640 meaap.exe 6032 meaap.exe 5168 meaaphelper.exe 628 7za.exe 3612 dcagenttrayicon.exe 5240 dcagenttrayicon.exe 5280 7za.exe 5592 uesAgentService.exe 5604 driversetup64.exe 3560 driversetup64.exe 5896 uesFaUser.exe 5948 uesDevCtrlSummary.exe 6088 devctrlaction64.exe 6128 dcagenttrayicon.exe 1084 dcagenttrayicon.exe 5372 meaaphelper.exe 5468 7za.exe 5348 7za.exe 3448 meaaphelper.exe 2956 7za.exe 5700 EDRDCManager.exe 6084 7za.exe 4428 MEARWSetup.exe 5676 MEARWZipUtil.exe 5796 TelemetryService.exe 2380 MEARWService.exe - Loads dropped DLL 64 IoCs
pid Process 1520 MsiExec.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 5100 dcagentservice.exe 5100 dcagentservice.exe 4884 dcpatchscan.exe 4884 dcpatchscan.exe 4884 dcpatchscan.exe 616 dcstatusutil.exe 616 dcstatusutil.exe 616 dcstatusutil.exe 1476 dcagentservice.exe 1920 dcinventory.exe 1920 dcinventory.exe 1476 dcagentservice.exe 4352 dcusbsummary.exe 4352 dcusbsummary.exe 804 dcconfig.exe 804 dcconfig.exe 3528 metroapps.exe 3528 metroapps.exe 3528 metroapps.exe 3528 metroapps.exe 804 dcconfig.exe 3848 dcstatusutil.exe 3848 dcstatusutil.exe 4516 dcondemand.exe 4516 dcondemand.exe 4516 dcondemand.exe 1720 dcinventory.exe 1720 dcinventory.exe 60 dcswmeter.exe 60 dcswmeter.exe 3848 dcstatusutil.exe 4516 dcondemand.exe 4516 dcondemand.exe 1920 dcinventory.exe 2548 dcconfig.exe 2548 dcconfig.exe 1660 dcinventory.exe 1660 dcinventory.exe 3128 dcinventory.exe 3128 dcinventory.exe 1660 dcinventory.exe 4240 metroapps.exe 4240 metroapps.exe 4240 metroapps.exe 2548 dcconfig.exe 3172 dcuninstallsw.exe 3172 dcuninstallsw.exe 3244 dcwolsettings.exe 4988 dcagenttrayicon.exe 4988 dcagenttrayicon.exe 4340 dcondemand.exe 4340 dcondemand.exe 4340 dcondemand.exe 4028 dcagenttrayicon.exe 4028 dcagenttrayicon.exe 4340 dcondemand.exe 4340 dcondemand.exe 5772 dcondemand.exe 5772 dcondemand.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 3144 msiexec.exe 7 3144 msiexec.exe 24 3144 msiexec.exe 26 3144 msiexec.exe 35 3144 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 3792 powercfg.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData dcagentregister.exe File created C:\Windows\System32\DriverStore\Temp\{9d82cbfb-e435-854e-b570-7006f6b2a97f}\SET9FBC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{209387e8-f4d0-4346-a58f-949c3cac5ca1}\SET5288.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mearwfltdriver.inf_amd64_33949fe404711eb9\MEARWFltDriver.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mearwfltdriver.inf_amd64_33949fe404711eb9\MEARWFltDriver.cat DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF dcinventory.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{209387e8-f4d0-4346-a58f-949c3cac5ca1}\SET5287.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{209387e8-f4d0-4346-a58f-949c3cac5ca1} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{9d82cbfb-e435-854e-b570-7006f6b2a97f}\SET9FCD.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 dcagentregister.exe File opened for modification C:\Windows\SysWOW64\logs\devicepatchaccess.log dcagentregister.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File created C:\Windows\System32\DriverStore\Temp\{209387e8-f4d0-4346-a58f-949c3cac5ca1}\SET5288.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{209387e8-f4d0-4346-a58f-949c3cac5ca1}\SET5277.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{209387e8-f4d0-4346-a58f-949c3cac5ca1}\SET5287.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{209387e8-f4d0-4346-a58f-949c3cac5ca1}\DCFAFilter.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9d82cbfb-e435-854e-b570-7006f6b2a97f}\MEARWFltDriver.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9d82cbfb-e435-854e-b570-7006f6b2a97f}\SET9FCC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{9d82cbfb-e435-854e-b570-7006f6b2a97f}\SET9FCC.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mearwfltdriver.inf_amd64_33949fe404711eb9\MEARWFltDriver.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9d82cbfb-e435-854e-b570-7006f6b2a97f} DrvInst.exe File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 dcagentregister.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9d82cbfb-e435-854e-b570-7006f6b2a97f}\MEARWFltDriver.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9d82cbfb-e435-854e-b570-7006f6b2a97f}\SET9FCD.tmp DrvInst.exe File created C:\Windows\SysWOW64\dcagenthttp.dll msiexec.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{209387e8-f4d0-4346-a58f-949c3cac5ca1}\DCFAFilter.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9d82cbfb-e435-854e-b570-7006f6b2a97f}\SET9FBC.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9d82cbfb-e435-854e-b570-7006f6b2a97f}\MEARWFltDriver.sys DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{209387e8-f4d0-4346-a58f-949c3cac5ca1}\SET5277.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{209387e8-f4d0-4346-a58f-949c3cac5ca1}\DCFAFilter.cat DrvInst.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 2952 WScript.exe 752 cscript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfservicedll.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcuninstallsw.log dcuninstallsw.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz2344.tmp dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\3\uesDeviceNotificationAlert.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaphelper.log meaaphelper.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\CollectionLog.log EDRDCManager.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\folder_backup.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentremofficehistory.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcfilteraccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json meaap.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwolsettings.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\DCAgentUpgraderAccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\Updates\oldinstaller.msi dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\addons-resources.json meaap.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe MEARWZipUtil.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Internal\Bin\ConfigFiles\edr_events.clp MEARWSetup.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentservice.log dcagentservice.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEEDREventLogResource.dll MEARWZipUtil.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\NativeUIHandler.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\3\uesAgentTrayIcon.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win7\DCFAFilter.sys 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\VssHelper.exe MEARWZipUtil.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Find.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\SecureDCProcess.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UIControls.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_computer.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\FullScan.json dcinventory.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\hostondemandaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz2344.tmp dcpatchscan.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\4\BitlockerMgmt.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\edrComponent.zip6104.tmp meaap.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcmisconfigaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win7\dcfafilter.cat 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\onnxruntime.dll MEARWZipUtil.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\DisableEnableEthernet.vbs msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\secaddoncrashanalyser.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml4840.tmp dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\UserAssignmentRules.json dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\3\Newtonsoft.Json.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\server-applications.xml dcpatchscan.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\4\uesAgentTrayIcon.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win8\DCFAFilter.sys 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\Logs\EDRDCLogger.log EDRDCManager.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\dclibxml2.dll MEARWZipUtil.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rdsrunasuser.exe.config 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmsghandler.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcscreenrec.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-security-setting.json dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win8.1\DCFAFilter.sys 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x86\Win10\DCFAFilter.sys 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\ConfigFiles\commonfile.txt MEARWZipUtil.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\WebrtcDLL.dll msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\TMF\c43811e3-df39-362d-6475-e12b8896e803.tmf MEARWZipUtil.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\win8\SerMonDriver.sys MEARWSetup.exe - Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e58bc86.mst msiexec.exe File created C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File opened for modification C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File opened for modification C:\Windows\INF\setupapi.dev.log MEARWSetup.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\e58bc85.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIFB72.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File opened for modification C:\Windows\INF\setupapi.dev.log driversetup64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIFFA9.tmp msiexec.exe File created C:\Windows\Installer\e58bc8d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5FDB.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\e58bc85.msi msiexec.exe File created C:\Windows\Installer\e58bc86.mst msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3420 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 7 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD0DA5A8CEC718F86828A364176406CBBAF037A5\Blob = 030000000100000014000000ad0da5a8cec718f86828a364176406cbbaf037a52000000001000000af030000308203ab30820293a00302010202085343aaf4dd762e54300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303831363131323935375a180f32313236303831363131323935375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a02820101009c09a80089a6ef3ff394af9778d5db95de7eff5954b1f9e230158a93662d3921ee52123f5031ca17c3054e3e8c87799a163780611f058ef571eb205fc84dc95b1e19cd38f0f2eac5bfed997eeb21eab4a8ff5c20ecbe69fc47989a8d45264b1600dd9fa2b5f12cbc996a4c99ce850d3af04f285c55ce9e9bc9372b23e59c21a10a8ada55a17cf0ae1fcbc01bea02b89b96da583aa7ba5cfd46b52e6025b64210693f30e2566aca61444c392b8cd9505dd07f22e341b08d60abe7d8779fbda6a0b9c4741ebcbac6a92d4de51ed5f28c82a4f5b2e2979e8d502d40c5570711ea26e01bf9a2f13e940b9d5aacd1d9de7624e78db0606e310f6f63f60242a0be57d90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e5e84ae6a1360fa0da5e4fc1714208b9122eecae301f0603551d23041830168014e5e84ae6a1360fa0da5e4fc1714208b9122eecae300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101006b2d7cbbdacbbb6cb42d7b35354247bb5a579615b27b44e9a9d8cad1c2e4384383524974728fe1003c939bec9a97608cafc40527d4f2338df862c807e4be7c38164ff7e233724a5a6b82f6d1c977024fa5853a5ef60b8c0ab0fc4f9e7efb2a5217a74190c173e9960a64c3bc9db8eabcaea6cde8c6000f2becfb6d3e1e1dcbea28785bcccfed433909c8a875cb4531a682cd84fdeb233af43279aa1ec00a0b4afd0dcd61fcc8255b7c03ea6695c4d7f9a9cbac885c24ad006b49069b77d96b798b824bfb9ebc567167954a2e7f16fc95cd60ed545581296d526c97029d0c52efb44e71ee2b50d889faca919ef2b3273e0358129b2f9c2686d5c56b711712c5b9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\29FE5E4CEC8245582050F5150CA9A540A8970097\Blob = 03000000010000001400000029fe5e4cec8245582050f5150ca9a540a8970097200000000100000029040000308204253082030da0030201020208028ba47a847f49b3300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303831363131333434315a180f32313236303831363131333434315a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b3a6b3d9d16fb8e56a33c062e8839b19788f5c98ac3e673954a5a46b47aae4d7e33d6cfb4cdbe03ecd64732f69530c535a514698c5d306ba0bf7d4b6963c9eb7cd1ce2880987646f77f53d16de147affdc7588f99af1e2324f6aa7e1b33e05cbde8420dc3fe01feb0b4afa180c740c7cebcbe7bf26a4b009333b871102eb78012d6eb16a8eb6ff3647f708f93420f38216e1aa38a17c9dbedfed248f99cd6de242b9cc9a0aec7b0e8db1e2a41d6b8652fbdf751b51c6ea19cf7ac451809bfb87ec77d2c3cd75153b737aa7067f0302f0d82a6605e32150ae9db5f3d9c8eea3d334f3cf158bed7a92d52860c76388b978acedf2d572d21ed6168df6edd1ce6b690203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414710f330dd38342d252e0ed29ca8f325e8c14eabd301f0603551d23041830168014710f330dd38342d252e0ed29ca8f325e8c14eabd300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101006710351f344bd2bc7d1a7f346c6d8b2489baee08e821b30d09e3bc32735041bdd2781d32bdb0bb135799a9609ff23120e1a2e52537b93dad0928e4f3d70d34deb1f887363dc8b4aeb0f35295645ce51a185ba0b02ba4180288c4727c2ed2b371892b2c34f52d9df9b94c6fee6e975dac04037f7d91ebea93632773ace6cdf59a72977bfc82a551aa0944f1ebd6b57b69466094c54feb845faeb2031c79dce7c773f00d2200b7aba9ed5b264b6898ac5b61524b81afdcde15aa016b067f9cee0d67118ff39cfe529a9d3e85d686ce01f35cb384b8c49318c5c0563c8a600ecbabf93f998e1e04d66fe9989a78a9e12034e0d32cd0aa082d433190e00fb4da8376 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD0DA5A8CEC718F86828A364176406CBBAF037A5\Blob = 140000000100000014000000e5e84ae6a1360fa0da5e4fc1714208b9122eecae030000000100000014000000ad0da5a8cec718f86828a364176406cbbaf037a50f0000000100000020000000b9c47eeb0019ca312d4783173c5ae9bdbf284a484fcf5f0976c53d8aa39189152000000001000000af030000308203ab30820293a00302010202085343aaf4dd762e54300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303831363131323935375a180f32313236303831363131323935375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a02820101009c09a80089a6ef3ff394af9778d5db95de7eff5954b1f9e230158a93662d3921ee52123f5031ca17c3054e3e8c87799a163780611f058ef571eb205fc84dc95b1e19cd38f0f2eac5bfed997eeb21eab4a8ff5c20ecbe69fc47989a8d45264b1600dd9fa2b5f12cbc996a4c99ce850d3af04f285c55ce9e9bc9372b23e59c21a10a8ada55a17cf0ae1fcbc01bea02b89b96da583aa7ba5cfd46b52e6025b64210693f30e2566aca61444c392b8cd9505dd07f22e341b08d60abe7d8779fbda6a0b9c4741ebcbac6a92d4de51ed5f28c82a4f5b2e2979e8d502d40c5570711ea26e01bf9a2f13e940b9d5aacd1d9de7624e78db0606e310f6f63f60242a0be57d90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e5e84ae6a1360fa0da5e4fc1714208b9122eecae301f0603551d23041830168014e5e84ae6a1360fa0da5e4fc1714208b9122eecae300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101006b2d7cbbdacbbb6cb42d7b35354247bb5a579615b27b44e9a9d8cad1c2e4384383524974728fe1003c939bec9a97608cafc40527d4f2338df862c807e4be7c38164ff7e233724a5a6b82f6d1c977024fa5853a5ef60b8c0ab0fc4f9e7efb2a5217a74190c173e9960a64c3bc9db8eabcaea6cde8c6000f2becfb6d3e1e1dcbea28785bcccfed433909c8a875cb4531a682cd84fdeb233af43279aa1ec00a0b4afd0dcd61fcc8255b7c03ea6695c4d7f9a9cbac885c24ad006b49069b77d96b798b824bfb9ebc567167954a2e7f16fc95cd60ed545581296d526c97029d0c52efb44e71ee2b50d889faca919ef2b3273e0358129b2f9c2686d5c56b711712c5b9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD0DA5A8CEC718F86828A364176406CBBAF037A5\Blob = 040000000100000010000000cab13c3182a2c0fc21afb47e48dbe9190f0000000100000020000000b9c47eeb0019ca312d4783173c5ae9bdbf284a484fcf5f0976c53d8aa3918915030000000100000014000000ad0da5a8cec718f86828a364176406cbbaf037a5140000000100000014000000e5e84ae6a1360fa0da5e4fc1714208b9122eecae2000000001000000af030000308203ab30820293a00302010202085343aaf4dd762e54300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303831363131323935375a180f32313236303831363131323935375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a02820101009c09a80089a6ef3ff394af9778d5db95de7eff5954b1f9e230158a93662d3921ee52123f5031ca17c3054e3e8c87799a163780611f058ef571eb205fc84dc95b1e19cd38f0f2eac5bfed997eeb21eab4a8ff5c20ecbe69fc47989a8d45264b1600dd9fa2b5f12cbc996a4c99ce850d3af04f285c55ce9e9bc9372b23e59c21a10a8ada55a17cf0ae1fcbc01bea02b89b96da583aa7ba5cfd46b52e6025b64210693f30e2566aca61444c392b8cd9505dd07f22e341b08d60abe7d8779fbda6a0b9c4741ebcbac6a92d4de51ed5f28c82a4f5b2e2979e8d502d40c5570711ea26e01bf9a2f13e940b9d5aacd1d9de7624e78db0606e310f6f63f60242a0be57d90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e5e84ae6a1360fa0da5e4fc1714208b9122eecae301f0603551d23041830168014e5e84ae6a1360fa0da5e4fc1714208b9122eecae300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101006b2d7cbbdacbbb6cb42d7b35354247bb5a579615b27b44e9a9d8cad1c2e4384383524974728fe1003c939bec9a97608cafc40527d4f2338df862c807e4be7c38164ff7e233724a5a6b82f6d1c977024fa5853a5ef60b8c0ab0fc4f9e7efb2a5217a74190c173e9960a64c3bc9db8eabcaea6cde8c6000f2becfb6d3e1e1dcbea28785bcccfed433909c8a875cb4531a682cd84fdeb233af43279aa1ec00a0b4afd0dcd61fcc8255b7c03ea6695c4d7f9a9cbac885c24ad006b49069b77d96b798b824bfb9ebc567167954a2e7f16fc95cd60ed545581296d526c97029d0c52efb44e71ee2b50d889faca919ef2b3273e0358129b2f9c2686d5c56b711712c5b9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD0DA5A8CEC718F86828A364176406CBBAF037A5\Blob = 1900000001000000100000004f01908c8575fedad2d34f1801e23543140000000100000014000000e5e84ae6a1360fa0da5e4fc1714208b9122eecae030000000100000014000000ad0da5a8cec718f86828a364176406cbbaf037a50f0000000100000020000000b9c47eeb0019ca312d4783173c5ae9bdbf284a484fcf5f0976c53d8aa3918915040000000100000010000000cab13c3182a2c0fc21afb47e48dbe9192000000001000000af030000308203ab30820293a00302010202085343aaf4dd762e54300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303831363131323935375a180f32313236303831363131323935375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a02820101009c09a80089a6ef3ff394af9778d5db95de7eff5954b1f9e230158a93662d3921ee52123f5031ca17c3054e3e8c87799a163780611f058ef571eb205fc84dc95b1e19cd38f0f2eac5bfed997eeb21eab4a8ff5c20ecbe69fc47989a8d45264b1600dd9fa2b5f12cbc996a4c99ce850d3af04f285c55ce9e9bc9372b23e59c21a10a8ada55a17cf0ae1fcbc01bea02b89b96da583aa7ba5cfd46b52e6025b64210693f30e2566aca61444c392b8cd9505dd07f22e341b08d60abe7d8779fbda6a0b9c4741ebcbac6a92d4de51ed5f28c82a4f5b2e2979e8d502d40c5570711ea26e01bf9a2f13e940b9d5aacd1d9de7624e78db0606e310f6f63f60242a0be57d90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e5e84ae6a1360fa0da5e4fc1714208b9122eecae301f0603551d23041830168014e5e84ae6a1360fa0da5e4fc1714208b9122eecae300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101006b2d7cbbdacbbb6cb42d7b35354247bb5a579615b27b44e9a9d8cad1c2e4384383524974728fe1003c939bec9a97608cafc40527d4f2338df862c807e4be7c38164ff7e233724a5a6b82f6d1c977024fa5853a5ef60b8c0ab0fc4f9e7efb2a5217a74190c173e9960a64c3bc9db8eabcaea6cde8c6000f2becfb6d3e1e1dcbea28785bcccfed433909c8a875cb4531a682cd84fdeb233af43279aa1ec00a0b4afd0dcd61fcc8255b7c03ea6695c4d7f9a9cbac885c24ad006b49069b77d96b798b824bfb9ebc567167954a2e7f16fc95cd60ed545581296d526c97029d0c52efb44e71ee2b50d889faca919ef2b3273e0358129b2f9c2686d5c56b711712c5b9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD0DA5A8CEC718F86828A364176406CBBAF037A5\Blob = 5c000000010000000400000000080000040000000100000010000000cab13c3182a2c0fc21afb47e48dbe9190f0000000100000020000000b9c47eeb0019ca312d4783173c5ae9bdbf284a484fcf5f0976c53d8aa3918915030000000100000014000000ad0da5a8cec718f86828a364176406cbbaf037a5140000000100000014000000e5e84ae6a1360fa0da5e4fc1714208b9122eecae1900000001000000100000004f01908c8575fedad2d34f1801e235432000000001000000af030000308203ab30820293a00302010202085343aaf4dd762e54300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303831363131323935375a180f32313236303831363131323935375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a02820101009c09a80089a6ef3ff394af9778d5db95de7eff5954b1f9e230158a93662d3921ee52123f5031ca17c3054e3e8c87799a163780611f058ef571eb205fc84dc95b1e19cd38f0f2eac5bfed997eeb21eab4a8ff5c20ecbe69fc47989a8d45264b1600dd9fa2b5f12cbc996a4c99ce850d3af04f285c55ce9e9bc9372b23e59c21a10a8ada55a17cf0ae1fcbc01bea02b89b96da583aa7ba5cfd46b52e6025b64210693f30e2566aca61444c392b8cd9505dd07f22e341b08d60abe7d8779fbda6a0b9c4741ebcbac6a92d4de51ed5f28c82a4f5b2e2979e8d502d40c5570711ea26e01bf9a2f13e940b9d5aacd1d9de7624e78db0606e310f6f63f60242a0be57d90203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e5e84ae6a1360fa0da5e4fc1714208b9122eecae301f0603551d23041830168014e5e84ae6a1360fa0da5e4fc1714208b9122eecae300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101006b2d7cbbdacbbb6cb42d7b35354247bb5a579615b27b44e9a9d8cad1c2e4384383524974728fe1003c939bec9a97608cafc40527d4f2338df862c807e4be7c38164ff7e233724a5a6b82f6d1c977024fa5853a5ef60b8c0ab0fc4f9e7efb2a5217a74190c173e9960a64c3bc9db8eabcaea6cde8c6000f2becfb6d3e1e1dcbea28785bcccfed433909c8a875cb4531a682cd84fdeb233af43279aa1ec00a0b4afd0dcd61fcc8255b7c03ea6695c4d7f9a9cbac885c24ad006b49069b77d96b798b824bfb9ebc567167954a2e7f16fc95cd60ed545581296d526c97029d0c52efb44e71ee2b50d889faca919ef2b3273e0358129b2f9c2686d5c56b711712c5b9 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\29FE5E4CEC8245582050F5150CA9A540A8970097\Blob = 190000000100000010000000f2c6ce1261a7d1ddf79edff19f6c227603000000010000001400000029fe5e4cec8245582050f5150ca9a540a89700970f0000000100000020000000aa3b1e49ef8551270f55a45f2bd5c73bc5726fc9df928aee9916a3457a0f0ed7200000000100000029040000308204253082030da0030201020208028ba47a847f49b3300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303831363131333434315a180f32313236303831363131333434315a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b3a6b3d9d16fb8e56a33c062e8839b19788f5c98ac3e673954a5a46b47aae4d7e33d6cfb4cdbe03ecd64732f69530c535a514698c5d306ba0bf7d4b6963c9eb7cd1ce2880987646f77f53d16de147affdc7588f99af1e2324f6aa7e1b33e05cbde8420dc3fe01feb0b4afa180c740c7cebcbe7bf26a4b009333b871102eb78012d6eb16a8eb6ff3647f708f93420f38216e1aa38a17c9dbedfed248f99cd6de242b9cc9a0aec7b0e8db1e2a41d6b8652fbdf751b51c6ea19cf7ac451809bfb87ec77d2c3cd75153b737aa7067f0302f0d82a6605e32150ae9db5f3d9c8eea3d334f3cf158bed7a92d52860c76388b978acedf2d572d21ed6168df6edd1ce6b690203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414710f330dd38342d252e0ed29ca8f325e8c14eabd301f0603551d23041830168014710f330dd38342d252e0ed29ca8f325e8c14eabd300b0603551d0f0404030201a6300d06092a864886f70d01010b050003820101006710351f344bd2bc7d1a7f346c6d8b2489baee08e821b30d09e3bc32735041bdd2781d32bdb0bb135799a9609ff23120e1a2e52537b93dad0928e4f3d70d34deb1f887363dc8b4aeb0f35295645ce51a185ba0b02ba4180288c4727c2ed2b371892b2c34f52d9df9b94c6fee6e975dac04037f7d91ebea93632773ace6cdf59a72977bfc82a551aa0944f1ebd6b57b69466094c54feb845faeb2031c79dce7c773f00d2200b7aba9ed5b264b6898ac5b61524b81afdcde15aa016b067f9cee0d67118ff39cfe529a9d3e85d686ce01f35cb384b8c49318c5c0563c8a600ecbabf93f998e1e04d66fe9989a78a9e12034e0d32cd0aa082d433190e00fb4da8376 dcagentregister.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uesDevCtrlSummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language metroapps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language metroapps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcpatchscan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcuninstallsw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaaphelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcuninstallsw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCProcessMonitor.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002 powercfg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0003 powercfg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc powercfg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags uesFaUser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0002 powercfg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom uesFaUser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags devctrlaction64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0003 powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags devctrlaction64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 uesFaUser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 uesFaUser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc devctrlaction64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0100 powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0020 powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 powercfg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0020 powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002 powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 uesFaUser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0020 powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0100 powercfg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002 powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 uesAgentService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 powercfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 powercfg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID powercfg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc uesAgentService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom devctrlaction64.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MEARWService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MEARWService.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4420 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion MEARWSetup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs EDRDCManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs EDRDCManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs EDRDCManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates EDRDCManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcpatchscan.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4a450ec0e\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1 = "Snip & Sketch" metroapps.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace492361004\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331 = "Get Help" metroapps.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcondemand.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace475a1c57b\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.202 = "Weather" metroapps.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs meaap.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates EDRDCManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4dcd9f954\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0 = "Paint 3D" metroapps.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe%5Cresources.pri metroapps.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe - Modifies registry class 23 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "44C40189C3AA44442AA780ED114A0026" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "167772210" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD0DA5A8CEC718F86828A364176406CBBAF037A5 dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\29FE5E4CEC8245582050F5150CA9A540A8970097 dcagentregister.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe 4220 dcagentregister.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 920 MEARWService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3128 msiexec.exe Token: SeIncreaseQuotaPrivilege 3128 msiexec.exe Token: SeSecurityPrivilege 3144 msiexec.exe Token: SeCreateTokenPrivilege 3128 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3128 msiexec.exe Token: SeLockMemoryPrivilege 3128 msiexec.exe Token: SeIncreaseQuotaPrivilege 3128 msiexec.exe Token: SeMachineAccountPrivilege 3128 msiexec.exe Token: SeTcbPrivilege 3128 msiexec.exe Token: SeSecurityPrivilege 3128 msiexec.exe Token: SeTakeOwnershipPrivilege 3128 msiexec.exe Token: SeLoadDriverPrivilege 3128 msiexec.exe Token: SeSystemProfilePrivilege 3128 msiexec.exe Token: SeSystemtimePrivilege 3128 msiexec.exe Token: SeProfSingleProcessPrivilege 3128 msiexec.exe Token: SeIncBasePriorityPrivilege 3128 msiexec.exe Token: SeCreatePagefilePrivilege 3128 msiexec.exe Token: SeCreatePermanentPrivilege 3128 msiexec.exe Token: SeBackupPrivilege 3128 msiexec.exe Token: SeRestorePrivilege 3128 msiexec.exe Token: SeShutdownPrivilege 3128 msiexec.exe Token: SeDebugPrivilege 3128 msiexec.exe Token: SeAuditPrivilege 3128 msiexec.exe Token: SeSystemEnvironmentPrivilege 3128 msiexec.exe Token: SeChangeNotifyPrivilege 3128 msiexec.exe Token: SeRemoteShutdownPrivilege 3128 msiexec.exe Token: SeUndockPrivilege 3128 msiexec.exe Token: SeSyncAgentPrivilege 3128 msiexec.exe Token: SeEnableDelegationPrivilege 3128 msiexec.exe Token: SeManageVolumePrivilege 3128 msiexec.exe Token: SeImpersonatePrivilege 3128 msiexec.exe Token: SeCreateGlobalPrivilege 3128 msiexec.exe Token: SeRestorePrivilege 3144 msiexec.exe Token: SeTakeOwnershipPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 3144 msiexec.exe Token: SeTakeOwnershipPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 3144 msiexec.exe Token: SeTakeOwnershipPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 3144 msiexec.exe Token: SeTakeOwnershipPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 3144 msiexec.exe Token: SeTakeOwnershipPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 3144 msiexec.exe Token: SeTakeOwnershipPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 3144 msiexec.exe Token: SeTakeOwnershipPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 4576 7za.exe Token: 35 4576 7za.exe Token: SeSecurityPrivilege 4576 7za.exe Token: SeSecurityPrivilege 4576 7za.exe Token: SeDebugPrivilege 4352 dcusbsummary.exe Token: SeDebugPrivilege 60 dcswmeter.exe Token: SeRestorePrivilege 2820 7za.exe Token: 35 2820 7za.exe Token: SeSecurityPrivilege 2820 7za.exe Token: SeSecurityPrivilege 2820 7za.exe Token: SeRestorePrivilege 3144 msiexec.exe Token: SeTakeOwnershipPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 3144 msiexec.exe Token: SeTakeOwnershipPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 3144 msiexec.exe Token: SeTakeOwnershipPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 3144 msiexec.exe Token: SeTakeOwnershipPrivilege 3144 msiexec.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 5240 dcagenttrayicon.exe 5240 dcagenttrayicon.exe 1084 dcagenttrayicon.exe 1084 dcagenttrayicon.exe 2676 dcagenttrayicon.exe 2676 dcagenttrayicon.exe - Suspicious use of SendNotifyMessage 6 IoCs
pid Process 5240 dcagenttrayicon.exe 5240 dcagenttrayicon.exe 1084 dcagenttrayicon.exe 1084 dcagenttrayicon.exe 2676 dcagenttrayicon.exe 2676 dcagenttrayicon.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4352 dcusbsummary.exe 3172 dcuninstallsw.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2952 wrote to memory of 3128 2952 WScript.exe 87 PID 3144 wrote to memory of 1520 3144 msiexec.exe 98 PID 3144 wrote to memory of 4220 3144 msiexec.exe 100 PID 4220 wrote to memory of 4576 4220 dcagentregister.exe 104 PID 4220 wrote to memory of 4884 4220 dcagentregister.exe 109 PID 4220 wrote to memory of 3420 4220 dcagentregister.exe 110 PID 3420 wrote to memory of 4420 3420 cmd.exe 113 PID 4220 wrote to memory of 616 4220 dcagentregister.exe 117 PID 4220 wrote to memory of 1920 4220 dcagentregister.exe 119 PID 1476 wrote to memory of 4352 1476 dcagentservice.exe 122 PID 1476 wrote to memory of 804 1476 dcagentservice.exe 123 PID 1920 wrote to memory of 3528 1920 dcinventory.exe 125 PID 4352 wrote to memory of 4216 4352 dcusbsummary.exe 126 PID 1476 wrote to memory of 3848 1476 dcagentservice.exe 128 PID 1476 wrote to memory of 4516 1476 dcagentservice.exe 130 PID 1476 wrote to memory of 60 1476 dcagentservice.exe 131 PID 1476 wrote to memory of 1720 1476 dcagentservice.exe 134 PID 4884 wrote to memory of 2820 4884 dcpatchscan.exe 136 PID 1476 wrote to memory of 2548 1476 dcagentservice.exe 139 PID 4884 wrote to memory of 2084 4884 dcpatchscan.exe 141 PID 2548 wrote to memory of 1660 2548 dcconfig.exe 143 PID 4884 wrote to memory of 2152 4884 dcpatchscan.exe 146 PID 1476 wrote to memory of 3128 1476 dcagentservice.exe 148 PID 3128 wrote to memory of 4240 3128 dcinventory.exe 150 PID 3128 wrote to memory of 3172 3128 dcinventory.exe 151 PID 1476 wrote to memory of 4980 1476 dcagentservice.exe 152 PID 4884 wrote to memory of 4100 4884 dcpatchscan.exe 156 PID 2548 wrote to memory of 3244 2548 dcconfig.exe 162 PID 2548 wrote to memory of 752 2548 dcconfig.exe 163 PID 752 wrote to memory of 3792 752 cscript.exe 166 PID 1476 wrote to memory of 4340 1476 dcagentservice.exe 168 PID 2548 wrote to memory of 4988 2548 dcconfig.exe 169 PID 2548 wrote to memory of 4028 2548 dcconfig.exe 171 PID 1476 wrote to memory of 5772 1476 dcagentservice.exe 178 PID 2548 wrote to memory of 5960 2548 dcconfig.exe 181 PID 4884 wrote to memory of 6020 4884 dcpatchscan.exe 183 PID 4884 wrote to memory of 2200 4884 dcpatchscan.exe 185 PID 2548 wrote to memory of 5368 2548 dcconfig.exe 187 PID 2548 wrote to memory of 5472 2548 dcconfig.exe 189 PID 2548 wrote to memory of 5528 2548 dcconfig.exe 191 PID 2548 wrote to memory of 5344 2548 dcconfig.exe 193 PID 2548 wrote to memory of 5564 2548 dcconfig.exe 195 PID 4884 wrote to memory of 5640 4884 dcpatchscan.exe 197 PID 2548 wrote to memory of 6032 2548 dcconfig.exe 199 PID 6032 wrote to memory of 5168 6032 meaap.exe 201 PID 5168 wrote to memory of 628 5168 meaaphelper.exe 203 PID 5168 wrote to memory of 3612 5168 meaaphelper.exe 205 PID 5168 wrote to memory of 5240 5168 meaaphelper.exe 206 PID 5168 wrote to memory of 5280 5168 meaaphelper.exe 207 PID 5592 wrote to memory of 5604 5592 uesAgentService.exe 210 PID 5712 wrote to memory of 5748 5712 svchost.exe 213 PID 5592 wrote to memory of 3560 5592 uesAgentService.exe 214 PID 5592 wrote to memory of 5896 5592 uesAgentService.exe 216 PID 5592 wrote to memory of 5948 5592 uesAgentService.exe 218 PID 5948 wrote to memory of 6088 5948 uesDevCtrlSummary.exe 221 PID 5168 wrote to memory of 6128 5168 meaaphelper.exe 224 PID 5168 wrote to memory of 1084 5168 meaaphelper.exe 225 PID 6032 wrote to memory of 5372 6032 meaap.exe 226 PID 5372 wrote to memory of 5468 5372 meaaphelper.exe 228 PID 5372 wrote to memory of 5348 5372 meaaphelper.exe 230 PID 6032 wrote to memory of 3448 6032 meaap.exe 233 PID 3448 wrote to memory of 2956 3448 meaaphelper.exe 235 PID 3448 wrote to memory of 5700 3448 meaaphelper.exe 237 PID 5700 wrote to memory of 6084 5700 EDRDCManager.exe 239
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Optimizeinstallation.vbs"1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt" /quiet /norestart /lv "C:\Users\Admin\AppData\Local\Temp\AgentInstall.log"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3128
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 288FDA2871E9FDA15F142A246CD468E12⤵
- Loads dropped DLL
PID:1520
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exebin\dcpatchscan.exe -y 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2084
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2152
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4100
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll4⤵
- Executes dropped EXE
PID:6020
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2200
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad24⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5640
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe4⤵
- System Location Discovery: System Language Discovery
- Gathers system information
PID:4420
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:616
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exemetroapps.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3528
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5100
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4216
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:804
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3848
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:4516
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:60
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1720
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -p processor compatibility3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1660
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwolsettings.exebin\dcwolsettings.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3244
-
-
C:\Windows\SysWOW64\cscript.exeC:\Windows\system32\cscript.exe DisableEnableEthernet.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\powercfg.exepowercfg -devicequery wake_from_any4⤵
- Power Settings
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:3792
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4988
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -s3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:4028
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5960
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll3⤵
- Executes dropped EXE
PID:5368
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5472
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5528
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5344
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5564
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" bin\dccomponentregister.dll5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:628
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3612
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5240
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5280
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6128
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1084
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 24⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" bin\dccomponentregister.dll5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5468
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5348
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 425cc09c-d116-4ff1-a6f4-52ff663926f6 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\edrComponent.zip" -c edr_win_neutral -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EDR-metadata.json" -a 14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\edrComponent.zip"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2956
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\bin\EDRDCManager.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\EDR\\bin\\EDRDCManager.exe" -installorupdate5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "Standalone.zip"6⤵
- Executes dropped EXE
PID:6084
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\bin\MEARWSetup.exeMEARWSetup.exe -install mearwconf.json6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4428 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\MEARWZipUtil.exex "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\MEARWBundle.7z"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5676
-
-
C:\Windows\SYSTEM32\wevtutil.exewevtutil.exe im EDR.man /rf:"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEEDREventLogResource.dll" /mf:"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEEDREventLogResource.dll"7⤵PID:2088
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 04⤵
- System Location Discovery: System Language Discovery
PID:5324 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe-c 45⤵
- Checks SCSI registry key(s)
PID:5308 -
C:\Windows\system32\gpupdate.exeC:\Windows\system32\gpupdate.exe /Target:Computer /Force6⤵PID:5400
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:732
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2676
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 04⤵
- System Location Discovery: System Language Discovery
PID:3864
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 425cc09c-d116-4ff1-a6f4-52ff663926f6 -c edr_win_neutral -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EDR-metadata.json" -e enabled -a 34⤵
- System Location Discovery: System Language Discovery
PID:5840
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r3⤵
- Drops file in System32 directory
PID:4916
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -s3⤵
- Drops file in System32 directory
PID:6000
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s postnotify SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ SYSTEM 0 12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exemetroapps.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4240
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuninstallsw.exebin\dcuninstallsw.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3172
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4980
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4340
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5772
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3724
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:4004
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -install "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driver\x64\Win10\DCFAFilter.inf"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
PID:5604
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -start2⤵
- Executes dropped EXE
PID:3560
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesFaUser.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\uesFaUser.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5896
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe-s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe-c 93⤵
- Executes dropped EXE
PID:6088
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -stop2⤵PID:5496
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Windows\TEMP\{735bb925-e098-dd42-a7a6-299eaea9dd7c}\DCFAFilter.inf" "9" "4ca28cc43" "0000000000000148" "Service-0x0-3e7$\Default" "0000000000000158" "208" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driver\x64\Win10"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:5748
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Windows\TEMP\{2934c35d-5f9e-7f45-b706-aed11fc8e211}\MEARWFltDriver.inf" "9" "494795b4b" "0000000000000148" "Service-0x0-3e7$\Default" "000000000000015C" "208" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\win10"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2956
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\mearwfltdriver.inf_amd64_33949fe404711eb9\mearwfltdriver.inf" "0" "494795b4b" "0000000000000174" "Service-0x0-3e7$\Default"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
PID:3852
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\TelemetryService.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\Telemetryservice.exe"1⤵
- Executes dropped EXE
PID:5796
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe"1⤵
- Executes dropped EXE
PID:2380
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\EXE\MEARWService.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: LoadsDriver
PID:920
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58bc89.rbs
- Size 58KB
- SHA256 57d81cf2db0ed019ab8ec9e3b7431c12c9179d1d7ae577e418ae6f173cd556fe
- MD5 9423e51f7ff522eaa1aa856df6d4fa02
- SHA1 729722aa9b145a3ce19c2d0c4747082542b7ec5b
- SHA512 ff420135906dc3dcf49323aa5875574576b91bb74fcfe8a7f591706bcef41e521333b4db6b5b4ef19662c690b9a5d0b32ff99daae3f44c113357042b72216d87
- SSDEEP 768:0YOamH6jx6gZiypDO+uT0KkJRbQbGJHaUawhiOVbm:LBsCx6xeDO+MkSqndi2bm
- TLSH T10B436166DB26E2CBD1151AF733826D1806094C7B66F0C43E1318AD3BD4DBA457EBF868
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58bc8e.rbs
- Size 546B
- SHA256 58c235ca7b21726e32947ec265c54718e448b8d276e95717fd451eac06278ea3
- MD5 4c973c6dde405a23a67dc3fb904ab064
- SHA1 46865cb192f4ff04aec7b695c0aac1088d3e8184
- SHA512 539aeb54d6afe1545e6379fea0adf68a6dec8d5b57d895690ae7d8b205a9051b1234b404edea8852ee452141b07bf1c2cb27510e7a6e9050b2486de6fe075355
- TLSH T1DDF09E93A70842D2D6A07E3613436F051A3BE53A915447752D856238BD1630A5EFE0CD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\PocoCrypto.dll
- Size 2.2MB
- SHA256 24208305449f9e0798f83bdac575747e2f059a5b6673fe95502dd124112f6fc1
- MD5 a8e87d2ba4955fc5906a1fbc4218c7ff
- SHA1 f4edbec5176c33b0997c93c0e97bd1c3c33293ec
- SHA512 035365aefe4106d475d7a1a6d054cd4339cb3ea84f774e6e564c285229327c606a292d3986255bddde5a0384703074e513df23a1a5001d35b08963cadeafd265
- SSDEEP 49152:GuufkgJKlMtOy3ayXeqBYItS1Y82mWlg9iT7twYph9JxsFH4:Ok6yMt33dBYT1F2lldt59T
- TLSH T11EB5BF12FA819031F4CE027692FE4BB68D799A14132C95D35BA63CB89EB51D2763C34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\MEARWSetup.exe
- Size 18.5MB
- SHA256 0319b8610148abe1fa8db678a103783e72779b53480a27451d90edf770d4570c
- MD5 0af490f8c2e63770639f6a1e6aef6c68
- SHA1 f788c4b0698e2e35d479523a442cab77df4df2cc
- SHA512 ca79a0992fd5ca7e419d515eade46126d4a40c9294afec54688801022fdf4e683881a6360e5f7a18e7297e2a2c842eb8cf1eaa3fbf81e792d11aad329211f27f
- SSDEEP 393216:V2U3UyHn+mfQ6ofL2fHfmYeghqN3Jcv/m0oGNsjX3Xm:V2UFHn+P6o3N5c3mh8sjHW
- TLSH T1D3170216F2B441F4D0BBC178C5969A56EAB1780647309ADB13D04B2E2F37AE5CE3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\TMF\90b9d24c-5edd-3175-45e9-9b7254d56a79.tmf
- Size 528B
- SHA256 5213fa5faae507b4996b28c52eb50bb5f06ef80426b136ea517658646786a29e
- MD5 3224742b1713b348b52211f6c2294ebf
- SHA1 af8f6efa753027970a41ead7750ecf4e53a76b22
- SHA512 b369eeacf45d7bb003ab242d8fbda7c6dd37cfa94e120520eaf5a86e695ac0e53f307d04f51137a5ebfbab447d4fb54648aae3b6c325bbdc43bf5090fa1846dd
- TLSH T106F0EB7818F1DBA511F2B0B5F18D8980730520A313140440F80EBB1CD1BE872C1BB7DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\TMF\9e234734-152e-3823-fe7e-1b069641acdd.tmf
- Size 808B
- SHA256 d07fb737c90be645335a3d1447f425dbee8e53ef64dc5f6f8db1af950e8c9ade
- MD5 0aeadb34c67017df60c815dac5cb757f
- SHA1 87973f025ccd3f000891474791530adb4dde024f
- SHA512 d6f44ad4bc5d09db1d2a2d2b3adcf30f6a1041cace0039e8a3e3190c5131c98eb74d7b765b8f2315d96645fe463a84b96fd0a14ecde0b193fa30ea2617f48854
- TLSH T176014C3448B1DF7901B5B479F38994256A3501C293544414F94E5BED907CCAD77BC792
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\TMF\c0b570d4-7c75-39ee-f5da-d5578c9e051f.tmf
- Size 5KB
- SHA256 568996b736760671d213ac966e81ca5d93d3caa3db08464795205746fb314b5e
- MD5 101accf44e473687ef0eb27a787f8319
- SHA1 60d7c9ef8a06bc634c8272b6cae72227c44905ba
- SHA512 3b57bc156bcd17c55b6d1be33c8d1092484ba2a32d7a0fd4069eb6ebfe4be66b539d4400d5b7ef0b521923ac0d0f6339774a6eeee7c40323a3f94922d6009a31
- SSDEEP 96:y6znlnCn657nun+gnunKn0nsnpznJHln9nHnw29n9knanCmanvn+kncendnZnGno:fXARCmB0dl
- TLSH T1D5C17D3C88F3A77A40D2E066F2CEC4057B89154363294450F90AA71CE26C9EED6BCE77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\Anti-Ransomware\Public\Bin\TMF\c43811e3-df39-362d-6475-e12b8896e803.tmf
- Size 2KB
- SHA256 e79f6d75f731f6ddcdd4c56430292fd9a67412aff5c6bc77f22c70518ca4d994
- MD5 50906a3b4502e5bfae04ad741c32985a
- SHA1 71f33cffcb7518d55c9e13cdf55625bb1de98b73
- SHA512 82961ccf41d503a2f9877123f7bcc33955b836d8b7fe89e31fd6abc629aff14bb0a0d9d3908da1a14be1a4443c3089bd2abb0784d8f58f5e2095d24576c9c345
- TLSH T14F41D3B8A4F16B6A00E5E864F7CED43D7B4F109293249910F40F86ED614CCB92ABEF55
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\EDR\bin\Standalone.zip
- Size 15.4MB
- SHA256 4965befa29503df9ac47ce5b90460bad18f23605f39676f17571466f581a51cf
- MD5 2beff71e1248a097920cdc902598ae7f
- SHA1 d57002d2efcb4ac26123afab2892178db7a0714a
- SHA512 92344b58e5b84d52b01391cc9bbf3ebc4926578f767b74da2115a4af5ce12c5bd69af59e41537f47b714f87b6db74d3a3078667f8621d2fd68155508299f2b4c
- SSDEEP 393216:UU5F/0Qo5zGfnz+GuatoVlfCV/ya65vjr:UUoQopVBCZy3dP
- TLSH T1ABF633C2F480FDAF77094D6DE0A28C916823696358A41454EAF4494F34BA831BFDBDF6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 802KB
- SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
- MD5 8f57948e69c82bf98704f129c5460576
- SHA1 33e277af0cea397252c23d310961f803be5cdf2b
- SHA512 628cf68c9436721b874a87e1bff711d3b6fe5d4bd9b02411890059a7d32078a9592fc48e6e53761d17bdbd72c5eb66593b841470157a3e8b38f0b67525d73bc9
- SSDEEP 24576:L48I9t/zu2QSM0TMzOCkY+we/86W5gXKxZ5:Le71MzuiehWIKxZ
- TLSH T1C9059E22BAE5D07BD2421132CA1C7BF591F9976D0B2048C763808F6D7B359D1DA3AE1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 2.3MB
- SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
- MD5 2843aac7409fc7e54722c6238342f660
- SHA1 3e40879eacf10473127386816c24e0cf245410f6
- SHA512 f8a6e689f3b0c6761aa84f29d717d192fc0b34767a06d551a3937827a95f0cf740baada2a151b4ef6138a0fa626a93c94d45e34c235de63e265cebf32c9e70c2
- SSDEEP 49152:8P5i/uH8WK6WK0Lh8tRjd4b39T9+LoSaEYLUzSPrBsFwZkmTbk8iE8phYhlJFxI:8P5i/uH8WK6WK0WtRU9TAodE0UzirBsH
- TLSH T17CB5BF23EA808032E4CE053692FD5BB65D3E9A10132CA9D3ABD53DB45E755E2663C34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
- Size 250KB
- SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
- MD5 a2fb219c999a8fa6b95ad7c24890072e
- SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
- SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
- SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
- TLSH T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
- Size 245KB
- SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
- MD5 cecc32d267ee07ce3413637314b66ca0
- SHA1 627b584f88033791f427091fff74c9310bdc2ef1
- SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
- SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
- TLSH T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
- Size 14.6MB
- SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
- MD5 b26cb94e52dd0688c3a77b46e883f084
- SHA1 27692088d8f3d321a6f9afb39395f6109f0469e9
- SHA512 9823343c9c341b3a9c07ad9b3c89ec9c2efc8ea31f3937cfccd3c03724494ebddcd83a53a383087d2cc8e4aedff1e64aa7bcd76fc7d6a28fec4c6309bbd19311
- SSDEEP 393216:FT+EJ+ygjrEhL2oJ/3u6xC/9HI7T3ebuRgzPNK:FT+U+nQhL2oJ/jI/WXeiKk
- TLSH T15FF633E9B4828A4BC5C889B0C64681C4E1CE41B5DC9A6CB6D5B167BFD3DA8C714DB3F0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
- Size 160B
- SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
- MD5 7fe1c49c6da9570331515a2d300642e3
- SHA1 13c824b889876a1ae1e94faeed430185329df502
- SHA512 9de0c421861be17aa0e32ee5a3b603be946f075bb7178e7ee40d8b8639bedd3761e88114dfddc4aa0ab5ae20d6adfae5535b7205b8fa3674e6e8aaad27a0fb7a
- TLSH T1A0C0122AC1CA24F0EF077FB6B05613A34D0CC1FB020386570C4690401F81EAD8D2C406
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
- Size 62KB
- SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
- MD5 8e3d3fe805da01bc5abb251f2fb58705
- SHA1 8adc16a8e417cfe1130c3b3e40495ea977374fdf
- SHA512 8e742dc4122c3971f3a0175f648647ba0630fb87d0c1a415c5cd38178643a07a0e2e9ca5e360b3e1de530dba5ba323aa963de9daf204bb0ab19afaa38372311a
- SSDEEP 768:KuhPgdGgqsgO0JRCXwvtLqhjgiWmZhSX0P+4EDsXnqmpif52TZaZTAMxkEYg:KuhP+dgv0AvUjymZhSEPF4k4xH
- TLSH T167537B27B390C432D462197458A9C2725E7B79620BF8D6C77788037E4FB13D0AEB935A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
- Size 536B
- SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
- MD5 60f77c64f9c8a86fd24c8e64c20e009e
- SHA1 e9299102aa662027b9e46246a5847074444ec1fd
- SHA512 972afa85faba00ad96efad4951ec92ed90e60175dd80a388328c708975df2871655d8ae31ea750d60298ab1514c1a4b53b3b0304d5ace6118b4fea320c075f33
- TLSH T12BF075C0B546067A64170F3544351D4502476D06A57CA33ACC50FCDCD67E220B0229A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 92KB
- SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
- MD5 2978f0ceba230877a2476d3d99739518
- SHA1 a16ae5aa1bb6017d2732ee5cced1ede9b091816e
- SHA512 5e8ccd699315e23ccc94b4541d568815f88ffc5736c39bdc29d4dc9c3dce3e8ee1b9c70e9f28d980b5433f5bc10d49658b13dc2e8947a415e45d1e4153001cc5
- SSDEEP 1536:APLaK7cLtLWedH8rwkrsofXR1BjDrl7E2zzi0FNLGpxLzH:T66trH4wW3RE2zzieLGDT
- TLSH T1ED938E227690C032E456597468ACCA725E7FBD215BB8C4C77788477B1FA03C0AF7A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.2MB
- SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
- MD5 9c1ac952bdfee44fed1ecf7165808e12
- SHA1 8fee062be189b641b0ffcbbb7287697b9be16cae
- SHA512 bb9720f816a1833769d083079a75913c7aef9a103c3edca122ff151acd94cfb586b3b8303720d305807f72f28c6370bf80d478c5a0e6beb734384a89e344685b
- SSDEEP 24576:QSTpNU+Po5KeKA66v9cskz0LIU6iUKLO7N7EqyyF6FmR0OqZC0uNZtSTHytb0Dk:Q2F1ec5zu9LOx7yyF6FmR0OqTi+TStgw
- TLSH T13B559E22D7428031E7E200B7C57A86BAA938AB75131190E3E3D45DE85AEC5D17E3F25F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
- Size 2.0MB
- SHA256 8e35a7064793a56a8d6f1e08050fa588571c8898f5bcea4f78228cf343ce5016
- MD5 5956882d71ddb032bc14ce667b700d9e
- SHA1 74224f6a2948baeab354e2e2a7e687ab6a65877d
- SHA512 f7230ec387f95ab5aff516771b11ca00475adf460a293308a4dd9206a1ef2fc4a462c647ad8a4b0696209b7ed19e303c84667ff85bb2b4a06f4d4e90c15d5f6d
- SSDEEP 49152:oc41Ly9rwBXp10lrzBSnwX0cLP65eP8Txvkd/TgVI3cYKNpe:ey96iSnwXpLP65Lvkdnco
- TLSH T137A57D11A742C437E5B304F6C97D86BE5438B930172490C3B3C42DAD9BF99D27A36A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
- Size 3.3MB
- SHA256 e3200c70077193f3decf5896fded35b3cce2034aec5517178a24e35a665abfd0
- MD5 cb8424f3468ff7b5d98890f119279f4f
- SHA1 d82d02cde0da4f79b8bc430a306e47767f08f60d
- SHA512 ea59556d8f33cb1a05e616d9095d869590dcf47acd553c86ed4439cdea5e86251159e166cff9f84e7ac99ed726343af2371c057d80f1b249d4e72c3a777cd23c
- SSDEEP 49152:cPsJnLOymqHBm6MkoA4kLF6NEOROCWHnu26Dz7ZJSoY9n0aSu9cLGtTNpqLO:cPsJLEqHg6MkoMcNEQ/lJSoYeaSFYsO
- TLSH T1C5F59F21EF018135E6D100B7D67DAE6A582EFA30132190D3E2D81DAD67B46E33A3D65F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
- Size 1.1MB
- SHA256 b24ad0ae12c05931f11b66f26166c7ec41a7be318893aebe4cc2babe29bdb080
- MD5 34bfd8a2cafc17cc6d77731137647ee3
- SHA1 f759d53de2db6984ecc7604d0d655cb9324c71ab
- SHA512 26772bdc4d88ba6ea664d47c5f1d96fe1b3c08cebf852c77c2a0513459f763edf17300e341f4e764da647649177e4812fc926dda15c640b91ccfd6d0f847ac34
- SSDEEP 24576:yq6MTUXbn7CW4nVG2w30/JssVTlFLsWOq63IfHNpFw0wOzfTkqZgfVV:sn3/8FLsWOq63IfHX6NKTHZsV
- TLSH T1E135AF21EB024031E1E200B7C6B9D6BA7938A771271590D3E3C05DE96BA89D1BD3E75F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
- Size 172B
- SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
- MD5 c8a811d36876948a70fe7509b7f49925
- SHA1 48541ac236da4f143154a8f71fb7fb3f3110bb38
- SHA512 6bba69fa213b495a9faf4ea917788c43d888b3d96606db1644d7f8c456fb089f01d3e2582016a5043a49182ebd9767a2169aab94de05868ab0efeff5825c7578
- TLSH T115C0801594D652DB7498C735951537213919947F996DD12D404431F134785A0511FD64
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
- Size 318KB
- SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
- MD5 4373ce1e6f57dc9df7a8ada69479d8ba
- SHA1 f19deb28a0af966ad8c03db23cd21f75dfedda08
- SHA512 e1c1cd77650e72652528b005da981a8ee3b28c995c41875a872202d0a00c75c612050f74b626dbf42f9e5412624860d182b7b6c98dde4df7c09a7f735834dd41
- SSDEEP 6144:QnqKQ2Oq3ScuA05A+O4PlDfZIkbaRF30zG26Wdi9vhEsSCyAekfX6xgrNQi:mqhq3M5A+XfhaD3lV5SCyAe+XmCJ
- TLSH T19264CF2137E5C47BC692253089DC6BF970FAA7490F2448C723C49F2E5E35AE6D239729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
- Size 1016B
- SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
- MD5 368947d319ac4823f5d542c8f723fb0c
- SHA1 7d419d7c8b15f9abefc936f526e68ae2c535292f
- SHA512 ed51660075cfeb5a3826231a0f0e2b1b165d0dc808cc5c1f309885dfa7903c914b76bebbb183ef38d67a789adf43b0e6e5223cfccfc362d50ab05b1becb15a60
- TLSH T188119AF0A1F0DCBAE7571660799EB42055D66AC03249424D340BF6286EB7715748CFA9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
- Size 6KB
- SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
- MD5 d10bc07005bb2d604f4905183690ac04
- SHA1 69011104e870704cf45910d74bed5938f9062891
- SHA512 c8df6ec5eb5684348613af6e8bc2e8d5759ff9912e9d36df42c09960739b0922c2830b56059ec0a95fc2ed7aa83fb3fe5a8673402544c4bd00daab457b9b97ab
- SSDEEP 192:JfC8S1p4JW0bYmezNui5WP1UMIUN93GUO4:JK8AvOYmW1+BIg93P
- TLSH T102E19E87A4C2459E8EAA5CFF1D8E522DC17B8E1A9A1B50C52552D2C1071DFF8D483FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
- Size 6KB
- SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
- MD5 00dd0ec0a16a1085e714c7906ff8fb06
- SHA1 244bd9b7c3b1c4f7ef72de31f67804faff213715
- SHA512 163afece9ae9693c41324ffd89191132a8d2e42d73f962ace0b70b44a17d954c8f506cc25af152397e2536da6245e4336ae465708edf6ede955b4ad502af7a71
- SSDEEP 96:gMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6KaP:zXTvYXQzy51nfmcuXibSralG/aP
- TLSH T166E18DE534F0C16898A14C3253536644D16EB3C3A8F7AD02C1B0AABAA465F3872FF7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
- Size 4KB
- SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
- MD5 4e7e3e142f3939883cd0a7e00cabdaef
- SHA1 d20567fd436991539eafd65c3bde77d82a656012
- SHA512 d145a64f637f34d9f9fefaf7cef14ea277d0933e16c625234a9c1e0a54a7f3d0d820ab49b4b68d5d3e9853399d74efba9ff7771bfd3481f8c1c70e6dc6f50275
- SSDEEP 96:7sHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:oHm231Nvu+wIqltWOe3nIH
- TLSH T1A7A13DE27BE7DCF495E62277BF9D5491E1542A41207047B4C4C4D11C695C99B1361E11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
- Size 6KB
- SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
- MD5 40bf25799e4fec8079c7775083de09df
- SHA1 4fc6b1449c73f5d10489c104225ebe326a4016ba
- SHA512 51c9e46224098e9270bf51bec93e0528b5e726a632a1de57863fba531d914a9db1d3fb07d22cef756f6fc9e999bf08043e73bca6225a9ab7efffe2904105c388
- SSDEEP 192:92XiIsTugcTnouLuIXdj7Z7rgmlWRI1ie+BVtNzDby:AmOTnwCnZftW61ie+BV3Xby
- TLSH T15DE19FC1E5F8C4E0DD58E668EE886209C7A658B9064742DBCF0485694B48D3186FAB8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
- Size 4KB
- SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
- MD5 093a819138276b446611d1d2a45b98a2
- SHA1 1c7fc1ab71ed0d9fa051f07c7e8f43467121ebf7
- SHA512 c886fae282a185b69a2cdd8593cc4c4e7ee463bc010bf59544058bb294cb0bc2ecc008a9dbdc6c7cd0e45bbb80bb9cdd5b7520c4a88779eb8ff2df56128d7b8d
- SSDEEP 96:gHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:gHm231Nvu+wIqltWOe3nIH
- TLSH T187A17DE17B6BC4E4EBE7233FBFD95460A1542A01206073F480C0D1ECA98D9A71361E21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
- Size 6KB
- SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
- MD5 ea4ebe072be75fbbea002631916836de
- SHA1 1769aa84191332e981245146067080ee4faa592a
- SHA512 85990dc5c32560e10cf380d0e10707a4d995ff58b35cc81bb0ebca5afec15c1ddd6cb0de8e7fb392f2384f2a7ef9482f2b1e47924556e983b9c5ff1a79c1e7de
- SSDEEP 96:DcH4W00cRUjbz7dqG+sLo/Hh+U5cVH/lT3jmk/8fY44WtYHM4tNtldMJU/gl:oYW0YhqG+sLoPT+XjNQYbZNtfMJb
- TLSH T1B3D19E81D6CEA64BCB01DCC97EC73BD82588436B5A1A94EA15D2B0C8B52FA8CC50583F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\dlp-resources\dlp-globalsettings\dlp-consentsetting.json
- Size 45B
- SHA256 44912bd9b29453180d9a68c47f277dab01bd24560fd83954cacae891d7575e46
- MD5 78dbc9992bd73f6e7682ebb8ef737474
- SHA1 0b35ab8b779fe4084d704206ea739632eaf963a9
- SHA512 5cef4462bd987f1aabbfb8199758988b3a26e395c57e7685c62ddebed5cbd33f4e3aa3b1d8dc633155d202375de5b8d3d49be8b4223893fe02837e48553f8dcd
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\dlp-resources\dlp-globalsettings\dlp-globalsetting.json
- Size 592B
- SHA256 da445cc28048ffd0fcc3460576ceb1188ddc449d614f3a376c9d40e8c59f73ee
- MD5 f76cda1d476f26970d956e658351b651
- SHA1 bf5b36b79a8002767e62f704a368613c758b73c0
- SHA512 ef9e91a31d99d1c02610c81321e9abf55e5c433947325b3e5d8b4cffd1ba709824da97b19ddf79b5572b997ec98eb53a23e746a022aa4a60a107deedc1cca541
- TLSH T158F046E38A080998FF4B1AE2997302D990FBB10D5EB31481B1FE19685056720DB4B646
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-database-settings.xml
- Size 197B
- SHA256 1acf861ddbabb4864373aa0f8e4d968dd8aab2230c4ed1761184c3f5f98b0201
- MD5 8045ef96c4071df39302ec3f0080f352
- SHA1 99a2f7f43ab7d0d338625e93b31969f3057719d8
- SHA512 85227c49c21fb4845c5f76f9f0ff1f95b6c03e7bb2144102d47fe55ba4a77fe5191b61baccf5f687c6cac033b18cd1ee29364d0429dbf2d0c7d227ae5eaab5c5
- TLSH T194D012A83540E02F4BB49330D7BD87188366768681355B34A820C03636514D16BDBAD4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-diff-scan-settings.xml
- Size 371B
- SHA256 b4f6ab4c9377ac4d14d5e2872d44176e8b09a77e3cf1ad44e3d6428dde97f5fe
- MD5 8c0c6ab3d6c299bdbf1eecea48a924c4
- SHA1 bd07d68b24805951572a27618c80e8205237954f
- SHA512 6f38d91156cf9254ce69131a0f6f79117da013bd26e8cdef9d8118d20907413519fbf57d48901cff2f40160a75077b5cdca76dd8c86d66fba5d29144a6d75928
- TLSH T11EE0DF3429888C5D13A8EBC2D75CE8044C8D2217385F2CA8A062BF16167F7873D63AA4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml
- Size 30KB
- SHA256 2ccc14cceea6f117fe9b9b019c38b52e974fc00f35e927a4f35cbc2edba961f3
- MD5 6a229fd6dc7e2bfd398ecb438d89c44c
- SHA1 b9641b42faeb6747590a2fd8591b495237272e57
- SHA512 f2fa846f35e619fb211c5c8122c4bedd2fae225520b0ebdeddbfe58f4198cc8a3f2861cb9335f444f1edfa3aa7053dc6253b4c1ae911aa321d8b6691ac938fe6
- SSDEEP 768:DtSznpHDynPiJfxefBU9W6+rqgWZTOCFu9Ath4N3e:DtSrpHOnPiRxeMW6+rqgWZTOCFcAth4c
- TLSH T1C8D250E63BD21A110650B0CE87BE4F8152B7FBDF895A5BC831A06875931B6F73B4B601
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\EPMErrorCodes.xml.gz
- Size 7KB
- SHA256 f98afedcadb662b4d445800cb2fb704c9432f6449a850db0de7626dc5e50e000
- MD5 c70276f2b72556c0501bb6c8ce05d533
- SHA1 f6aaf376581cf4405d0bcc4fed283b6279b79652
- SHA512 10fd7ce87fc63190aefae117ccf1a839cd61ad28b630995d231bb01243e166d76c2f69647166149b9388983745aa09b51c36889dc4de63c831c8d73f9f90c2aa
- SSDEEP 192:ROGetiEfnoWBJLfDa0AQROfcsvXPsWJSPVZxKnb:ROGgOWS3QIfcTaSPfgnb
- TLSH T199F1AE803AC8102EC460C95486965EE722551F0A77FEE12B081ED4E7CB7FC6A52753D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml.gz
- Size 608KB
- SHA256 47a049c49e9fd4a9817efd595998ae5acdb838e4cc4e1f1219a9d2003b5f1612
- MD5 f7d43bd989403a50c9ca80b6fb969656
- SHA1 59db803b17ff609a5545225326974dc5444ca94b
- SHA512 b8686644ac40317ca4758c2a5001b02585fe50c6506f224c8cabb64e977bebd4c0acdb2a47c56f2a39e9343a09bbbf73d03a14fb5c5ac25676e73b8b107f5819
- SSDEEP 12288:ZnUnRogROrmvIhES+LfTJEhfpnErHAaVCv4KepLdwlrG2TNTqyEIE5aI:mWgggLLfTifpU3VzKezwly2ThuIEkI
- TLSH T17ED423E8C9C7BA13850444EB611416D27E324DC1EA7ED4D13FF0659BAC9EA59CC8F2A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz
- Size 365KB
- SHA256 b51efd8fde309d36a38e2174db59bc7633473df450627fdfea437816cfe42c05
- MD5 c2c5b2c043b6aa50648858f0626ebb17
- SHA1 01b8a07a67c614c77669588dacb95deb5a00fcbe
- SHA512 6a4cd400b7b36162c147dadeed8f6dc0274c80bf6dfa6a672dd8fbdfb72f7dcaa1367ca807bb34799bf513eaa86a065c80339f3d4d3a7fcef222f266e9f76368
- SSDEEP 6144:OBwZzMQNINGrcc2pfNCI0Z7Nx5rkxKpNdXg7KMCgX2mdO4+VwBMBswbI7H:cwrINGrc5pfNE5g0PUKMCgXxO47cIb
- TLSH T1D7842300EA8216561FFDC5C1E40FC4B3C6BA17DFC1DBA2E628663D8DF24DA02A9755C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz
- Size 516KB
- SHA256 a80de7283baa35b09e93ae6d98c1b56df4fca3a39c866a991c0e5ba01982ea54
- MD5 ec127913c51f40be0bd68ae5b97519c6
- SHA1 cb7a36e47051b8a75196e154f5b1ca2ecc07b252
- SHA512 65f38229d24cde9ab3a8840fba1fd9dcda80181390f1d08da56c11c8103df1d19ef8b93ef02b3669ff5d039399190da79d580d3baf5ccd25810828946d99ac8b
- SSDEEP 12288:7n5KTIX39WRSNaMppIBohwl0IOaRYwq/nYSVaMBP3aXaLDLtAUrZ:7n5KcX8S88jOl5+YsBnLDBz
- TLSH T1DBB423827ABB8AD5C00FA53AD7FFB772D2427654F68122A4E4660E13FC31B9D4392171
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz
- Size 120KB
- SHA256 76bb3afb0c8746b57f118fdc4ea24c7daa04ab6bbe364650f359de24cc31ff4c
- MD5 90d7b5f00a0b07950ec7b46c6a5b3e1f
- SHA1 c12af4cfefcb384db1d7b59f4a8b41d4c192555d
- SHA512 bcec9518131b645800e0e15870c781abf966dbb0912366400dd70f47e786517edb5105f08acfad924013f0ea6dba5007522b7dc7b0675a86aafe2137ade95204
- SSDEEP 3072:4HPUIWm8r6tjwLbLQmLLhgYcrVFv0Fe31TuCX80fpemxog3xcm6V3kR:OWmIgjwLQmLivB90Fe5ul0fptx963G
- TLSH T1FFC3120843D0959467BCB5C9C4ED78BFDFB3595031A98BDB68A4021297CDDB22EAF342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz
- Size 118KB
- SHA256 9f738e0dd604eee717218b74021d7e3085b19c2ba5643f1c592d9252a0f738b0
- MD5 30862556bbf0423c311e8c0e767ca965
- SHA1 097dfc95631073004abef35eb88450d97145a168
- SHA512 1fb54af2ff11d7eccfe80cd3d49383ecaa06e796a5196c50355f73bbefd57155705a391bb4fb94b8148aded8c0e22fd59e8e3806076c2311c93d1ea8c4cf74fb
- SSDEEP 1536:GJsjAImdKz3Yr7gGYmW/vr0OiFfXlrgbNz6GcemiiYmHPl86uJZ2BSq/aEy+yqxT:6INYAj1iFflr22GePm6yYa1oVipMl
- TLSH T104C3AE8E2253952E53BD103DEA70DE3BAC1E109820B15834AC94636363BFAF58DD5CBC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-dependency-details.xml.gz
- Size 104KB
- SHA256 7c142774c61bb0d20d57f1d2357eee1a4f24955d0c855c9c28d3fd093241f7c3
- MD5 aaead0fbd1adef3684fdc7848685ee44
- SHA1 488e8aec1487911614d8b91ac682baafc0bbe00d
- SHA512 e03cd2d51c43bf58be25219445c78fa3b53062ea8ef6244353b389317380e8a6b73a5dc20d9c587c52c7657057776f5d2c4b5cccda5f4826bf7c61805ac478aa
- SSDEEP 3072:eA/pkojYbqws8exzpA+e17AFp5BjEn6HH47Si6:hpkqwPe0+e17Qp5BjEn8H1f
- TLSH T138A302FC62731D2DC2A40775DD4B4604EFADFBFBF21808B98F6165A8097A607252368D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-scan-data.xml.gz
- Size 225KB
- SHA256 6fef20fa7b61803e256e2ea59d8a61f22d54d16360e77d8ab94169c14f74f861
- MD5 e837d5790ac2a5ec66d54f82c574add5
- SHA1 9d775aeebb1d49acacfeeb137285ba9c777b4aab
- SHA512 921ea412c2f3a4ca8adfd82ba15b11e891b60a49b18281397778d2f85194f1a9f7fd391aca230aa14479cf7e0358455b68b148ac6cedca239187483cdb8fa368
- SSDEEP 3072:W472fyGJKxGitcS51cMXESTKJaFg8RQPl47hQ07zq8EXWgNOj0a2QmUZU6zva1hp:J7AyOWKSzcIreuR9NEGJ2QFugaPSZC
- TLSH T1B534239C4EE56468F701A5EE32C2C0CB06DEA84374D68554CFC1A3EE02A9D6F5C69DB1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.xml.gz
- Size 148KB
- SHA256 3b9959303f49e24c4b59b4c30aa7b4eee772608c95b911d958d5cc28a3dea68b
- MD5 8913ee55f4a6708b927da60e51ee48f5
- SHA1 fba2ba699167b5014d7fe14bb410b05bd84a094b
- SHA512 0c3f8a04b58812ea68bf7845f96b61302f2a7932c1fd3e8bd6ce66770c642e05dda67271a9b4152095cb4cd955fb549761b837efa033b4ed95d6713de27e210d
- SSDEEP 3072:mTck3uxKLGboevM4WO8JFie5/cQ5sD6yVHTqf/NwuxSHSOSdDV+:SyE0o74W1Jd5UQylTK/x3OgI
- TLSH T144E3126404E5458008B5EEE2CA3B02B4EF9E7005F64B30CE9CDDD5BAD97096F879626B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml.gz
- Size 4KB
- SHA256 eb1d8d122fb6954f71960432d208138dc938462fd4d5b1d5bc4e2c2ba4b9d804
- MD5 6755dd53d98aef763aa79ffff029a978
- SHA1 51ce9550dea0cdd3753681ceb35bb8e2896c2e99
- SHA512 e04319173b6df32ead22225726718c4c45c8157d1ec79cb82a92664e24efa9ae75634329f450db94e4d2bfd501fa319f8fc823f15e0ff9aea8eccca1b3f046aa
- SSDEEP 96:jvSRrDBGg0nyIW4InHhln7M9eR1kYYmxxgb5wW0xmrUfW6cjPPIrnwBiv8Xl:jvS6py6HeReb5EYrUfYgw88Xl
- TLSH T17A914BD9EC9B2490CB2E74F1BFFA0D78BA178571806837F35567048D56267D0AA82C51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchutils.json.gz
- Size 340B
- SHA256 16d745bb671edcc34b3af1f7f08afe9b9562ad5b514fe0fa9918190c6dbab527
- MD5 88b93a1f2b7b689d6f79b0227c7781f3
- SHA1 d6c2dccd694389e9140e004a353bb1d854caaebf
- SHA512 ca45ff419d0af21316c0fc14a5857dc1dfc42360d216536a4fa8124101100878732d556a1d3d271e0df5737b77d94f10f8ed7fac70c354d8726905e5e29ecfbc
- TLSH T12BE02DD4F140BE9087A058ED39E32689023F828B860030B383F28E830B010FCD0CF6C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json
- Size 103KB
- SHA256 86795dc724af5dd73fa5a10c1ea5d54bf4101336dabbb445983a555ba54cbd1d
- MD5 6d83f2a9db9ae6c2bd4595a44c8b517d
- SHA1 26d49acdf0948d34a211ac3ba10cd634d6a9570c
- SHA512 d9f93b8f03f80cbd37a7e2103f6edc1702c071ac60e63efea8d0cbda466603b22bc6800508a6f87f2bae31f6a7ab34af70d1bcc28f7b0caec0952cac1604a31d
- SSDEEP 768:MFT5ZHlMJSv41OLEB/iZcbeFIX66XUR2TA9i/lo7+58fCdgIHs/f11C2hSsViPyA:M95ZHSs/f11C2hSsdd8b
- TLSH T111A3B919EB60DE43961A86B150088C00722E137B7CC9BFE4779EA27C5F4C59F197E26E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\server-applications.xml
- Size 62B
- SHA256 dc3ba306133d36aca2f8529d71b2c11cff1ef1b322d036aa44fb4ad8215ec9c7
- MD5 66e501fe40026e8fd15851d95e6772a6
- SHA1 f86b2c5e644c360bf83aaf421416831904fa467f
- SHA512 d932cc5629137b815c18641dfd3043c04e7209bb337a0ebb0f298e2c9ec94c890203c41ae9cc453d180e4ff59700893083e8be1d9651b8354e2f0e3a46250ded
- TLSH T100A002D5631191674BD155664769C0A8937D711A38A00D454D9149A706560490B46156
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.7z
- Size 338KB
- SHA256 4e6b9591e806dde175d317933f390ca890d7ffd0ad311855467016625cfe1bf8
- MD5 eb8dc1925adcebfc023249d0bc2a4367
- SHA1 0b69a4815073eccd3be8b4a50b0fc51c05f14ff3
- SHA512 85dc3d140c39add362b628699e295d8cd930cec4fa35214e725ca639abfb71bb33372b7f55d106b521b2b6393b942a0353e92bffb0f3456c1d89ee315f25e766
- SSDEEP 6144:e9Thq4kEqanDsr/HO4pLmWMYuf7tlEtLJF927FgW7N/e+h5KAXBj7KXVFRf:e91qjCnDS/7pLzALmTg7FgcJe+5HtaFp
- TLSH T1677423E5F06F3E23DAAE44870E61D8D0C72FA045B501AA3BBF6DE1CB802D1499745766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz
- Size 464KB
- SHA256 330c26d95b59deb9cc893537bc91e1b8852d1ff4c99219c968ded6e93440c009
- MD5 d9fe4142d10fdca3ffa4c1b13c0793de
- SHA1 da0cd0fe875fe19e60f2701aa35d3d1a23c0fd71
- SHA512 fe4f9a114b34a0fd8d0c8dbbc0964450bb225686ec113fb638f8fb21a76cb357a0bda3e67e7675c1eaebf055ded845e105d2c33710f16589cd99223a25709c5b
- SSDEEP 12288:KAv6dZ+cXAx11I/fMN9fgR/o8GlPfmenWO4pU9GC:WwlxPI/EIRXGmYp4pU9GC
- TLSH T116A4235525FCE71799A2FA4A5EAE80925BD293040ED0C671EC7A7034829276DEF3FC50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz
- Size 201KB
- SHA256 0e38c0611ca05835971a71b2f460ddfe8a936b2b5c02d6611b09854c6cdce2a3
- MD5 42198bc0b5a873ae4542e21ca7a55ccd
- SHA1 db6e99be06fb5162f0fd2c5c4aa4a27964b8b5b2
- SHA512 94750d83c9de6017fd39bec8e05e1ea6daeb40722afb471079267a1477a95a43f89639ef023fc401c8c6a6040246d3fc23970c8f476a17ca3ce6872a50514da0
- SSDEEP 3072:9KnpnnBDOTA7Um0byMAI/OZfzRb2hWxZqZz81JeXSZU//OtHesb+NC6a13MJS09/:AxnsTrm0byMOZfzRrxrJa9araY6wMSCH
- TLSH T1841423634D00599F10ACDBA561FBC60636953EF7815BBB741BD6B9CE3BE0F8442B9012
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\applications-vul.xml.gz
- Size 142KB
- SHA256 3f80e81eb45ffe35c0448848cd09278f8272f36f5f00dbcd49da39b0c8175e16
- MD5 96f22dda9d103b33755449e7f1726cf6
- SHA1 649f1871f9df0e35f4c6d64633e3c9c4dd47a340
- SHA512 0b7ceadcd456d6ed61e520898f567951114c4482b81d08ea51a5dfa0971aeb6db7417a589df499d7471a2b6406269c23aaf10ce42fc7ba5cea9b8d0cc8aaf833
- SSDEEP 3072:u6PtdtcDPK/2DIqFA6peNDbBzrzd6gJ1mR6Lund6WCq761Digk7UIvx:u6yDPKGIkxpSBnZNrS61mgI
- TLSH T1A6E312CCFCEB59AF1680247D68F5761001FA617DECF8E9F1AA2286641C917B9483E247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz
- Size 48KB
- SHA256 4a1ea582d77df7c9d351c51b5b56d82a3bd48bf5749608f035f01d892914b422
- MD5 bda974ce3f858221a1c2bd6552946741
- SHA1 6f9b3bea4aabf8cd9f760e40a4caad6d2bf54185
- SHA512 69317c9d313cc14f0fe8bbe16468ba3859d85da432ee606f445871a2ac2dc95a1d4c61a550275e0b7a349cdc90308b99f4b9d8b5605a838345de7c1a81fbd0b8
- SSDEEP 768:k9KczP0sdkLOgfkzhZMwb3tlyItABxqmaRZKXi1ptdI6jcQy/ve8K:k99jdyot5leiP4XGzd9jcQr8K
- TLSH T14F2301FCCE7EA0313D8DC85969B8636C273C2BEAE51FD2F57E1939664E0C0350918498
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz
- Size 27KB
- SHA256 731630dcc5d5302c05eb306fc9fb3ce2c3d6d2d136ca8256bf71b78d0571eb86
- MD5 a90e92da82ff3d25ed060532d76f6ab5
- SHA1 2fe4bb2c77bc863d78d519ccc2a3348c5d401e5c
- SHA512 71876e310c876c6382b8f8703562cdc5ad1a4ebf9d79dd4e2cf24b2eb0ecd31aa651fe30dbd940fc149f76d78786cef8488c561c42936993400f8563e14a6dea
- SSDEEP 768:28gCgCP5H8JGLFSoY2LSUKaExfgFEhw+y1Pd:ldDH8KFS3I1ExfMU6Pd
- TLSH T108C2F16A40B28ED086315802B7DF8316B505D5BB25A40AB79C2CE41DE5AEFD0DF33707
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz
- Size 37KB
- SHA256 0c7a6a517574375d0ec1f0632b3b894c42b6613adc20c592a7a357131294e0dc
- MD5 b511f43fcb612194edf114ed9435abe7
- SHA1 1a6f9ae00b12cb6441083736e1abf47aa80ca314
- SHA512 b9a84ac3cf663cbb4801e3a234e79408d91dca5d619478d32d8927699773d6a98022a91952a9ec842a40654e6de773b9cbafa8b81a1c7ca7d9f7ab78b5e7f61a
- SSDEEP 768:dYEY2TLisp2mVb8O3OdH4phGw6qTtujTduxt55NhbUOA3T6h/x1wS9iBLe:dYd2TLisphqeph9nJu4fb+3T6pnwS9iI
- TLSH T16B03F11ADA44921831650FA6C9E37D17DCBC8CB11F75B9F19F4A0222389F19BC3079AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz
- Size 108KB
- SHA256 cae93e2951af42085b7f41b8ff5f84cff338b604c3956f39b8404a6cc6207f83
- MD5 18b51e0a513ecde62aacbe28291e5bd0
- SHA1 a437613a0d76b7ddf86633d917b2fdb5ca6fad0b
- SHA512 db11b18ed60f82bd36a665ed53d705b52d942c86140a05f65dbdd31268bcd018541da253547dc3364e7330c5c23ca07c821cc530100cfc9b3a44de49e01a540c
- SSDEEP 3072:6nsMLDfbPt1CKkus8iTKq5e/jGE85Y47FfKQmIowDPj:ksMHbPtuoq5eq647FfKmr
- TLSH T184B3124AA455C5976F3F0C14232E662232291F22A717FF3C62CB1097EC2B7F5B25B916
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties
- Size 98KB
- SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
- MD5 c340fdd54a3956f567a1b3b5bf0ad58e
- SHA1 3c620fd4efda92ddcb42fedd600d4ceb1d940a97
- SHA512 d5e3171d3b11bb56fcf35de8ad596fb37008f21d9e8dfa18444c1460490fdffde3149981ab7fa45a144ce1daa28a5c588230b58fc802ccd30568dc2383b38f3a
- SSDEEP 3072:UyfCAIeTx7UYwyKlWF/VPKWl+DE09phQl1mWSDj8kS:VfCAIMBUYwyKlAVPKc+LDj8kS
- TLSH T16AA3735AD1766F7E33C6132BF4392BD176B20D648741A9E87988E8F4D63C84121BB4B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json
- Size 394B
- SHA256 5b25e3ce74a902d1b41f08bdf936a191198d2178bd0ca09f18f2509de7263289
- MD5 dff9a6643bc445bf2645b6f53aa4836f
- SHA1 268148043d58a57cc84cd3e326fe32e06dacc35c
- SHA512 c9f346ca6b3fb744bb1f4942b72990098a2d118dae6a5bc1744f2e54ed00d5fd51315fcd05bda64460d9860f2124bafaee1a534ca7190e8abbbaadad034f72c9
- TLSH T1ABE068EA852B9ABB27A96B8FB201A5A480A3040C58DB0918BD401400ADFE6AE5D23056
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json
- Size 753B
- SHA256 2b4b191c84b370692fafa646c83ae75725523e1098a7e59539a5731a5a27d5aa
- MD5 00d3ac2b88861b5ca9fadb2b4094dff1
- SHA1 431a5e35b752c1bac83fa088f21e3a3dd77e101f
- SHA512 a945df2226aee19e20641c21b96a73798b14984ff3dd6e29faa473814fc7a4c22698c5486ffc8a9a04bd3bc203caa3c0ef24e644bb48157ffead775f50d29be6
- TLSH T16A0190C249335BF70BF797EDB551581A45F3250C44EB05097E48DC915DF197C480322B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EDR-metadata.json
- Size 478B
- SHA256 97d2b19996f210a08e1310607312237681e4c0928cf31027d078518bf792110f
- MD5 d4608c45b71c18a9a5a47eef48a085fb
- SHA1 1280c3eb966840dc121b8b2467c0fd49b54151c5
- SHA512 b77de50a5aa7d4175e51009c039d7ef9b4f5c4fa2406cf5486716510e0fce2b148fb5d4f923225441a9605bb69bd172cb85d59234e7e145850c7bf9e8d153420
- TLSH T1B0F0DCC31907F4B713D62F0AA6424405A4F7200CACE70C96ED4287888AF76BF0D13E03
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 15KB
- SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
- MD5 783b02208909201added3870096ecb7e
- SHA1 f912be0d056a40d9ffc49aeff5287d258048664c
- SHA512 a3b95b96082621a06f1b3df0dde7b50b4c84172f8f5a48889f766fab9594e3dc41a86ab47553bc8ef4a01c29103bfc59ace36f1135e4aedc0d7079faad513589
- SSDEEP 96:jSOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:jBhBAO8b0Obx9nFLnnmI
- TLSH T1E662C593A51D099F0222039999DF7AD3A1BC94344C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 60d8882f39c586ab3c36b54529d8b31cf30d538c89d0dc2fb8cbae8c344691df
- MD5 91825b38605d333662195bd3b42c869c
- SHA1 44a71532d39b9ddfcfd63914184a9d89f5315973
- SHA512 545a8242463dfc52cd814c0cb205bdf181bb5882f12e0711db15fa2461afb99798b6682dc1cc09f33ebe502d13f599c84563931b1cc3167cdfd1fcc76c60e808
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEV:0PY/P
- TLSH T188D24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz
- Size 2KB
- SHA256 5261b3e69078e902b1de05968785674565757a2fe8233b3d892e7b796ca6a537
- MD5 2420f77785bfd564950ed284dd4c5caa
- SHA1 77c995053109d0222a4d84a2a934df3a7376c8a2
- SHA512 827e27d8a0cedc6d1a492bc5fd9d519e1df714f4e3aad854972fd41fe48a5e08c3c6659cab7e2497b068c50c1d0ea4f3584c9ce2dd1a75f6a86bf23b1a8767f8
- TLSH T191515C122CE87E5B3441C60775C2BCF59CD7876820DD698D946C6F0853936773B71C86
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\addons-resources.json
- Size 25B
- SHA256 c8bef82f23f0f34c6fc781f4d358c7ee3b25199eebb6fafaafe2e39a17e61443
- MD5 f7b9536a643ce1d97a0b76bc76ee851d
- SHA1 2a65e3ae884b7246cca579c9b645d8912ec33712
- SHA512 72fa9b329fb396cc85aad77a6a796d1cdb958edd8df0580951f1fd12fb6f5b8b19a35e2ea8672c6aab2e52e9e424f68a27b084f5a1a0cd691b881f7a09097307
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-security-setting.json
- Size 203B
- SHA256 b9eec4906d9f8afa444bdb96527b984c0bfe71f90755a83b06440915114083f9
- MD5 b3f5fe665532b51ac8aa3c98e4f90047
- SHA1 6dfb179bbb3743f6ecaa915fa2af0020f6756146
- SHA512 5ad7715eb16f2df088e78f6d114f27e06f875cfed2266e31eb685a3bd4b9073b967f33e4132c7dcab8481878c1ef1abc014f6bc7b0ba1ff3335c93502a259898
- TLSH T180D022AEF004A6880AA82AE4043EDD69139498588D98B6B12038B68326149E6AF11322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
- Size 3KB
- SHA256 46f9b385599e60a51a96316cdf336d891ca617d98740cbec8dbc3ab95c02e9f7
- MD5 56e15c1ee61125ab13ad2a7b2efe78db
- SHA1 9f4538ade9cbdd34cf8fec63ab26a7e0bf424ffe
- SHA512 1f02e9213eb94d19f932b251a34bd527310f00a399f834b0c077747f2ee055a3a205bbc2faf1e05f31860b32f0fa7a20e3b54c3c8d280df38baa9da42c9478a9
- TLSH T135812111A0B0C72D1374776CDD56F715CE0A06952A190B0AF06D34FB0F7AAD17AAB4F2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\application-agent-store.json
- Size 1KB
- SHA256 175487ac0207d0f9d87ef1cdc77c32cb98f0ca5931c0fd91a6462e43f0bc23fc
- MD5 0ec9d287f242b46b6f5804e2f10db7df
- SHA1 a81feddc65362fe23bd135b90169b09f72feafe7
- SHA512 533bb0463884a949d97df61b0c3cc01e76ab3d1fc59b46b194dd906f1bec11c4c2ea2b813312aefd3f168bd570c8e01e0f951292b7a79c9881e4883c13561fc3
- TLSH T1A431CEEB61471AB6ABC7535FE84AC79917B32C3D58FA1D407E8E5F280F842E89757010
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
- Size 242KB
- SHA256 1a388c11ac7b14c44ecb605da1f6111274beb11d947442311c5ef1a88d6e4b68
- MD5 80ff33c99dd10147ea596dc25319a780
- SHA1 04bada413072751276f871286071cf691b5073ff
- SHA512 ae0ff8a43d19cc0b4a26cf10e7fa28779d803d984639d2e6a5304a6e737635a440a5551633a1026be8b3a9d847ac0f7e125e1f00f0edeb5fb03bc5afefa6e44c
- SSDEEP 768:HDVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAaS:HDzZZ1uSNABIpkIU1
- TLSH T13E3418969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json
- Size 1KB
- SHA256 c9b1911676f090c956d47eb5dcfde02d1c6fbf5caa7ff04cf403b230ac51ae82
- MD5 68a6db4401e1ea278eb26c71afb1de8b
- SHA1 20fa14447fdf1d9b0d8515989850a693599d72e4
- SHA512 5b3560a83b3b49a6b062040c51bc0b8b218ae3585ce1f2b87009b265ac0d8da68d44532eb5704f777194b54923b3dc3a5a2ad25fa30a9f9b25404e06a837be31
- TLSH T1F411C0E871AF0CFD82C7F55A9D9EC12A76A9F626E0E85C0C7A49F8048FC6048B3D1514
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-br.xml
- Size 54KB
- SHA256 200c5b769c540ea6cfcf8b311b3cfbe950b2f93406020deca59cd31773a6c9d8
- MD5 52d1db2a3b9241f873076cfabeaf4582
- SHA1 b51ac32f72a5377a9e13c9bfd93e92ebbc3983ec
- SHA512 b1f92bd0700e5f48cc5bc248e4bc5355cec384588ac816aa5ee3399270ca653afdbb162c7c876954d5e0fe2738ad76d212a626614f20ebc8b2a2bfda06319d7f
- SSDEEP 384:GvBUBk4Ou1tkFHYEMVlm5D3GEb5o7sRUURA2Iy679RUuLIp:pOum4jVlkDRdoQZIy67MuUp
- TLSH T1E843861F2EDDFFC90489D8A04CA470842E6F6A7BE59154D0F89FED35AB046DB6C32621
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-edb.xml
- Size 389KB
- SHA256 be1f87e03f3fd0cb7fc75784db831a31cb3c809cb08d4dbf784d6ac832382534
- MD5 666c46cc0aa743b45457fa116ce22001
- SHA1 73ce9949094a69121066eff149e897fa93764b17
- SHA512 69a6b3cc0f44cfa8d7fcd1ac458eb83cdb607ce60af17347dcf2e8fb6d5ea6e537b1b1be5c2150fd22355631ffea4435341eb891b8653546ec7b6f339d46b823
- SSDEEP 1536:cdr2eN4+wTmYLR17wX5jTf0ClYOwiyP0ClTNp+dJ7fU:cdrIJQoL
- TLSH T15684245B7EFABBD91485D8D488E030841E846177B95126D9B8CECF769F01B87BC23B18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 415KB
- SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
- MD5 d1a1e51389e6663e8e53933731adf46f
- SHA1 9ada91a587210f7f67ce5e805d7c35ba1c4201eb
- SHA512 14208064c56b6fd9998f10b7a534b3c48ddc1539ca4ae63521e5ccced1824e3a2e7ecc0c2e592138bf17d4ef07d253ba537215d8fc095b0d2a55842887624a99
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZn2FYYh:6fufQiiNJY7tYiSYh
- TLSH T13E94B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-mc.xml
- Size 62KB
- SHA256 43d6385cd675c9b3217f5d59437f887806cd8ca1a56aa49916b999dcd8fc621b
- MD5 1373893a3b1d50c71be90d839b33b4b0
- SHA1 9c21aa8537f1e6bad95ef0a2d5e9492c88e13761
- SHA512 df741bd1cf8e0ddf16c4c53378507c31b1a18c7a9157d99a5a0768e3ea6004b432e5f67bcb2054061159daa37ae5829248ebe263abe587bb985112fea3e3d6e5
- SSDEEP 192:z06hVJ43ch6R0qSMzqiHRNrb/l6R07rlWnYPQJerqNHb:zvhV+/Wbeu
- TLSH T14353482F3DFAFAE51445D898889031952E806177F68526D8B8CDDF76AF00B877C23B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml
- Size 278KB
- SHA256 73c9afdb65406c39f529eb6461b60b91352160a6ab53cf6f1d1c033ad5baf61f
- MD5 e59e02705dc4f04e06050fb7537d2459
- SHA1 4bfc64e6291dc30a50cceb5385118acd2fc4d363
- SHA512 ca4e1dad24d33a0545d04cee84b34f634f9b7e0923a61ae399ff44432352f70e73656e2a67b60e8c3cb1ded972321d0fa233885000505fc7dd47d4bdefe264be
- SSDEEP 6144:linOGst7mrpjMG9KKJoDm9d2JKbT4S4j8xpMqH1GOYKK2nYdcZBYa:wJ2JKbT4qH1GOYX2nYuZBYa
- TLSH T12454CA1F2EDEFED50449D894889071842E6F9A3BE19554D0F8EFED35EB00ADB2C32661
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-vul.xml
- Size 163KB
- SHA256 052ff066f5ca62c9d79312f15341789b4c4851c0e0f67e02eb3bed5454c1bd53
- MD5 46bdc1ed87d1ff5045a43d68b2810696
- SHA1 473d1fc806c370ae188099e09d94835a0112b51d
- SHA512 0f7329f4382486bca23c2dcf4eb33dde6759f0cb94652557a57df571fa67595df193fc356381bca4d61943b6fac8dca13bbcd5186c7d803c6a9c59ce3331cd63
- SSDEEP 768:XEKy8oHAQ1oSX/DET0znoschasDgRVgAY:XEKy80AQ1PX/DET0znoschaegk9
- TLSH T1FEF39A2F2EF9F6E10045D898889071941EA06277E69566D4BCCDDF76AF00B8B7C33B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
- MD5 415d608384f186f24717c62056111c99
- SHA1 85a8d23411db39acaaa00a7efb974535f74bfb26
- SHA512 f72b81cddefac677b27d41380fbc647c83a1cd22ac3d319659f569d64907103cbaa5ca3ab877c97fb54f3f0f37b5a6a3a7afa96f6c4c7bee02aaa275473b7ceb
- SSDEEP 49152:L8vq3hwELiWbHTKR0NDZK+/0KfEDKJKzK5xFKOQFKNoDKpW83wKFC+KFE2v:4vqxwEeWbHTK+hZK+/0KfEDKJKzK5xF8
- TLSH T13E75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-info.xml
- Size 881B
- SHA256 2e9c93194157a2a161d7ff44e17362ce3adb2aa66363659a0e5e5b749cc03bf8
- MD5 581ada4fc53d9519793d2bbca61a21fa
- SHA1 bf4a8cea290e70215951b3d6fe10feb0fbe97c78
- SHA512 f25e20a4dee974f5fc4f5ace0712542253dd192a580404c02c3e2c804d2a171dc3729ba5bdd887ae3b59bbafea55295e9fa9b2138aba35969f9c29896f05b72a
- TLSH T1E3116D13B883DCE92363BB84278D981AAE542426721F1C5071557E958A7EFA31C7347B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
- Size 28KB
- SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
- MD5 889d10168a96d01a40af825a606ffbe8
- SHA1 d1a75fea9d9aedd31dd581b8cdf7b45791d790d8
- SHA512 4536452db3e0d32cc7129bab4180a509b71d5affa0fb98599cf7ae4d21671cce0fcb7335cc891a0ce247de2a6674197f6ba74409a14b6bfc15a7a03d1511b90b
- SSDEEP 768:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYOXNe/pR71KRa2GG4q+V5No5hVMKD4idqH:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYL
- TLSH T10AD2753E61A0FC4CBAD0E85C14CC8A188855D313518D7AF1FBE84F2E0BA59A5525FDFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\edrmeta.json
- Size 310B
- SHA256 67dba8238460dfc226087f76a67b217513eb91f9b2451be191847b9d13483a2f
- MD5 b01333b2742f525884a7504c0fc96a23
- SHA1 5c2e0e511d2657ca3bfdb0f3e57a7456812b34c4
- SHA512 e498cf2897f90b2a7ee148af0170ccb04b84a2c13ae52176ba7a14fe8f7ef729c59a9fdfaeeca5bef7b7ea59a230bd4d9f660e4f916273ebca10e592e4d21fc8
- TLSH T149E07D6BF230FCB6919D8600B29458E032A4218CBD917C86C896E1051FB2F334813040
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\mdm-enrollment-settings.json
- Size 141B
- SHA256 f058553969e9eeefd40178f50479c02cd6531136b1aa3469925f4fe4e2db2ed6
- MD5 e71acca7e9098d10800b69c252da3283
- SHA1 ea1eeca14a91757b9cd071e3af434e5d4a0916d1
- SHA512 ee6fa42d3df3dadf898f5d503637282b995787f8d6cd6c70f1b33e7bb03e960a0a65f06597dbe6f1ca313899d9f026239397fe92effd2bf8805c0e7a1d38d25a
- TLSH T1C3C09B91CB502DF44B4D3CDC984CD5C91D909347594964A5F420915D6F4D17C3475CD7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml
- Size 8KB
- SHA256 26c308f0aabcb250a3ae573d014ee65f406c964947ed3b1516480e50f32d591e
- MD5 6a7d5833218f8fb87edb99dd92f4fdc3
- SHA1 c12b0ad52a442985eb162600650afe2620bcb88a
- SHA512 92c9a3b048f8528868947a0b9953027a169f03a0015774d63c8c1abe26fd2e96cedd646a62602d98a35c53b65dac80ff1902b7396b66f8544c53845e9e521a5c
- SSDEEP 192:qUKUEUZURUwuUnUrAU2UjU2UTUMUdUZU+UAUfUJUHUZU+ULUlUHUYAUzU+UIUxuw:qN9Ym6i+AnaBED669z+oMY9ukiTAQ9pa
- TLSH T1B3028DA06BCA9CF81194FA0C8F4DD920F9B6F71721AD50547694FC448EFB8E73DA2129
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ns-status-details.xml
- Size 1KB
- SHA256 bed18ac9df66eeb02d52a9e77f9626e26fab5adb39d48624ffd1d491fbff4fc1
- MD5 f798036f879004b8df4ee4478b1a7695
- SHA1 94490df43c2c54b81af932fc6b6b3dd7c432c2f0
- SHA512 d134d09d77ac1b8d37dbd151c3b78df3c4c2cabb42212e06b127fe7ddf71b50eae265d21ee1cc2798ecaa6c6874ca39ed547492daa76f4fd97bdc3d3b8fad1e5
- TLSH T127418211A8839CE92357BF942D8E89229C5D1867322F2DA0B151BE91563FFD31C734BA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf
- Size 55B
- SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
- MD5 87cadf1716a7a89b6a5e95707bbe0e5c
- SHA1 677e32f23bfbaa64b2eeb562a24b9153eff29c7d
- SHA512 92c72d63eb92952cde4bf2dd01cff2ace0b531d28b3d53ade8b5912ee796d2313b08f4a7ee172efcaca8f2951386d3c8916796ac736801ece831bc6d7ae2ca76
- TLSH T18290026DD52E681112675D0E66488F43C51A50C1198D582B1A2C1826A0B417D5A50153
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 3.1MB
- SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
- MD5 7e12fdfa73e292f21d91fab687229213
- SHA1 092919df467205f4b81337a73e1d8602c77d92ee
- SHA512 5e41cf585b2e549330b21d8e9f414fbe7588fe405c1b80d32053c14b98b45a001384c93ac32e7253910f01285f1c6efc0d46e163c1b0c3f017fd04f5bda20ad7
- SSDEEP 49152:8594T6Iiya9PlJdUI11loQlxI6Uh8Zvu4d7TmunCQ/XHaT9eGfcph9yv3fxJuQ:8P4uIiya9PeHQlxdQ4dGunCQfUer9yvr
- TLSH T19AE5AF13EB418031E5DA00B6C27A9B7A9D396730132590D7E7D06DE86EB45E27A3E34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 97KB
- SHA256 c01bdc98f99707bf0d54eea90bd960910661cf1634e6368a428389b716ed313d
- MD5 0b701733b5257224b93484d7324cb7af
- SHA1 8e7fd9cd36391b99ef2144a5aabd6362ce2612db
- SHA512 1554be961c8b8df905f2800c4597fd349f9c03edf65a47f740ef18cd997b2df450daefb9659efdb0209d3ff0ca95251250c741f067610ccf0aa623066c619a1e
- SSDEEP 3072:4EJH78888E848L838a8q8c8J838a8r8h8y8J8D8/88h8v8H8j8G/hZWh5hEh5hLd:Cgw
- TLSH T1B4A3AE417D56306872AEA6E1FD3817AB24C2766A0203B916FBBC784497BD41E5FFF060
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dccomponentregister.log
- Size 30KB
- SHA256 3c4b78ee3d4ac5716d2d9eab8a320dda177407952fc0c03333ffa58d4f28e6fa
- MD5 6640ef8798ffafed35eb10ce08e73c93
- SHA1 a72dd2fd6a3dace1804b360af1e82089685e743c
- SHA512 ac7d5596ea7bc4283a6d605c526414fb003af98814b5b8ad1000262bd28925667b74cc57fe5eed2125f3cdabbd6c6d516b221c5c024836311521da102efdc107
- SSDEEP 384:8qTqjQz01v91gIaqXfljcF2h2gJRK1n5ZjFcOY5W+Qo+O68H22dr:8qTqjQz01v91gIaqXfljcEJ9OlRO6ydr
- TLSH T13BE28C01396A215972FE58CAFA291F8714C27E2A0653E91173ACBCC5FBDE4191FEF460
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
- Size 1KB
- SHA256 09fe2a168b514992749b22b26aea057ac02fefd968983d6b0e7de34cb57cb899
- MD5 d19d5aaab5bf0bd25e27af83fd7fdf50
- SHA1 d20f95143ecee1f1873ed27bba72e6e987d926e8
- SHA512 1b7ca7334230932c229faddeccabdac14f0cf7091ff433fe126d7fa1c1b65427335cec832b3c96f4ff4bce9aa9719598ae7335a5a5c7469ca53339e4c7d1444d
- TLSH T15621DC9E2B99557D93FEC99FE068441484813C9790B031A9EF64D006C7E536DF6E0618
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
- Size 1KB
- SHA256 ca143ec82add67698b95b28c0a8386a15c4df07ce3a27e5bf665b16de20a5fec
- MD5 7fe952e8b0083e78e680b1f20526543e
- SHA1 f07640afb262b3f1701f17187d80852d2aa0d5aa
- SHA512 8b1a04facc600baadc377cd26dfcb5d168e4046b3e7c8c26d1c6ec447c3f6ae02a6157d436b061a24d1fe474888cbf54e5fbb591a4412e68a478c401e6b947ad
- TLSH T1DC41CC9D3799527D93F9C69FE16C491085913C9791B031A8FFA4900AC7E236DF7E0618
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
- Size 2KB
- SHA256 b7ed229a9d7e6c1c7aabead685d76bc569e44f2b58af445e140289d543552c45
- MD5 61ab657e079e420d43544fbb6a345e9e
- SHA1 9ae7add32984f0ddeb9f6c79129b8c62d08e2766
- SHA512 d19ac0c041b3ca2eaf9d545319d2cfbd912f0b25839f0f40d51690f3dad703ee06382c6d5fa5ea148a6b9e5cc54b62ed383e6a2f01eb40b56fdd9293e6c949c9
- TLSH T12251FE993799527D93F9C66FF16C590482913C9791B031A8BFA4C00AC7E236DF7E0618
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
- Size 4KB
- SHA256 8a6103c2805e136744192adda18ad8f6c5486416f5f77a8bdbe5fd84b5b866ba
- MD5 70c113693fad1d7fa03fda8e08de3624
- SHA1 8ef06c19ad816388a0d6b55e6fe171a6fb250346
- SHA512 bf0a7570f807b2c3d45b548db4598ce1c1f4a7d79627b9ce0033bfd213eacd92fa17b50d3a9742d29ef856ed068a674d028a51e89fbab57e0435b4d4e4b8c7d4
- SSDEEP 48:+70n8/0P2FkER2WhKkEett2A5r2lkEgy22kEST2f5r2fkEm2mkESK52dOkESKH2N:+C8/FCeAHYC1r9knW18v
- TLSH T1DEA1CC993798527DD3F9869FF16C591482927C9391B031A8AFA0C00AD7E23ADF6E4618
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferup.log
- Size 453B
- SHA256 76bfdceb5a02ad41037fe116e57a066ac18a1478888d7c4ad906eacd84bb3663
- MD5 7e36cc4fa09e5be69d3d801e657953c4
- SHA1 3044f8f4eb7d0b4e355c36caa07718bc2601c9c2
- SHA512 58f1ca1e158b377a40af59dfb2b9fca3c5003b263ca6e0e6fc2fe8f263346d9e43b26bd22d68aa430e7ecf5d97b8a5f3780713735023c3b4d694413f4f7317a5
- TLSH T1E2F0DC1A2721613DA1FAC94EF02D4009A5972483402030E8AFE4D04247793FEABF6208
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
- Size 256B
- SHA256 2b4f901258dceeb688add70bd011740509781475411233cba0a14f0f28d0e2ab
- MD5 6e24d328fa783f1f18341fd5480b4a6a
- SHA1 0c6a3da06fb21e35f01cabed31881d691cf4b009
- SHA512 c2afd1aef1eefb53f31ad8b16b2f1b2ce9962b5ffd4217a541193eb16251b25b11b5d4e43a79dbf88bf4b481e3e96f7d0ccbaf5edab0eb8d420809b066a452f9
- TLSH T11FD05E20723B551053E976B12E316FD4345469268361B90270B524FE6FE7B8C17FFA49
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log
- Size 784B
- SHA256 a72554dfcd1741460a71541d58b8e42aa3541b677eba1ae3c8db54bfe06946d9
- MD5 3f68eaf053d8cf1e1d83cd80c3f3a640
- SHA1 53e2726dff23ec98db32b7050ee21672f283b93a
- SHA512 936b860447cecc0c9862bfca4968dcf25aa61c34dd6c99f95d1791f8dde9b3280882747393ba444cce83106cc6065383ff064287301a30761a40a47bb896f785
- TLSH T1BD01A9A24E0A060828CEE3B334DFD723E53191560F46791E30EE185493287083B9E428
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaphelper.log
- Size 23KB
- SHA256 ae4382faa54149b764031ab802dd22a077b15f5a6448074cbaf702a76e70b52c
- MD5 1741b3743bae2a35e93fc076fc2064ff
- SHA1 5e133c3041d116fcdba71b47c02fd72d7c26b15f
- SHA512 797b07b441a0bf8f94b7a8c3f67d4f1c7b673f036593babe13482e040b6ba3d03561520e343fa80132fdd1e4684cc645c882c14412069147f0ec6f9b6198e470
- SSDEEP 192:hyaoBn5K3SpEui8wHieui6ieuN9ieunuH31u/0Eu8AtbAEusVwViX7ie+oN9ie09:H70y3x0XEs0GL5f6UmUXus
- TLSH T1A9B2E3416C266D9633AFE9D636281FC6D0827A2E05E39C11731D74D4EB9F4192FEF068
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip
- Size 2.3MB
- SHA256 fbf012237b68d8d289956cee3d811eb780dfeac07671d0a3f557e63952ec234d
- MD5 df723713ba159ef060db491d8e8c9672
- SHA1 3b28648896dad9ef07251f5932d7c4f167c8973b
- SHA512 ba8a3d2f752a2f508caab6386311890a8cbd196a42d9612ba480d623bf02344b68cbb9131c902b290a777412681287197248811d97910cab5259c526bcc7aa7e
- SSDEEP 49152:6O75D+PhTe8SWfD2nhSHLPSYUzT79Y+oXLrTrnStqPqaBBT99xWalX:pN6PxSPnhSVUz/P6rTrnHPjBTgalX
- TLSH T129B533D8A34A8AF5C32E1CF2A156E8BFF24596688FABBE005ED903C5034F56F6D35150
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip
- Size 8.2MB
- SHA256 5c8fe933b91bb00c0fe0e907e78a84de10d23dbd8d95ae5908c024b2a4cd19cd
- MD5 59e51c44f4a09c721cda47d85485d5bc
- SHA1 3d498deb41d23ea5ff44d1e2e9da50645b628cd6
- SHA512 baa478797393ee4270a9db4e56db714523145c01bc41680168d17ad9fe41dff4d0a77284fbc07673cad4d72dbd2115b4ec27bbb5da830175e085ebd53759a3d4
- SSDEEP 196608:6NwqnhSeq1O60tC6OuBnUSamHvLd1qDIRY1msixgJ6mN1VVA:6uqnhBeOtpBUSa4J1qDIRY1mXo6OVG
- TLSH T184863350A6942AE7E85B09B07745DE97FBD7C0B48BFFBF30C5C08912CA87059A42936D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\edrComponent.zip
- Size 1.5MB
- SHA256 226d3c27dfcef0ed2f4bb2cace0ad846c4869a46b26226b6371c7ac8fac1591e
- MD5 906552aeddb7e0f5f77829295aa52c00
- SHA1 722931d19b9b5d0d0e64a9257da48fb23ae2ba45
- SHA512 91ba31bb2280815259485b499c392f9149ee1d3fad9525be63d6e02a0195213d4d31b79ae0ef27e39827242d5e187dda8a52dd76b23e1e2a04d53a0377a07687
- SSDEEP 49152:FQm6xkg/lGwcsLWBa+aR3FjDhShbTmmgreecZbnu:FAig/HtF+ujcg8bu
- TLSH T13C7533F1FE5197158D0F1A688A7FF2033E450449D390F26AD1ACA4C676A7A0BD609BFC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AgentInstall.log
- Size 1KB
- SHA256 d3a14a1b81ce947adb8cf7c6f0e3e982c55b4bafdb5a8dfa1aef710b93a99878
- MD5 32fe3a44e629569fa472da86feb66bd9
- SHA1 f732566d99986617b4cb32af01d93837cf2e5a55
- SHA512 dcfd07d59673352e84b2615de7b1213cc5fe65d2b4fcee372dc256e98d3318c2ddef10ccad28929d62232c6f08cdd4fd30047043929fa06a11cb41750f03464c
- TLSH T16F31A4691EE5090AB6B35747DEB3C0516B73FCD66835CB4C2344821D067BD059DAC37A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Certificates\client.p12_2991_2324
- Size 1002B
- SHA256 931d3fb5023ef483618c9648186ce87abd3d73dc1b65408135287eec7cf1ff0b
- MD5 07a44ac604f9f066abe74b03179e27ce
- SHA1 e4575f49d636e616053a07ce1b3a03a130643d9d
- SHA512 21d5ba3da292f6bea386e4b3b21f8f840fa5f7ae8cc5b173981962d205bcd142bd56e420919705116f1de421d05dc54ec30a0d36bc5899f6e5919c95638e40f2
- TLSH T1D011A5E36D2D245AB89C8E8C36AC8F0340C977A88E4CD4BF595562800D613B47C7CD70
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dc4032.tmp
- Size 9B
- SHA256 bac0662712b7b39d4817f00ac40c2d4bbd49c0d1fb3fa45a78e7437620b022c6
- MD5 742b41a5748f83435a18ceb0920f2adc
- SHA1 3179a9a47a6148d6d1d0d2ffae55a0ca3424052f
- SHA512 a7e516d967fadf9ce07b3ba99e6b846cdfdc8c168e5dd6c4991dbfee1a7fb9792f6dd14c5064e030bac88b81243c4016417c5a46a9df98d34ddfac4c7378f15c
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSIFB72.tmp
- Size 81KB
- SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
- MD5 e9b3f881f3855718fe6a4ed7855bae30
- SHA1 cf19171cc1b2186c5e046c0a3195ce47532b215a
- SHA512 50c04cc4ff234bb97192af5b437838f81e3930b1c2024dc13bd292ff85f6ddbaa670c7e2c2a1ca90d2c9e8de1b0ec4c1e7c2aa49ada80a0f4a42f9e461f41c26
- SSDEEP 1536:A+xCoJw5hZFi1QmA2uFQW9z/gkcWBxk40OExFyoxM:nJw51i1PburjM+xEOExFy9
- TLSH T102837C117350C872E49A693468A9C7326D397D625EF884C77FD907794FA03C1AE3932B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58bc8d.msi
- Size 31.8MB
- SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
- MD5 db7ca603d463a06806ff1660979f406d
- SHA1 823ade4e43d36416436a115c48ba562d94fa696f
- SHA512 8e2527478514cf5ec8b40fa0ffc53d91ae72a1ba75a8c96800e06282b5e76e2f2f61f4b9e979c15f691591ee4f926b17aa07aebf31de68638b13e94db702b8d5
- SSDEEP 786432:juvkjbX98hUIlkZpqcvX4kp1h1HnX6Jx5L3gxKF:ivk3X98hUUspqcvokD3yxU6
- TLSH T1FD77337234438836D5C26CB095E6C364D2A60D508EB42453A677B2BBDAF37C296F73E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagenthttp.dll
- Size 3.6MB
- SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
- MD5 c943a1cdbcd28058068b921cc8daa04e
- SHA1 2694d3588167cc0f940a30a5f4b13793e0cf181e
- SHA512 d5bee6a3a43d4b04e41d177af022ff03ac8a2971f0cc79265e00d027294e56b1de289773e487dba60664a6c9ba3d9f2f26bdd5453cc9220cd8313adf1868fd24
- SSDEEP 49152:eGvD7zfSmnd1o2Mm0A1qga6zN/zuNscwOWbKikCDp9ZqljvLQTeDTtJb83ph9h7Q:1D7zqmnd1oT4XN/zuNsSikq6Lzbs9VQ
- TLSH T1D106BF11FF82C176FECE1176827A4F7E4D3A9744076649C767A43AB80E311E26A3E247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dclibxml2.dll
- Size 2.1MB
- SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
- MD5 67cc424838fda84bad295b4459107c8b
- SHA1 404f865e84e6338735a0c38617d73031195c520f
- SHA512 1a3232bed3826065416a50866d02827765c66104ed49c533324f0cb614745028411bda63784f4f8c3819f9a72e65016171179d80d484d10e52300eaffbd44397
- SSDEEP 49152:e9DUM26DYbVgzTtuKlKuuGaXKbj/BAUZLYM7:TMfQgRBBAUZLT
- TLSH T1F9A5AE15F981C176E5E6807486FEEBB6982ECD31232460E376A639D45E341E232BD34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{2934c35d-5f9e-7f45-b706-aed11fc8e211}\SET9F6E.tmp
- Size 12KB
- SHA256 ff370bd017d038fd1b0d2536db051eb131e216a56020bc76a23400c4b4832b9c
- MD5 f68738a281b93205610468639ece3e3a
- SHA1 bc2e510f383ea86da3bc4e2ab4d49337344022bc
- SHA512 47e7f7e30a6f922b4465f22c2aad02ce631229d5a5fb81d8dae2089688f9135486d38ef21c377f54c42f9e4f6ef7452438ca2c8bc3bfb7e8ac7d32ffbc8dd674
- SSDEEP 192:NYXiNPMJCERLRnnXBEwZIhYCuwqXhHssDX01k9z3AJdOqVroJ:iFRLdRIh3pqXFDR9zW5r2
- TLSH T1D24209A285580083F8A7EC6003E8F8977C3D77CB6850549666AEF71E0DA33D9F75462D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{2934c35d-5f9e-7f45-b706-aed11fc8e211}\SET9F6F.tmp
- Size 3KB
- SHA256 6abdef9568f83803d07d67c3b984042f4b34e60324381382520b7601ea35824f
- MD5 01dd0083728e9d1ed427e103f17f693a
- SHA1 6a4377c77dd51a5ddc428b94adf78618711f4d99
- SHA512 ee1b2d521324ee8c81e7962f55c307e39ea0783ada96352b4f9bfea563e3ed065ec1a85f67899c09883f887c8c4e829ffe10f60eee34862584aafcaa8ac16448
- TLSH T10971DD9DA79382B4A69633607F173C83B7643054D0F6258472ED8188D7DA85DC2B93FE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{2934c35d-5f9e-7f45-b706-aed11fc8e211}\SET9F70.tmp
- Size 144KB
- SHA256 8f65278ad59e2c88707b9ec4e61819c06aac61c109845200f6e09f3297acbe2b
- MD5 b8b7de7e5bd7248e193eb35b0df88c82
- SHA1 6abcf9457d166ea9c1d5d64d4cc1b827b5a94e52
- SHA512 26eb870ea7f6d197223299412338e17fdca2d785f88b6b8a2ebbaaeedbddc48a2a5ef6f6c6fbac7884222277d376a95f682a9c1a2eb9016482913e299329dd03
- SSDEEP 3072:309jKtT5gk7a2HACGc5ifEk9z7FSYMWkyyk7gW2:4EgkHACr8fNlS+kyykEH
- TLSH T152E37C5B33B85496E9A7C479D9A15413EBB2F8821B2187CF07A4C5490F23BE0BD3D366
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{735bb925-e098-dd42-a7a6-299eaea9dd7c}\DCFAFilter.cat
- Size 11KB
- SHA256 13ca4fe14d26dd21d435e3574785d13f8812f09e4aec8bde236dfdaf1bd8c45a
- MD5 f8d0d70986deab9cf6ca833a281af42d
- SHA1 38a437a02ef3d03363c37a2630cb105f354387f7
- SHA512 9d16ab75e44828899fa9c102c9162255042d3d18ca47279190b1596b147b74ef5a268ecc83404495eb6aca3bec308e6172d22723c279a2bc5d78c035d884c714
- SSDEEP 192:fJKZa44JCERCaJ9EwvZvhYCzIFtLowcLK+X01k9z3AnOpzR/p:fvFFRNJZvh3kB6R9zj7
- TLSH T1104208B6966C4082F9B7AC7043D8E5977C3A27CB6850456625AFEB0E0DE73C8E71422C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{735bb925-e098-dd42-a7a6-299eaea9dd7c}\DCFAFilter.inf
- Size 3KB
- SHA256 f333d903628f9290d46f127c6cf9db0f1523298a458a42f5fca76aee4326a281
- MD5 95671eee18c5442dd174e5fc20985375
- SHA1 7d2f638af769a2f3313f01899d0b2f5ca36f1c69
- SHA512 5c5e0bb4bc635184ae946cb82c7debeb18f4243d136dc500275ca2463397a1115684da7b11d5a92f430dc0b59ca9a27fd5fc783121216e78c05122b2241f5537
- TLSH T17561EC6867929678AA863720BF17388377643184D0F4208837ED81C5A7D7D8EC4B17F6
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{735bb925-e098-dd42-a7a6-299eaea9dd7c}\DCFAFilter.sys
- Size 52KB
- SHA256 232b51747b0d296e16dfe7de614716e76e04e650939b123250f191eda5831e7b
- MD5 02e3129082cdf5b87bc1f7e57514e736
- SHA1 5a2e3cb039e943468bca02ccc98c52e2cc65902d
- SHA512 86db2dc81012e02008a823b59ee34fdfdfbd44013096ab82c29e9d291397934791f137fab4dc776b0a9db29f40ddbc9dfa22c6c95c3a35cfe1bc5a51f18a2b6a
- SSDEEP 768:Uh+jsO317r2Io0r24QE6QSSy66or29NgAMxkEPIi13N29zhD:Z5FkT66og4xLdCzhD
- TLSH T158335D968A610871EFA78971F0DA89077EB5BEC55F6080C70B4AC8403E6B7C1EF7964D
- MD5 SHA1 SHA512 SSDEEP TLSH